This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
SCCs are the primary legal mechanism enabling EU-to-US personal data transfers following the invalidation of Privacy Shield. The DPA's incorporation of SCCs is essential for EU and UK customers to lawfully transfer personal data to OpenAI's US-based infrastructure.
Interpretive note: The adequacy of SCCs for US transfers remains subject to ongoing regulatory interpretation, particularly regarding supplementary measures required after the Schrems II ruling, and individual supervisory authorities may apply differing standards.
This document primarily affects businesses using the OpenAI API rather than individual ChatGPT consumers, governing how personal data about individuals processed through those business products is handled. The agreement states that OpenAI will not sell or share personal data submitted via the API, will assist operators in responding to data subject access, deletion, and correction requests, and will delete or return personal data upon termination. You can contact the operator (the business whose product you use) to exercise data subject rights such as access or deletion, as the DPA assigns responsibility for handling those requests to the operator in the first instance.
How other platforms handle this
When we transfer personal data outside the European Economic Area, United Kingdom, or Switzerland, we use appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, to ensure your data is protected.
Personal data collected by Unity may be transferred to and processed in countries outside of the European Economic Area, including the United States, where data protection laws may differ from those in your country. Where we transfer personal data from the EEA or the UK, we rely on appropriate safeg...
We may transfer, process, and store all personal information we collect anywhere in the world. Different countries have different data protection laws. If we transfer personal information from the European Economic Area, Switzerland, Brazil and/or the United Kingdom to a country that does not provid...
Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"To the extent that OpenAI processes Customer Personal Data protected by EU Data Protection Law in a country that has not been recognized as providing an adequate level of protection, the parties agree that the EU SCCs are incorporated into this DPA by reference. The applicable module of the EU SCCs will depend on the capacity in which Customer and OpenAI act with respect to the processing of Customer Personal Data.— Excerpt from OpenAI's OpenAI Data Processing Addendum
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
SCCs are the primary legal mechanism enabling EU-to-US personal data transfers following the invalidation of Privacy Shield. The DPA's incorporation of SCCs is essential for EU and UK customers to lawfully transfer personal data to OpenAI's US-based infrastructure.
ConductAtlas has identified this type of provision across 12 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.