Does the AI train on our data – and how do we switch it off?
Short answer
It depends on the plan. On free and personal plans, conversations may be used to train the models unless you switch it off. On the business plans from OpenAI (Business and Enterprise), Anthropic (Team and Enterprise), Microsoft 365 Copilot and Gemini in Google Workspace, company data is not used for training by default. At Mistral, Pro and Team train by default, and an administrator has to switch it off; Enterprise does not train. Never use free plans for personal data.
Where the big services stand
| Service | Plans | Trains on your data? | Data in the EU? | Data processing agreement? | Custom connectors? |
|---|---|---|---|---|---|
| ChatGPT OpenAI, USA | Business (formerly Team) and Enterprise | No. Company data is not used for training by default. | Enterprise only: new workspaces can have data stored and processed in the EU. Not Business. | Yes. The data processing agreement is part of the contract (OpenAI Ireland for EU customers). | Yes. Custom connectors via developer mode; an admin switches it on. |
| Claude Anthropic, USA | Team and Enterprise | No. Data is not used for training unless the business opts in. | No. Data is stored in the USA; there is no EU storage option. | Yes. The data processing agreement is automatically included in the commercial terms. | Yes. An owner adds custom connectors for the whole organisation. |
| Microsoft 365 Copilot Microsoft, USA | Add-on to Microsoft 365 for business | No. Prompts, responses and company data are not used for training. | Yes, within the EU Data Boundary. But new EU customers may have requests processed outside the EU at peak times (flex routing), which can be switched off. | Yes. Covered by Microsoft's product terms and data processing agreement. | Yes, via agents in Copilot Studio. Licence requirements not confirmed. |
| Vibe (tidl. Le Chat) Mistral AI, France | Pro, Team and Enterprise | Pro and Team: yes by default; an admin must switch it off. Enterprise: no. | Servers in the EU (Sweden). Some features may send data outside the EU; only Enterprise can switch this off. | Yes. Whether it covers Pro and Team is not confirmed. | Yes. An admin can add custom connectors. |
| Gemini i Google Workspace Google, USA | Workspace Business and Enterprise | No. Workspace data and prompts are not used for training without permission. | Storage and processing in the EU only with Enterprise Plus or the Data Regions add-on. Business: storage only. | Yes. An admin must accept it in the Admin console if it is not already in your contract. | Not confirmed for Gemini in Workspace. |
Checked 9 October 2026. Free and personal plans (ChatGPT Free/Plus, Claude Free/Pro, the Gemini app, Vibe Free) have no data processing agreement and may train on your data. They are not suitable for your company's personal data.
Why it matters
If a provider trains on your data, it is being used for a new purpose you have no control over, and you can't get it deleted from the model. That is a problem both for GDPR and for your trade secrets.
What to do
- Use business plans.Not employees' personal accounts.
- Check your own settings.Especially on Mistral Pro and Team.
- Put it in your policy.Only approved tools and plans.
- Send less.Data the AI has never seen can't be used for training. Pseudonymise.
What the law says
- Article 5(1)(b) GDPR – purpose limitation
- Data collected for one purpose cannot simply be used for another, such as training a provider's model.
- Article 28(3)(a) GDPR
- A processor may only process data on your documented instructions.
Questions and answers
What if an employee has used free ChatGPT with customer data?
Delete the conversation, switch off training, and assess whether it is a personal data breach that has to be reported within 72 hours.
Is pseudonymised data safe from training?
The AI only sees codes, so the real names cannot end up in training. Still use a plan without training.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.