Image: Pexels, used under the Pexels License.
When a compliance team asks "is ChatGPT GDPR-compliant?", the useful answer starts with two OpenAI pages: trust.openai.com, where the audit documents live, and openai.com/enterprise-privacy, where the data commitments are written down. This playbook walks through both, in the order a vendor review needs them.
The short version: the paperwork is good, but it isn't the same for every plan. ChatGPT Business has a SOC 2 Type 2 audit and a DPA. The ISO certificates cover Enterprise, Edu and the API, not Business.
Correction, October 15, 2026: an earlier version said the trust portal's certifications, including ISO, apply to ChatGPT Business (OpenAI lists Business under SOC 2 Type 2 only), that the no-training commitment is a policy for Team and API but a contract only for Enterprise (OpenAI's enterprise privacy page gives the same default commitment for all business products), that Team admins can't control retention (Business admins can), that EU residency isn't available for Team (it is rolling out for Business), that Azure is OpenAI's EU or primary infrastructure (the sub-processor list names Microsoft alongside CoreWeave, Oracle, Google Cloud and AWS), and that Enterprise retention has a minimum period (OpenAI says admins control it). We also removed an unsourced turnaround time for SOC 2 requests, a control count for the CSA STAR questionnaire and a section on ChatGPT plugins, which OpenAI now calls apps.
Step 1: Open trust.openai.com and know what's there
trust.openai.com is OpenAI's trust portal, built on SafeBase. The front page shows SOC 2 Type 2, SOC 3, PCI DSS v4.0.1, ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019 and 42001:2023, plus CCPA, CSA STAR, GDPR, TX-RAMP and FedRAMP 20x entries.
Screenshot: OpenAI Trust Portal, trust.openai.com.
Some items are public and some sit behind a login. The compliance panel attaches PDF files to the ISO certificates and the SOC 3 summary. The SOC 2 Type 2 audit is "available to authenticated users," so press "Get access" and request an account first.
Three entries are narrower than the badge suggests:
- CSA STAR is Level 1, the self-assessment level. The portal links to OpenAI's listing in the CSA registry.
- PCI DSS covers "the components of ChatGPT that support delegated payment processing," not your prompts.
- ISO 42001 has its own certificate from the same auditor, Schellman.
Step 2: Check which certificates cover your plan
Don't skip this step. OpenAI publishes a product compliance status page, version 1.1, updated August 4, 2026, with a matrix of which products are in scope for which audit.
Screenshot: Product compliance status, OpenAI.
| Plan | No training by default | DPA | Compliance API logs | Admin-set retention | Data residency | SOC 2 Type 2 | ISO 27001 / 27701 |
|---|---|---|---|---|---|---|---|
| Free / Plus | No (opt out in settings) | No | No | No | No | No | No |
| ChatGPT Business | Yes | Yes | No | Yes | Rolling out | Yes | No |
| ChatGPT Enterprise | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| API Platform | Yes | Yes | n/a | 30-day default, ZDR on request | Yes (new projects) | Yes | Yes |
The ISO certificate makes the same point in different words: it covers an information security management system "for OpenAI's API, ChatGPT Enterprise, and ChatGPT Edu services." OpenAI's pricing table marks the ISO line "No" for Business.
If your customer contracts or your own ISMS require a supplier with ISO 27001 or 27701 scope, Business doesn't meet that on paper. Enterprise does.
Step 3: Request the current SOC 2 Type 2 report
The latest report was posted on August 29, 2026 and covers July 1, 2025 to June 30, 2026, across the Security, Availability, Confidentiality and Privacy criteria. The previous one covered January to June 2025.
Screenshot: OpenAI Trust Portal updates, trust.openai.com.
Read its scope section against the compliance matrix, note the period end date, and set a reminder for the next one. A SOC 2 report describes a past window, so an annual refresh is normal.
Step 4: Sign the DPA
GDPR Article 28(3) says processing by a processor "shall be governed by a contract or other legal act" that binds the processor. For ChatGPT that contract is OpenAI's Data Processing Addendum.
OpenAI can execute a DPA "for their use of ChatGPT Business, ChatGPT Enterprise, and the API," and points customers to a DPA form. The current version took effect on January 1, 2026. Points to check before you sign:
- Instructions. OpenAI processes customer data only on your documented instructions, which include the settings you choose in the product.
- Transfers. The DPA uses the EU standard contractual clauses adopted on June 4, 2021.
