Is ChatGPT GDPR compliant for business use?

Who is responsible when an employee uses ChatGPT?

The GDPR sets out two roles (Article 4). The controller decides why and how personal data is processed. The processor handles it on the controller's behalf and follows its instructions.

When a sales rep pastes a client's email into an assistant to draft a reply, your company decides on that processing, so it's the controller, whatever the tool.

Article 28 then asks for two things: only use a processor that offers sufficient guarantees, and govern its work with a contract. Without one, you can't give instructions, demand deletion or know where the data goes.

What does a business plan with a DPA change?

The DPA is OpenAI's processing contract. In the version in force since January 1, 2026, OpenAI commits to act as a processor, and for customers based in the European Economic Area or Switzerland the contract is with OpenAI Ireland Ltd. OpenAI says it signs this DPA for ChatGPT Business, ChatGPT Enterprise and the API, on request through a form.

These plans also keep your data out of model training by default and come with an admin console to manage accounts.

A personal account (Free, Go, Plus or Pro) has none of that. The employee accepts OpenAI's terms in their own name, and OpenAI Ireland Limited, which has provided ChatGPT to European users since February 15, 2024, processes the data as controller under its own privacy policy. Your company has no say over what was typed in.

What rules apply to the data your teams enter?

Every processing activity needs one of the six legal bases in Article 6. For everyday work, like answering a client or preparing a file, it's usually performance of a contract with that person or the company's legitimate interest. The choice is yours, and it goes in your record of processing.

Data minimization (Article 5) means entering only what the task needs. To rewrite an email or summarize a contract, the client's name, address or file number is often unnecessary, and removing them takes seconds.

Special category data under Article 9 (health, ethnic origin, political opinions, religious beliefs, union membership, sexual orientation, genetic and biometric data) can only be processed in narrow cases. In a general-purpose assistant, keep it out.

People whose data you process must be told (Articles 13 and 14). Your privacy notice lists categories of recipients, including processors such as an AI provider.

Does the data end up in the United States?

Chapter V of the GDPR governs any transfer outside the European Economic Area. OpenAI's DPA says European data is processed by OpenAI Ireland Limited, and that any transfer to other OpenAI entities or third parties outside Europe relies on the Commission's standard contractual clauses or on an adequacy decision.

For the US, the adequacy decision in force is the Data Privacy Framework, adopted by the Commission on July 10, 2023. It covers US companies that join the framework. On September 3, 2025, the EU General Court dismissed French MP Philippe Latombe's challenge seeking its annulment. He appealed to the Court of Justice on October 31, 2025; according to the legal sources we checked, no ruling had been issued as of November 5, 2026.

Since February 2025, OpenAI has also offered data storage in Europe for new ChatGPT Enterprise and Edu workspaces and for API projects, and since January 2026 in-region processing in Europe for some Enterprise and Edu customers. Storage in Europe doesn't cover everything, account and billing data for instance, so ask what your plan includes.

What happened in Italy?

On March 30, 2023, the Garante, Italy's data protection authority, ordered an emergency restriction on OpenAI's processing of Italian users' data. It cited missing notices to users, no legal basis for training the models and no age verification, after a March 20 leak of conversations and payment details. ChatGPT came back in Italy in late April 2023 once measures were in place.

On December 20, 2024, the Garante closed its investigation with a €15 million fine. It found that OpenAI had not notified it of the March 2023 breach, had trained its models on user data without first identifying a legal basis, had fallen short on transparency and did not check users' ages. It ordered a six-month public information campaign and passed the file to the Irish authority, OpenAI's lead regulator since the company set up its European headquarters in Ireland.

On March 18, 2026, the Court of Rome upheld OpenAI's challenge and annulled that decision (judgment no. 4153/2026). The Garante took it down from its website. The underlying questions, such as the legal basis for training, now sit with the Irish authority.

What do European regulators and the CNIL say?

The European Data Protection Board (EDPB) brought EU regulators together in a ChatGPT task force. Its report of May 23, 2024 says users must be clearly told that what they enter may be used for training, and that OpenAI can't shift GDPR responsibility onto them through a clause in its terms. It also notes that ChatGPT's answers are likely to be taken as accurate, including about real people.

On December 18, 2024, at the Irish authority's request, the EDPB published Opinion 28/2024 on AI models. It answers three questions: when a model can be considered anonymous, whether legitimate interest can justify building or using it, and what happens when a model was trained on unlawfully processed data. On that last point, the lawfulness of deploying the model can be affected.

