Is ChatGPT GDPR compliant? OpenAI API SOC 2 and GDPR guide

The short answer: ChatGPT Teams and Enterprise are GDPR compliant when properly configured. The ChatGPT free and Plus consumer tiers are not suitable for processing personal data under GDPR. The OpenAI API is GDPR compliant with a signed DPA and the right configuration. Which tier your team uses is what matters.

Here is what OpenAI's compliance documentation actually says, what you need to document before your next audit, and what your CTO needs to know before your next enterprise security review.

OpenAI's compliance certifications

OpenAI maintains a SOC 2 Type II report covering security, availability, and confidentiality trust service categories. The report is available under NDA through OpenAI's enterprise sales team and through the OpenAI trust portal at trust.openai.com.

OpenAI also maintains ISO 27001 certification, which covers information security management. The certificate is available through their trust portal.

For GDPR, OpenAI offers a Data Processing Addendum (DPA) that includes Standard Contractual Clauses (SCCs) for transfers from the EU to the United States. The DPA is available to API customers and Teams/Enterprise plan subscribers.

ChatGPT tiers and what each means for compliance

ChatGPT Free and Plus: Consumer product terms. No DPA available. OpenAI states that conversations may be used to train models unless you opt out in settings. Not suitable for any work involving personal data or company-sensitive information.

ChatGPT Teams: Business product terms. DPA available. Zero data retention by default (conversations are not used to train models). SOC 2 report available. Suitable for internal productivity use where personal data may be incidentally included. For this tier, GDPR compliance depends on enabling the right settings and signing the DPA.

ChatGPT Enterprise: Same as Teams with additional controls including SSO integration, admin controls over data access, domain verification, and priority support. Best option for companies where GDPR compliance and auditability are required.

OpenAI API: API platform terms. DPA available. Zero training on API inputs and outputs by default (this has been OpenAI's policy since March 2023). Suitable for building AI features into products. The developer is responsible for ensuring that downstream handling of data meets GDPR requirements.

The DPA: what it covers and what to verify

Before processing any personal data with OpenAI, you need a signed DPA. For ChatGPT Teams and Enterprise, the DPA is incorporated into the subscription agreement. For API access, you need to explicitly execute the DPA addendum.

The OpenAI DPA covers:

• Processor relationship (OpenAI is a processor, your company is the controller)
• Standard Contractual Clauses (EU to US transfer mechanism)
• Sub-processor disclosure and notification requirements
• Data subject rights assistance
• Security obligations
• Deletion and return of data on termination

What to verify: confirm that the DPA you have on file covers the specific OpenAI products you use. Teams, Enterprise, and API are covered separately. If your team uses multiple OpenAI products, you may need more than one agreement or a master agreement that covers all products.

Data residency

OpenAI processes data primarily in the United States. EU customers on Enterprise plans can request data residency options, but US processing is the default. For GDPR transfers, the SCCs in the DPA provide the legal mechanism for US processing. If your company operates under stricter data residency requirements (German public sector, healthcare, or finance-specific requirements), verify with OpenAI whether your needs can be met.

SOC 2 scope: what is actually covered

OpenAI's SOC 2 report covers the systems that process API requests and ChatGPT conversations. It covers the security controls around OpenAI's infrastructure, access management, incident response, and change management. It does not cover OpenAI's research operations or model training infrastructure, which sits outside the SOC 2 boundary.

For your vendor assessment, pull the current SOC 2 report and check: the audit period (should be current, with a Type II report covering the trailing twelve months), the scope boundary (confirm your use case falls within it), and any exceptions or control deficiencies noted.

What to tell your customers when they ask

Enterprise customers will ask about your use of OpenAI. They want to know what data you send, whether you have a DPA, and whether their data is used for training. Have these answers documented:

What data we send to OpenAI: Specify which product features use OpenAI APIs. Name the data types that may be included in prompts (for example: support ticket text, code, document summaries). If you strip PII before sending to the API, say so.

DPA status: "We have a signed DPA with OpenAI that includes Standard Contractual Clauses for GDPR-compliant EU-to-US transfers."

Training: "We use the OpenAI API, which does not use our inputs or outputs to train OpenAI models by default."

Data retention: State OpenAI's current retention policy for API data, which as of 2026 is zero retention by default unless you have explicitly enabled storage features.

SOC 2 controls to document internally

If you use OpenAI in your product or workflows, these are the internal controls your auditor will look for:

Vendor inventory entry. Document OpenAI in your CC9.1 vendor inventory with data classification, risk tier, DPA reference, SOC 2 report reference, and next reassessment date.

Access controls. Who can create or use OpenAI API keys at your company? CC6 requires logical access controls. API keys should be stored in a secrets vault, rotated on a schedule, and revoked immediately when an employee leaves.

Data classification policy. Your acceptable use policy should specify which data classifications are permitted in OpenAI API calls. Customer PII, production credentials, and regulated data should not be sent without explicit policy guidance and technical controls (like PII stripping middleware).

Audit logging. If you call the OpenAI API in your product, log every call with metadata: timestamp, tenant, model, token count, and outcome. Do not log the full prompt or response if it contains sensitive data.

Incident response. Document the process for how you would respond to an OpenAI security incident that affects your customer data. This is a CC7 requirement.

Quick compliance checklist

Keeping OpenAI audit-ready means maintaining your AI vendor inventory, pulling trust reports on a schedule, and mapping OpenAI's controls to your SOC 2 and GDPR evidence requirements. If you would rather a fractional CISO owned that than carry it yourself, book a call.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.