- Sub-processors. You give general authorization to the listed sub-processors and can object to a new one within 30 days of notice.
- Data subject requests. OpenAI will tell you if it receives a request about your data. Answering it stays your job as controller.
Then open the sub-processor list. The cloud infrastructure entries name Microsoft, CoreWeave, Oracle, Google Cloud and Amazon Web Services, each with its own processing locations, and Cloudflare handles content delivery and web hosting. If you restrict transfers to particular countries, this list is where you check them.
Step 5: Confirm the training and retention settings
"We do not train our models on your data by default," reads OpenAI's enterprise privacy page, and the Help Center gives the same default for Business, Enterprise, Edu and ChatGPT for Healthcare workspaces. Data from connected apps isn't used for training by default either.
Consumer accounts work the other way: chats can be used for training unless the user turns off "Improve the model for everyone." So personal accounts are the gap your ChatGPT policy has to close.
On retention, Business and Enterprise admins both control how long conversations are kept, and deleted conversations leave OpenAI's systems within 30 days unless the law requires otherwise. For the API, OpenAI may keep inputs and outputs for up to 30 days to identify abuse; zero data retention for eligible endpoints is something you request, with a qualifying use case. Fine-tuning files stay until you delete them, and fine-tuned models are never served to other customers.
Step 6: Decide on data residency
OpenAI launched data residency in Europe on February 5, 2025 for the API, ChatGPT Enterprise and Edu. On January 16, 2026 it added in-region GPU inference in the US or Europe for eligible Enterprise, Edu and Healthcare customers.
Three limits to plan around:
- New workspaces and projects. In ChatGPT, residency applies to new Enterprise and Edu customers. On the API, European residency can only be set for new projects.
- Business is partial. Business residency is "rolling out gradually," the region is chosen at checkout, and safety and abuse-monitoring data stays in the United States. The pricing table still lists residency as an Enterprise feature.
- Residency isn't a lawful basis. You still need the DPA, a lawful basis for the processing and, for higher-risk uses, a DPIA.
Step 7: Close the personal-account gap
Everything above covers a managed workspace. None of it covers an employee pasting client data into a personal Free or Plus account. Some teams go further than blocking personal accounts. On r/gdpr, u/JKO-1991 described their approach: "We simply stopped (through policy and guidance) employees entering personal data into any AI tool including ChatGPT enterprise which every employee has access to." That's stricter than most teams need, but it's a reminder that the DPA covers the tool, not what people type into it.
Checklist before go-live
- Confirm your plan on OpenAI's product compliance status page and match it to the certificates your contracts require
- Download the ISO certificate and SOC 3 summary; request the SOC 2 Type 2 audit through the trust portal
- Complete OpenAI's DPA form and file the signed copy with its effective date
- Save the sub-processor list and subscribe to change notices so the 30-day objection window means something
- Set workspace retention and app permissions in the admin console
- Decide on data residency before the workspace or API project is created
- Request zero data retention for API endpoints that handle sensitive data, if you qualify
- Block or police personal ChatGPT accounts for work data
- Set a reminder for the next SOC 2 audit period and the next DPA update
Our take
OpenAI's documentation is thorough: the trust portal is current, the compliance matrix is honest about scope, and the DPA is a standard form you can sign without a negotiation. The weak spot is ChatGPT Business. It gets SOC 2 and a DPA, which is enough for many GDPR reviews, but not ISO scope or settled residency. If a customer questionnaire asks for ISO 27001 coverage of your AI vendor, answer it from the matrix, not from the badge wall. For a side-by-side of the two ChatGPT plans, see ChatGPT Business vs Enterprise compliance, and for the Anthropic comparison, Anthropic vs OpenAI GDPR compliance.
For teams managing several AI vendors, the AI vendor DPA tracker keeps DPA status, renewal dates and sub-processor changes in one place.
Related Reading
- Anthropic's July 8 Biometric ID Policy: What Teams Need to Know
- ChatGPT Team vs Enterprise: compliance comparison for 2026
- Privacy-First AI APIs: Which Don't Train on Your Data (GDPR & CCPA, 2026)
- GDPR-Compliant AI Assistants: Comparison for 2026
- AI Vendor DPA Tracker 2026
- Anthropic vs OpenAI GDPR Compliance 2026
- AI Data Privacy for Small Teams: GDPR and CCPA Guide
