OpenAI Data Processing Addendum

This document sets the rules for how OpenAI handles data that business customers provide when using its services. OpenAI can only use that data as the customer instructs, and cannot sell or share it under applicable privacy law definitions. If there is a security breach, OpenAI must notify the customer without undue delay, and after the agreement ends, OpenAI will return or delete the customer's data upon instruction.

This Data Processing Addendum establishes the terms under which OpenAI processes Customer Data on behalf of customers, grounding the relationship in a processor/service-provider model. OpenAI is obligated to process Customer Data only in accordance with Customer Instructions, unless applicable law requires otherwise, and is prohibited from selling or sharing Personal Data as defined under U.S. Privacy Laws and the CCPA. The DPA sets out Sub-Processor authorization on a general basis, with termination rights available to either party if a new Sub-Processor objection is unresolved. International transfers of EEA and Swiss Data by OpenAI Ireland Limited are conducted under Standard Contractual Clauses or applicable adequacy decisions. Customer-side obligations include maintaining all necessary consents and authorizations for Customer Data throughout the Term, and customers must not take actions that would cause OpenAI to lose its service-provider or processor status under applicable law.

For a business customer, this document means OpenAI is bound to process their data only as directed, must promptly notify them of any Personal Data Breach, and must return or delete their data after the agreement ends when instructed to do so. Customers bear responsibility for ensuring they have all necessary consents and rights for the data they provide to OpenAI throughout the entire duration of the agreement. Customers who object to a newly added Sub-Processor and cannot reach resolution have the right to terminate the Agreement or the specific services requiring that Sub-Processor. Audit rights to verify OpenAI's data handling practices are limited to once per year and are conducted at the customer's sole expense.