OpenAI offers a formal GDPR data processing agreement that includes the EU's Standard Contractual Clauses for customers who need it, which is required for legally transferring personal data from the EU to the US.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
A DPA incorporating SCCs is a legal requirement under GDPR for transferring personal data from the EU/EEA to a third country such as the United States. The document states this is available but requires the customer to request it, meaning it is not automatically in place.
Interpretive note: The document does not specify which SCC module is used, whether a Transfer Impact Assessment is provided, or what supplementary technical measures are in place, all of which are required for full GDPR Chapter V compliance.
The updated terms state that workspace admins 'can control' data retention rather than directly controlling it. This conditional phrasing may suggest that retention control is optional or contingent rather than a guaranteed capability. Enterprise customers relying on admin-driven data retention policies should clarify with OpenAI whether this change affects their ability to set specific retention timelines for workspace data.
View change record →The updated terms shift governance of conversation access and retention from end users to workspace administrators. Under the revised policy, workspace admins can now view, access, export, and delete any end user conversations within their workspace and control how long workspace data is retained. Additionally, OpenAI now reserves the right to retain deleted or unsaved conversations beyond the standard 30-day deletion window if retention is reasonably necessary to protect its services or any third party from harm, beyond prior language that limited retention extensions to legal requirements. Within an enterprise account, end users no longer have unilateral control over conversation visibility or deletion of their own conversations.
View change record →EU/EEA enterprise customers handling personal data must have an executed DPA with SCCs to comply with GDPR data transfer requirements; the document states this is available upon request rather than automatically provided.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"We offer a Data Processing Addendum (DPA) that incorporates Standard Contractual Clauses (SCCs) for customers who require it for GDPR compliance.Excerpt from OpenAI's Enterprise Privacy
REGULATORY LANDSCAPE: This provision directly engages GDPR Chapter V (transfers to third countries), specifically the SCC mechanism established under Article 46(2)(c).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
A DPA incorporating SCCs is a legal requirement under GDPR for transferring personal data from the EU/EEA to a third country such as the United States. The document states this is available but requires the customer to request it, meaning it is not automatically in place.
EU/EEA enterprise customers handling personal data must have an executed DPA with SCCs to comply with GDPR data transfer requirements; the document states this is available upon request rather than automatically provided.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.