How does OpenAI's OpenAI Data Processing Addendum affect users?

This addendum applies primarily to individuals whose personal data is processed by businesses using the OpenAI API rather than to direct ChatGPT users. The agreement establishes that OpenAI will delete or return personal data upon termination of the business customer's service and designates the business operator as the primary party responsible for receiving and processing data subject requests. Individuals seeking to exercise data rights must direct requests to the business operator rather th…

How often is OpenAI's OpenAI Data Processing Addendum updated?

ConductAtlas monitors this document daily and captures every version with cryptographic hashing and timestamp verification. Update frequency varies — see the change timeline on this page for complete version history.

Can I get alerted when OpenAI updates this document?

Yes. Monitor subscribers ($19/month) can add OpenAI to their watchlist and receive same-day email alerts whenever this document or any other OpenAI document changes.

CA-D-000757

OpenAI Data Processing Addendum

OpenAI

Last change detected June 6, 2026 Data processing addendum

SHA-256: a140b365afe4e3f2cfb… 3 versions captured 2 changes documented

Create free account

Track 1 platform and get the weekly governance digest. No credit card required.

View original document at OpenAI ↗

This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology

10 Total

1 High severity

6 Medium severity

3 Low severity

Summary

This document establishes OpenAI's data processing terms for business customers who submit personal data through the OpenAI API. The agreement specifies that OpenAI processes personal data only according to documented instructions from the business customer and does not sell or disclose that data to third parties. The document further authorizes OpenAI to assist business customers in responding to data subject requests for access, deletion, and correction.

Technical / Legal Breakdown

This document is OpenAI's Data Processing Addendum (DPA), governing the processing of personal data by OpenAI as a data processor on behalf of business customers (operators) who use OpenAI's API and related services, with its legal basis rooted in GDPR Article 28 and equivalent data processor contractual requirements under UK GDPR, Swiss data protection law, and other applicable frameworks. The agreement states that OpenAI will process personal data only on documented instructions from the operator, will implement appropriate technical and organizational security measures, will assist operators in fulfilling data subject rights requests, and will delete or return personal data upon termination of services. The DPA authorizes OpenAI to engage sub-processors from a published list, requiring only that operators be given advance notice and an opportunity to object rather than affirmative consent, which is a standard but operationally significant mechanism that compliance teams should evaluate against their own vendor management obligations. The document engages GDPR (including Standard Contractual Clauses for international transfers), UK GDPR, the Swiss Federal Act on Data Protection, CCPA/CPRA (where OpenAI commits to not selling or sharing personal data and to processing it only for specified business purposes), and HIPAA (addressed through a separate Business Associate Agreement). Material compliance considerations include mapping operator instructions to lawful processing bases, maintaining sub-processor oversight, and ensuring that SCCs are properly incorporated for transfers of EU/EEA personal data to the United States.

Institutional Analysis

Institutional analysis available with Compliance

Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.

Start Compliance free trial

2 important changes detected

3 versions captured · Last updated: June 2026

June 6, 2026

low

What changed OpenAI removed the full language selector list from the header of their Data Processing Addendum on June 6, 2026, replacing it with a collapsed menu indicator ('...'). The document substance, effective date (January 1, 2026), and legal definitions remain unchanged. This is a formatting change to how the document is presented, not a modification of the data processing terms, rights, or obligations themselves.

Why this matters This change does not affect the substance of OpenAI's Data Processing Addendum or the terms governing data processing practices. The document language, legal definitions, obligations, and effective date remain identical. The change is limited to how the language selection interface is displayed on the webpage.

View full change record →

May 23, 2026

low

What changed OpenAI updated the language selection interface in their Data Processing Addendum on May 23, 2026. The change added five additional language options to the language selector menu (Armenian, Georgian, Icelandic, Maltese, and Somali) while keeping all substantive terms identical. This is a formatting and localization update with no change to the underlying data processing rights, obligations, or protections.

Why this matters This change does not alter any substantive terms of the Data Processing Addendum. The updated document now offers the agreement in five additional languages: Armenian, Georgian, Icelandic, Maltese, and Somali. The rights, obligations, and data processing authorizations remain identical across all language versions.

View full change record →

Recent Provision Changes Jun 6, 2026

10 provisions unchanged.

View full change record →

High — 1 provision

HIPAA Business Associate Agreement Carve-Out Compare →

OpenAI's standard API services are not set up for healthcare data protected under US law. If you want to use the API with patient health data, you must sign a separate legal agreement with OpenAI first.

Added May 12, 2026 Standard Seen across 284 platforms

Medium — 6 provisions

Processor Instruction Requirement Compare →

OpenAI will only process personal data in the way the business customer tells it to, unless a law requires otherwise. The business customer is responsible for making sure those instructions are lawful.

Added May 12, 2026 Standard Seen across 284 platforms
Sub-Processor Authorization and Objection Compare →

OpenAI can add new third-party suppliers to process your data by posting an update to its sub-processor list. You have a limited window to object, and if you do, OpenAI will try to find a workaround but may not be able to guarantee one.

Added May 12, 2026 Standard Seen across 252 platforms
International Data Transfer Mechanisms (SCCs) Compare →

When personal data about people in the EU, UK, or Switzerland is processed in the US or another country without equivalent privacy protections, OpenAI uses standard contractual clauses approved by regulators to make that transfer legal.

Added May 12, 2026 Standard Seen across 284 platforms
CCPA No-Sale and Service Provider Commitment Compare →

OpenAI commits that it will not sell personal data submitted by API business customers and will only use it to provide the contracted service, as required for CCPA service provider status.

Added May 12, 2026 Standard Seen across 284 platforms
Data Subject Rights Assistance Compare →

If someone asks OpenAI directly about their personal data, OpenAI will pass that request to the business customer who is responsible for responding. OpenAI will also help businesses technically respond to deletion, access, and correction requests.

Added May 11, 2026 Standard Seen across 284 platforms
Security Measures and Breach Notification Compare →

OpenAI commits to maintaining security protections for API customer data and to notifying the business customer promptly if there is a data breach affecting their data.

Added May 12, 2026 Standard Seen across 284 platforms

Low — 3 provisions

Data Deletion and Return on Termination Compare →

When the API service agreement ends, OpenAI will either return or delete the business customer's personal data, unless a law requires it to keep certain data.

Added May 12, 2026 Standard Seen across 284 platforms
Confidentiality of Processing Compare →

OpenAI commits that its staff and others who access API customer personal data are bound by confidentiality obligations, either by contract or by law.

Added May 12, 2026 Standard Seen across 284 platforms
Audit Rights Compare →

Business customers have the right to audit OpenAI's compliance with this DPA, either directly or through a third-party auditor, as long as they give reasonable notice and keep findings confidential.

Added May 12, 2026 Standard Seen across 284 platforms