Is ChatGPT GDPR compliant? What a UK business has to check, plan by plan.

No software is GDPR compliant on its own. Compliance belongs to a processing activity: who the controller is, the lawful basis, what data goes in, where it goes, how long it stays, and whether the people it is about have been told. What a vendor can do is make each of those questions easy or hard to answer, and OpenAI makes them easy on its business products and leaves the consumer products to the individual user. The ICO’s guidance on AI does not treat a chat assistant differently from any other processor; it expects the controller to have done the thinking.

OpenAI states that by default it does not use content from ChatGPT Business, Enterprise, Edu or ChatGPT for Healthcare workspaces to train its models, and the same applies to the API. Workspace owners control retention and memory settings; deleted conversations are removed from OpenAI’s systems within 30 days unless legally required to be kept; Enterprise owners can set a custom retention period from 90 days and can obtain zero data retention for the API. The consumer plans are the opposite by default: Free, Go and Plus conversations may be used to improve the models unless the user turns that off under data controls, and the decision is the individual’s.

For a UK employer that is the whole argument for the Business plan. A few pounds a seat moves the decision from each employee’s settings page to the firm’s admin console and contract.

OpenAI data controls, enterprise privacy and developer data pages, read September 2026.

Business customers get a data processing addendum incorporating the standard contractual clauses, and for transfers subject to UK GDPR the ICO’s International Data Transfer Addendum, which is the lawful mechanism the ICO requires for a restricted transfer to a country without adequacy regulations. The Data (Use and Access) Act 2025 restated the transfer test as whether protection would be “not materially lower”, and the ICO’s guidance page confirms all of the Act’s data protection provisions are now in force. OpenAI publishes SOC 2 and its enterprise privacy commitments, and Enterprise offers data residency options that include the UK for firms that need processing to stay in the country.

The gap in most UK firms is not OpenAI’s paperwork but whether the firm has recorded OpenAI as a processor, holds the DPA, and can produce it when a client’s procurement team asks. The ICO’s contract checklist lists the eight clauses a processor contract must cover; the DPA covers them, and the firm’s record of processing should say so.

The same nine steps as for any AI assistant, and none takes more than a day for a firm with its records in order.

Three features widen what the workspace can see. Connectors let ChatGPT read Google Drive, SharePoint and other sources, and OpenAI switched them on by default for Business workspaces when the company-knowledge search launched; decide whether that is right for you on day one, because they show people whatever the connected drive already lets them see. Memory keeps context across conversations and is a workspace setting to decide deliberately. Codex, the coding agent, inherits the plan’s position: from a Business or Enterprise seat, the firm’s code is covered by the commercial terms; from a personal Plus account, the consumer training choice applies. Developers on personal accounts working on client code are the most common way a firm breaks this without noticing.

The two vendors’ business plans are, for a UK firm, the same shape: no training by default, a DPA with the UK Addendum, SOC 2, deleted data removed within days, and Enterprise tiers with custom retention. Anthropic additionally publishes ISO 27001 and ISO 42001; OpenAI offers UK data residency on Enterprise where Anthropic’s first-party plans process in the United States. Both consumer tiers train by default or ask the user with the option switched on. The decision between them is about the work, not the paperwork, and our comparison guide makes it by role.