Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
“Customer hereby provides a general authorization to OpenAI to engage the Sub-Processors listed in the Sub-Processor List to process Customer Data in connection with the Services.”
“render OpenAI not a "service provider" under the CCPA or "processor" under U.S. Privacy Laws.”
“Customer represents, warrants and covenants that it has provided all necessary notices, and has and shall maintain throughout the Term all necessary rights, consents and authorizations...”
“To the extent OpenAI Ireland Limited transfers EEA and Swiss Data to other OpenAI Affiliates or third parties outside the European Economic Area or Switzerland...it will do so on the basis of agreements containing SCCs...”
“If none of the alternatives or solutions are commercially feasible, in OpenAI’s reasonable judgment, or if the objections have not been resolved to the satisfaction of the Parties within 30 days of OpenAI’s receipt of Customer’s objection notice, then either Party may terminate the Agreement or any Order Forms or usage regarding the Services that cannot be provided without the use of the new Sub-Processor.”
“OpenAI will, to the extent legally permitted, inform Customer if OpenAI receives a legally binding request for disclosure of Customer Data by a law enforcement authority.”
This document sets the rules for how OpenAI handles data that business customers provide when using its services. OpenAI can only use that data as the customer instructs, and cannot sell or share it under applicable privacy law definitions. If there is a security breach, OpenAI must notify the customer without undue delay, and after the agreement ends, OpenAI will return or delete the customer's data upon instruction.
This Data Processing Addendum establishes the terms under which OpenAI processes Customer Data on behalf of customers, grounding the relationship in a processor/service-provider model. OpenAI is obligated to process Customer Data only in accordance with Customer Instructions, unless applicable law requires otherwise, and is prohibited from selling or sharing Personal Data as defined under U.S. Privacy Laws and the CCPA. The DPA sets out Sub-Processor authorization on a general basis, with termination rights available to either party if a new Sub-Processor objection is unresolved. International transfers of EEA and Swiss Data by OpenAI Ireland Limited are conducted under Standard Contractual Clauses or applicable adequacy decisions. Customer-side obligations include maintaining all necessary consents and authorizations for Customer Data throughout the Term, and customers must not take actions that would cause OpenAI to lose its service-provider or processor status under applicable law.
For a business customer, this document means OpenAI is bound to process their data only as directed, must promptly notify them of any Personal Data Breach, and must return or delete their data after the agreement ends when instructed to do so. Customers bear responsibility for ensuring they have all necessary consents and rights for the data they provide to OpenAI throughout the entire duration of the agreement. Customers who object to a newly added Sub-Processor and cannot reach resolution have the right to terminate the Agreement or the specific services requiring that Sub-Processor. Audit rights to verify OpenAI's data handling practices are limited to once per year and are conducted at the customer's sole expense.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
1 important change detected
4 versions captured · Latest change detected by ConductAtlas: May 2026
“Customer hereby provides a general authorization to OpenAI to engage the Sub-Processors listed in the Sub-Processor List to process Customer Data in connection with the Services.”
“render OpenAI not a "service provider" under the CCPA or "processor" under U.S. Privacy Laws.”
“Customer represents, warrants and covenants that it has provided all necessary notices, and has and shall maintain throughout the Term all necessary rights, consents and authorizations...”
“To the extent OpenAI Ireland Limited transfers EEA and Swiss Data to other OpenAI Affiliates or third parties outside the European Economic Area or Switzerland...it will do so on the basis of agreements containing SCCs...”
“If none of the alternatives or solutions are commercially feasible, in OpenAI’s reasonable judgment, or if the objections have not been resolved to the satisfaction of the Parties within 30 days of OpenAI’s receipt of Customer’s objection notice, then either …”
“OpenAI will, to the extent legally permitted, inform Customer if OpenAI receives a legally binding request for disclosure of Customer Data by a law enforcement authority.”
“Following expiry or termination of the Agreement, OpenAI will, at Customer's instruction, return or delete Customer Data, and existing copies unless retention of Customer Data is required under applicable laws...”
“OpenAI will notify Customer without undue delay after becoming aware of any Personal Data Breach.”
“OpenAI will process Customer Data only in accordance with Customer Instructions, unless required to do so by applicable law to which OpenAI is subject...”
“not "sell" (as such term is defined by U.S. Privacy Laws) or "share" (as such term is defined by the CCPA) Personal Data...”
“Subject to the limitations of liability included in the Agreement, OpenAI will remain liable for the acts and omissions of its Sub-Processors to the same extent OpenAI would be liable under this DPA if it performed such acts or omissions …”
“allow for and contribute to audits or inspections by, or on behalf of, Customer at Customer's sole expense...occur no more than once per year.”
Every distinct legal provision identified in this document. Featured provisions appear above with analysis.
OpenAI has updated this document before. Monitor includes same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Customer grants general authorization to listed Sub-Processors and similar clauses.
Compare across platforms →OpenAI expanded its data sharing terms to include third-party marketing partners. The updated policy authorizes the use of personal data fo…
872 provisions across 8 AI platforms. The terms your AI provider sets become the terms your product operates under.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
The bill does not regulate most AI startups directly. But it changes the companies they depend on. Here is what the first federal AI law wo…
H.R. 8094 would make the FTC the referee for AI model disclosure. It also names system cards as a way to comply, which turns a voluntary in…
Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 352+ platforms.