OpenAI's enterprise privacy framework includes disclosure of the third-party subprocessors it uses to deliver ChatGPT Enterprise and API services, allowing enterprise customers to assess the data sharing chain.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
GDPR Article 28 requires processors to obtain prior authorization from the data controller before engaging subprocessors, and the controller must be informed of any intended changes; the subprocessor list is the mechanism for this disclosure.
Interpretive note: The subprocessor disclosure provision is inferred from the document's enterprise privacy scope; the specific mechanism and notification requirements were not available in the provided HTML.
Enterprise customers whose personal data is processed by OpenAI subprocessors should review the subprocessor list to understand which third parties may access their data, and should confirm their DPA includes notification rights for subprocessor changes.
How other platforms handle this
Crusoe (Sees code data for inference): We manage Crusoe's compute for training some of our custom models, as well as hosting some of our custom models. Modal (Sees code data for inference): We manage Modal's compute for training some of our custom models, as well as hosting some of our custom models...
Mistral AI will provide reasonable notice to the Customer of any changes to the list of Subprocessors prior to engaging such Subprocessor. The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to...
We may disclose your information with our business partners. We may share your personal information with our business partners, such as companies that partner with us to offer certain products or services. We may share your personal information with advertising partners. We work with third-party adv...
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
(1) REGULATORY LANDSCAPE: GDPR Article 28(2) and (4) require that subprocessors be subject to the same data protection obligations as the primary processor, and that the controller be informed of and able to object to subprocessor changes. UK GDPR imposes equivalent requirements. CCPA requires that service provider agreements flow down restrictions to any third parties that access personal information. (2) GOVERNANCE EXPOSURE: Medium. Subprocessor lists are standard in enterprise AI service agreements, but the risk level depends on whether the DPA includes prior notice or prior consent mechanisms for subprocessor changes and whether the list is kept current. (3) JURISDICTION FLAGS: EU and UK customers face the highest exposure if subprocessor changes occur without adequate notice or if subprocessors lack compliant data transfer mechanisms (SCCs, adequacy decisions) for cross-border transfers. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm whether the DPA requires prior consent or only prior notice for subprocessor additions, and should track the subprocessor list as part of ongoing vendor management. Any subprocessors processing EU personal data should have compliant transfer mechanisms documented. (5) COMPLIANCE CONSIDERATIONS: Legal teams should incorporate subprocessor change notification monitoring into their GDPR compliance workflows and maintain records of any objections raised to subprocessor changes.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
GDPR Article 28 requires processors to obtain prior authorization from the data controller before engaging subprocessors, and the controller must be informed of any intended changes; the subprocessor list is the mechanism for this disclosure.
Enterprise customers whose personal data is processed by OpenAI subprocessors should review the subprocessor list to understand which third parties may access their data, and should confirm their DPA includes notification rights for subprocessor changes.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.