In France, the CNIL said in May 2023 that it had received several complaints against OpenAI and opened an investigation. In July 2024 it published a Q&A for organizations rolling out generative AI: start from a specific need, set rules in an internal policy, only enter information you're allowed to share, train users, involve the data protection officer. When a third party hosts the tool, it calls for a processing contract. On consumer services, kept for non-confidential uses, it advises against accounts opened with personal email addresses and asks you to turn off data reuse where possible.

Its 2025 recommendations, on informing people and handling their rights in February and on legitimate interest in June, are mainly aimed at those who build AI systems. For small businesses, the CNIL also points to four practical guides from France Num, written with the CPME employers' federation.

Do you need a DPIA?

Article 35 requires a data protection impact assessment (DPIA) before any processing likely to result in a high risk to people's rights and freedoms. According to the CNIL, it's mandatory when the processing is on its list, or when it meets at least two of nine European criteria: evaluation or scoring, automated decisions with legal effect, systematic monitoring, sensitive or highly personal data, large scale, combining datasets, vulnerable people, innovative use, and denial of a right or service.

An assistant that helps draft emails often won't trigger one on its own. It becomes likely if you use it to screen candidates, assess employees, handle health files or process client data in volume. When in doubt, the CNIL recommends doing one.

What should your company do?

Eight steps, most urgent first:

• For any use involving personal data, choose a business plan with a DPA (at OpenAI: ChatGPT Business, Enterprise or the API). Check which entity signs and the list of subprocessors.
• Add the assistant to your record of processing: purposes, legal basis, data categories, processor, transfers. The under-250-employees exemption doesn't apply to a tool used every day.
• Write down what never goes in (special category data, HR files, health data, passwords) and what goes in only when the task needs it. A one- or two-page AI use policy is enough.
• On the personal accounts that remain, have people turn off training ("Improve the model for everyone") and keep client and employee data out. More detail: what happens to data pasted into ChatGPT.
• Tell your employees the rules and train them. The EU AI Act already asks you to support your staff's AI literacy.
• In France, from 50 employees, check whether the works council (CSE) must be consulted before rollout: labor law requires consultation on new technologies, and courts demanded it for AI tools in 2025.
• Update your privacy notice to name this new processor.
• Run a DPIA if the use touches hiring, evaluations, special category data or large volumes, with your data protection officer if you have one.

What about an agent connected to your documents?

The GDPR asks you to know where your data goes and who processes it. Saména reads your documents where they live, in SharePoint, OneDrive or Dropbox, read-only, in the folders you choose. Saména keeps no copy of your files. What it does keep from your documents is encrypted with a key unique to your company, and the master key is stored outside the database.

Servers are in France, the database is in the European Union, and everything can be deleted on request. If your requirements call for it, Saména can run on your own servers or on a dedicated instance. You choose the model: Claude, models from OpenAI, or Mistral if you prefer a French model. They run in Europe and keep none of your data.

The subscription covers the whole company with unlimited users, so nobody stays on a personal account for lack of a license. Nothing goes out until someone at your company approves it. The details are on where your data goes.

Frequently asked

Can we use free ChatGPT with client data?

Better not. No processing contract ties your company to OpenAI, and content can be used for training unless the user opts out. The CNIL limits consumer services to non-confidential uses, with safeguards.

Do we need to sign a DPA with OpenAI?

Yes, as soon as your teams process personal data with it: Article 28 of the GDPR requires a contract with the processor. OpenAI says it signs one for ChatGPT Business, ChatGPT Enterprise and the API; for European customers, the contract is with OpenAI Ireland Ltd.

Is the EU-US Data Privacy Framework still valid?

Yes, as of November 5, 2026. The EU General Court upheld it on September 3, 2025 in the Latombe case, and an appeal is pending before the Court of Justice. If the Court struck it down, transfers would need other safeguards, such as standard contractual clauses.

Does Italy's €15 million fine against OpenAI still stand?

No. The Court of Rome annulled it on March 18, 2026, after OpenAI challenged it, and the Garante removed its decision from its website.

Does a company under 250 employees need a record of processing for this?

In practice, yes. The Article 30 exemption doesn't apply to processing that isn't occasional, like an assistant used every day, or to special category data.