ChatGPT and GDPR: Can businesses use ChatGPT on personal data?

ChatGPT, Copilot and other AI servicesLast updated 11 October 20262 min read

Short answer

A business can use ChatGPT under GDPR, but not on free or personal plans when personal data is involved. Use ChatGPT Business or Enterprise, where OpenAI doesn't train on your data by default and the data processing agreement is included. Data is processed in the US by default; only Enterprise can have data stored and processed in the EU. The safest route is for ChatGPT never to see the real names: pseudonymise the data in the EU before it is sent.

Try it: what does ChatGPT see?

Type some text with names, phone numbers and emails. See what the AI would get with GoalCube. The text never leaves your browser.

Try it yourselfGoalCube Data Vault

The five questions you should be able to answer

Which plan do we use, and do we have a data processing agreement?
Does OpenAI train on our data?
Where is the data processed, and what is the basis for the transfer?
Which personal data do we send – and is it necessary?
Is the use in our AI register, and have staff taken a course?

How ChatGPT compares with the others

See AI services compared for Claude, Copilot, Mistral and Gemini.

What to do

Choose a business plan.Business or Enterprise – not Free or Plus for work data.
Check the data processing agreement.For EU customers, it is concluded with OpenAI Ireland.
Check training.The business plans don't use your data for training by default.
Check where data is processed.Usually the US. The transfer needs a legal basis.
Don't send names when you can avoid it.With GoalCube, ChatGPT only sees [PERSON_1].
Register the use.In your AI register, with purpose and risk.

What the law says

Article 28 GDPR – processors: Requires a data processing agreement.
Articles 44–46 GDPR – transfers: Transfers to the US need a basis, for example the Data Privacy Framework or standard contractual clauses.
Article 5(1)(c) GDPR – data minimisation: Only the data needed for the task.

Questions and answers

Is ChatGPT approved under GDPR?

There is no GDPR approval for tools. It is your use that must follow the rules: plan, agreement, purpose and data minimisation.

Does OpenAI train on our data?

Not by default in Business and Enterprise. On free and personal plans, conversations may be used for training unless you turn it off.

Can data stay in the EU?

Only in Enterprise can new workspaces have data stored and processed in the EU. With GoalCube, the real names never leave the EU – whatever your plan.

Sources

Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.

Be among the first.

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.