Is ChatGPT GDPR Compliant? The Answer Depends on How Your Company Uses It

It's 4 pm on a Tuesday. An HR manager in Munich has six performance reviews to finish and pastes the notes for one of them, full name, sick days and a line about a family situation, into ChatGPT to tidy up the wording. The result reads well. The question your DPO will ask is where that text went, under which contract, and whether it's now training a model.

That is what "is ChatGPT GDPR compliant?" really asks. The honest answer is that the tool can't be compliant or non-compliant by itself. Your use of it can.

Is ChatGPT GDPR compliant?

GDPR applies to processing, not to products. When an employee uses ChatGPT for work, your company decides why and how the personal data in that prompt is processed, so your company is the controller. OpenAI is either your processor (on the business plans and the API, under a data processing agreement) or, on a personal account, a separate controller dealing directly with your employee under consumer terms.

The business plans make compliant use possible: a DPA, no training on your data by default, admin controls and, for some products, EU data residency. Personal accounts give you none of that. And on any plan, the safest prompt is one that doesn't contain the personal data in the first place.

Why have European regulators focused on ChatGPT?

European regulators took ChatGPT seriously early, and the record is worth knowing because your board may have read the headlines:

• March 2023: Italy's data protection authority, the Garante, ordered a temporary limitation that blocked ChatGPT in Italy, citing the lack of a legal basis for training, missing information for users and no age checks.
• 28 April 2023: ChatGPT was available in Italy again after OpenAI added an age gate for Italian users, more information on data use and a form for EU users to object to training on their data.
• 23 May 2024: the European Data Protection Board published the report of its ChatGPT taskforce, with preliminary views on lawfulness, fairness, transparency, accuracy and data subject rights.
• 20 December 2024: the Garante announced a EUR 15 million fine over how OpenAI had processed personal data to train ChatGPT, plus an order to run a six-month public information campaign.
• March 2026: the Court of Rome upheld OpenAI's appeal against that decision. The Garante's own press page now notes that the decision has been temporarily removed from its website following the ruling. Press reports say the court turned on which authority was competent, since OpenAI's EU establishment in Ireland makes the Irish DPC its lead authority.

All of these cases concerned OpenAI as the controller of its own training data. They don't settle anything about your company. Your exposure is narrower and more practical: what your employees put into the tool, and under which terms.

What changes between free ChatGPT and the business plans?

OpenAI introduced data residency in Europe in February 2025: API projects created with Europe as the region are handled in-region, and new ChatGPT Enterprise and Edu workspaces can store customer content at rest in Europe. Existing API projects can't be switched, so this is a decision you make when you set things up.

The uncomfortable part is that much workplace ChatGPT use doesn't happen on the business plan at all. LayerX's 2025 Enterprise AI and SaaS Data Security Report, based on browser telemetry from its own customers, found that 77% of employees paste data into generative AI tools and that 82% of that paste activity comes from unmanaged, personal accounts. If the HR manager above used a personal account, there is no DPA, no admin, and possibly training switched on. That's the scenario a GDPR review should start with.

What does GDPR actually ask of you?

1. A lawful basis for sending personal data to an AI provider at all (Art. 6), usually legitimate interests backed by a written assessment. Special categories such as health data need an additional condition under Art. 9, which is much harder to meet. The sick days in that performance review are health data.
2. A processor agreement with the provider (Art. 28). The business plans and API offer one; personal accounts don't, and you can't sign one on an employee's behalf.
3. A valid transfer mechanism if data leaves the EEA (Chapter V). Check whether the provider relies on the EU-US Data Privacy Framework, standard contractual clauses, or keeps the data in the EU. EU residency reduces this question; it doesn't remove remote access by a US parent company from your assessment.
4. Data minimization (Art. 5(1)(c)): send only what the task needs. Writing a polite reply to a complaint doesn't need the customer's IBAN.
5. Transparency and records: your privacy notices (Art. 13 and 14) and your record of processing (Art. 30) should mention AI tools if you use them on customer or employee data.
6. A DPIA (Art. 35) where processing is likely to be high-risk, for example AI on employee evaluations, health data or large volumes of customer records.

How do you set up ChatGPT for GDPR in a 200 to 2,000 person company?

• Pick one approved plan (ChatGPT Business or Enterprise, or another provider's equivalent) and sign the DPA. If you're starting fresh on Enterprise or the API, choose EU data residency at setup, because it can't be added to an existing API project later.
• Say clearly what can't go in a prompt: customer identifiers, health data, credentials, anything about a named employee's performance. Then accept that a policy alone won't hold on a busy Monday.
• Mask before it leaves. A masking layer replaces names, account numbers and IDs with tokens before the prompt reaches the provider, and puts the real values back where the answer repeats them. That's what Maskflare does. Masked data is pseudonymized: still personal data on your side, but OpenAI never receives the identifiers.
• Cover the personal accounts too. The Maskflare desktop agent and browser protection mask text typed into ChatGPT on the web whichever account the employee is logged into. Applications that call the OpenAI API go through the AI gateway with a one-line base URL change.
• Keep evidence. Your DPO will want to show what was masked, when, and under which rule. Maskflare records which rules matched and how often, never the prompt itself, and the GDPR compliance profile produces an exportable coverage report.

Back to the HR manager. With masking in place, ChatGPT receives a review for mf_mask_170b... with the sick-day count and family note replaced by tokens or blocked by rule, rewrites it, and the manager sees the real name again in the answer. The tidy wording survives. The special-category data never left.

What masking doesn't solve

• You still need a lawful basis. Pseudonymized data is still personal data for you (GDPR Recital 26), so Art. 6 and your records still apply.
• Context can identify people. "The only female engineer in our Graz office" names nobody and still points at one person. Detection finds identifiers; it can't judge every description.
• Coverage has edges. Maskflare covers ChatGPT in the browser and applications calling the OpenAI API. Audio in realtime voice sessions isn't masked, and person-name detection is strongest in English, German, French, Spanish, Italian and Albanian.
• Contracts still matter. Masking reduces what the provider receives. It doesn't replace the DPA or your transfer assessment.

What about the EU AI Act?

The EU AI Act sits on top of GDPR; it doesn't replace it. For most companies using ChatGPT rather than building AI products, the main duties are AI literacy for staff under Article 4, which has applied since February 2025, and transparency where AI interacts directly with people. Obligations for providers of general-purpose models, such as OpenAI, have applied since August 2025 and sit with them, not you. Personal data in prompts remains a GDPR question, and your lawyers should confirm how the Act applies to any specific use you have.

This article is general information, not legal advice. Facts are as of October 2026; check the providers' current terms before relying on them.