Sovereignty & compliance

Is OpenAI GDPR-compliant? What ChatGPT and the API do with your data

Yes and no. OpenAI gives business and API customers the contractual tools the GDPR expects — a data processing addendum signed with OpenAI Ireland, standard contractual clauses for transfers — and many European companies use it lawfully. But OpenAI is a US company, so a US order under the CLOUD Act can reach data it controls wherever that data is stored, and no contract removes that. Whether it matters depends on what you send, and on who has to answer for it.

Published 6 Oct 2026 · checked on 20 Oct 2026

“Compliant” means two different things

The question hides two others. The first is procedural: do the contracts, the transfer mechanism and the controls let you, the customer, meet your own GDPR duties? The second is jurisdictional: can a state outside the EU compel the provider to hand over your data, whatever the contract says?

A provider can be solid on the first and exposed on the second, and the reverse happens too. When a European company asks whether OpenAI is “GDPR-compliant”, it usually means the second question — can US law reach my data? — even when it uses the word for the first.

ChatGPT for individuals, in OpenAI's own words

For the consumer app, OpenAI's help centre is explicit. The quotes below were read on 29 September 2026; the training sentence was read again on 6 October 2026.

Topic	What OpenAI writes	Source
Where conversations are stored	“Content is stored on OpenAI systems and our trusted service providers' systems in the US and around the world.”	Help centre
How long they are kept	“Regular and archived chats remain saved to your account until you delete them or an applicable workspace retention policy removes them.”	Help centre
Training	“When you use our services for individuals, such as ChatGPT and Codex, we may use your content to train our models.”	Help centre
Human review	“Please do not enter sensitive information that you would not want reviewed or used.”	Help centre
Keeping data in Europe	Offered to “Eligible API customers and new ChatGPT Enterprise/Edu customers” — not to consumer plans	Help centre

Users can switch training off and delete their chats, and the GDPR applies to ChatGPT in Europe like to any other service: rights of access, erasure and objection remain. What the table shows is the default position of a consumer service run from the United States.

The API and business plans: the contractual side

For business and API customers, OpenAI's Data Processing Addendum — effective 1 January 2026, read on 6 October 2026 — is signed with OpenAI Ireland Ltd. when the customer is based in the EEA or Switzerland. When OpenAI Ireland transfers that data outside the EEA, the addendum relies on standard contractual clauses or on an adequacy decision under Article 45 of the GDPR.

On training, OpenAI writes: “By default, we don’t use inputs or outputs from ChatGPT Business, ChatGPT Enterprise, ChatGPT Edu, or our API to improve our models.” (help centre, read on 6 October 2026). Data residency in Europe is available to eligible API and Enterprise or Edu customers.

For a wide range of workloads, that is a defensible GDPR set-up, and your counsel may well accept it. It answers the procedural question. It does not answer the jurisdictional one.

Transfers after Schrems II

Sending personal data to a company in the United States is a transfer under Chapter V of the GDPR. It needs an adequacy decision or appropriate safeguards such as standard contractual clauses. Since the Schrems II judgment of 2020, which examined US surveillance law, relying on those clauses means assessing whether the recipient can actually honour them — the transfer impact assessment your data protection officer will ask for.

The EU-US Data Privacy Framework, adopted in 2023, is the current adequacy decision for US organisations certified under it; it survived a first challenge in September 2025, and an appeal is pending (details in our GDPR and CLOUD Act guide). Either way, these mechanisms govern how data may leave Europe. None of them changes which government can give orders to the recipient.

The CLOUD Act: the part no contract removes

The CLOUD Act lets US authorities compel a provider under US jurisdiction to disclose data in its “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. § 2713). The Department of Justice adds that US jurisdiction “is not limited to U.S. corporations” (CLOUD Act FAQ, 2019). An Irish subsidiary can sign European contracts; the US parent that controls the data remains reachable.

A concrete example of a US court deciding what OpenAI keeps came in 2025, in the copyright case brought by The New York Times: OpenAI was ordered to preserve ChatGPT and API output data. OpenAI later wrote that “we are no longer under a legal order to retain consumer ChatGPT and API content indefinitely. Our obligations under the earlier order ended on September 26, 2025.” (OpenAI, update of 22 October 2025). That was a preservation order in a civil case, not a CLOUD Act request — but it shows where such decisions are made.

