Data processing agreement with your AI provider: what should you check?
Short answer
When an AI service processes personal data for you, it is a processor, and you need a data processing agreement under Article 28 GDPR. The big services include standard agreements in their business plans. Check in particular: that data is only processed on your instructions (no training), where data is processed and the basis for any transfer, sub-processors, deletion and security. Free and personal plans usually come with no agreement.
Where the big services stand
| Service | Plans | Trains on your data? | Data in the EU? | Data processing agreement? | Custom connectors? |
|---|---|---|---|---|---|
| ChatGPT OpenAI, USA | Business (formerly Team) and Enterprise | No. Company data is not used for training by default. | Enterprise only: new workspaces can have data stored and processed in the EU. Not Business. | Yes. The data processing agreement is part of the contract (OpenAI Ireland for EU customers). | Yes. Custom connectors via developer mode; an admin switches it on. |
| Claude Anthropic, USA | Team and Enterprise | No. Data is not used for training unless the business opts in. | No. Data is stored in the USA; there is no EU storage option. | Yes. The data processing agreement is automatically included in the commercial terms. | Yes. An owner adds custom connectors for the whole organisation. |
| Microsoft 365 Copilot Microsoft, USA | Add-on to Microsoft 365 for business | No. Prompts, responses and company data are not used for training. | Yes, within the EU Data Boundary. But new EU customers may have requests processed outside the EU at peak times (flex routing), which can be switched off. | Yes. Covered by Microsoft's product terms and data processing agreement. | Yes, via agents in Copilot Studio. Licence requirements not confirmed. |
| Vibe (tidl. Le Chat) Mistral AI, France | Pro, Team and Enterprise | Pro and Team: yes by default; an admin must switch it off. Enterprise: no. | Servers in the EU (Sweden). Some features may send data outside the EU; only Enterprise can switch this off. | Yes. Whether it covers Pro and Team is not confirmed. | Yes. An admin can add custom connectors. |
| Gemini i Google Workspace Google, USA | Workspace Business and Enterprise | No. Workspace data and prompts are not used for training without permission. | Storage and processing in the EU only with Enterprise Plus or the Data Regions add-on. Business: storage only. | Yes. An admin must accept it in the Admin console if it is not already in your contract. | Not confirmed for Gemini in Workspace. |
Checked 9 October 2026. Free and personal plans (ChatGPT Free/Plus, Claude Free/Pro, the Gemini app, Vibe Free) have no data processing agreement and may train on your data. They are not suitable for your company's personal data.
The pitfall: AI features in other tools
Many tools now have AI features – CRM, accounting, email. Check that the agreement also covers the AI feature, and whether it sends data on to a sub-processor such as OpenAI or Anthropic.
What to do
- Instructions.Data may only be used to provide the service to you – not for training.
- Location and transfers.Where is data processed, and on what basis?
- Sub-processors.Who are they, and how will you hear about changes?
- Deletion and retention.How long are prompts and answers kept?
- Security and breaches.Which measures, and how quickly will you be told about a breach?
What the law says
- Article 28 GDPR – processor
- Article 28(3) lists what the agreement must contain.
- Commission standard contractual clauses (2021/915) – Article 28
- Standard clauses you can use as your data processing agreement.
Questions and answers
Does ChatGPT have a data processing agreement?
Yes, in Business and Enterprise. For EU customers it is signed with OpenAI Ireland.
Do we need to sign anything with Anthropic?
The data processing agreement is automatically part of Anthropic's commercial terms.
Is GoalCube a processor?
Yes. GoalCube processes personal data for you in the EU and signs a data processing agreement with you. The AI service only gets pseudonyms.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.