What stays on your side, whoever the provider

When you send personal data to an AI service, you are the controller and the provider is your processor. Much of the GDPR sits with you, whichever provider you pick:

A lawful basis for the processing, documented (Article 6).
Data minimisation: send only the personal data the task needs (Article 5). Much of the “GDPR problem” with AI tools is data that should never have been sent.
Purpose limitation: data collected for one purpose is not reused for another — model training included — without a basis.
A processor contract (Article 28) and a record of processing (Article 30) that says what goes to which provider, and why.
Retention and data-subject rights, including for the prompts and logs you keep yourself.

When it matters, and when it does not

If your data processing addendum and the standard contractual clauses satisfy your counsel, and nothing in your contracts forbids non-EU jurisdiction, using OpenAI is a legitimate choice.
If you work in a regulated sector — health, legal, some financial services, public procurement — or a client's contract says “no processing under non-EU jurisdiction”, the provider's nationality is the problem, and paperwork does not fix it.
If you are an individual, decide what you type. OpenAI itself asks users not to enter what they would not want reviewed.

None of this is a judgment on OpenAI's engineering or its intentions. It is a question of which law governs the company, and that is decided by who controls it, not by where its servers are.

The European alternative, and its limits

Evanesca is an AI agent and chat, with an OpenAI-compatible API, whose models all run in Europe — most of them in France at Scaleway, with OVHcloud as a fallback, Mistral's own models in Mistral AI's EU region, others at AKI.IO in Germany, Apertus at Infomaniak in Switzerland. OVHcloud, Scaleway, Mistral AI and Infomaniak are European companies with no US parent, which puts them outside the CLOUD Act's direct reach; AKI.IO is a German company whose shareholders are not published. Evanesca does not store prompts or answers and never trains on them; your history stays in your browser, and of each message it keeps only the billing: tokens and cost. What the operators keep is theirs to say: Scaleway may keep and read requests that cause errors or look abusive, for up to 14 days (Scaleway, read on 6 October 2026), and Mistral AI keeps its models' inputs and outputs 30 days to monitor abuse; it lets its customers object to training, and Evanesca's account objects, except for what is sent to Mistral Large 4: it is a preview, and Mistral's commercial terms let it use the data of preview models for training, whatever the objection (Mistral AI, read on 12 October 2026).

For teams, the Business offer adds a signed Article 28 DPA and a sub-processor list with notice and a right to object.

The limits, plainly: you choose among other makers' models, not OpenAI's own, all run in Europe; and Evanesca is not open yet. A side-by-side reading of ChatGPT, Claude, Gemini, Copilot and Meta AI policies is on the sources page.

Frequently asked questions

Is ChatGPT GDPR-compliant?

The GDPR applies to ChatGPT in Europe and users keep their rights. But by OpenAI's own pages, consumer conversations are stored in the US and around the world, kept until you delete them, and may be used for training unless you opt out. And OpenAI, as a US company, remains within reach of the CLOUD Act.

Is the OpenAI API GDPR-compliant?

Procedurally, for many uses: EEA customers sign a data processing addendum with OpenAI Ireland, transfers rely on standard contractual clauses or an adequacy decision, and API data is not used for training by default. Jurisdictionally, OpenAI remains a US company that a US order can reach.

Does OpenAI's European data residency protect data from the CLOUD Act?

No. Residency decides where data is stored and processed; the CLOUD Act follows the company that controls it, wherever it is stored. A European region changes the address, not the government that can give the company orders.

Are standard contractual clauses enough?

Often, together with a transfer impact assessment. They are a lawful transfer mechanism. They cannot give you an assurance that no US court can reach your data: if your contracts or your sector require that, you need a provider with no US parent.

What does a European alternative to ChatGPT look like?

A service whose operators have no US parent, that says where each model runs and what is kept. Evanesca runs its models in Europe, most of them in France at Scaleway, with OVHcloud as a fallback, and stores no prompt; the details are on the sovereignty page.