Can companies use ChatGPT in compliance with data protection law?
Yes, if you use a Business or Enterprise plan for which, according to e-recht24 (as of 16 July 2026), OpenAI provides a data processing addendum as the basis for a data processing agreement under Art. 28 GDPR, have a legal basis under Art. 6 GDPR for each purpose and safeguard the transfer to the US. e-recht24 rates the free and personal plans as rather unsuitable or only of limited suitability for personal data. Also set out in an AI policy which data may be entered in prompts, and train your employees. This is not legal advice for your individual case.
ChatGPT and other large language models (LLMs) have become firmly embedded in the European business landscape. But with this innovation come growing requirements for data protection, IT security and regulatory compliance. This guide covers the data protection challenges, the impact of the EU AI Act and pragmatic steps to set up your company in a compliant way.
How ChatGPT works: technical understanding as the basis for compliance
ChatGPT is based on a general-purpose AI model (GPAI) trained on large amounts of text. From a data protection perspective, the critical point is that inputs can be used to further develop the models, depending on the plan and settings. According to e-recht24 (as of 16 July 2026), inputs in the Free, Go, Plus and Pro plans can be used for training by default (opt-out possible). In Business and Enterprise, content is not used for training by default, and for the API training is excluded by default according to the article.
In addition, it is often only partly transparent to users which data is stored, for how long and how it is processed. This calls for a good understanding of data processing before ChatGPT is used in the company.
Which ChatGPT plan is suitable for businesses?
The choice of plan decides whether you can conclude a data processing agreement and whether inputs are used for training by default. Source of the information: e-recht24, as of 16 July 2026. Plans and terms change, so check them with OpenAI before use.
| Plan | Training by default | DPA available | Suitability for personal data |
|---|---|---|---|
| Free, Go | yes, opt-out possible | no | rather unsuitable |
| Plus, Pro | yes, opt-out possible | no | only of limited suitability |
| Business, Enterprise | no | yes, via OpenAI’s data processing addendum | recommended by the source, Enterprise “particularly suitable” |
| API | no, excluded by default | statements in the source contradict each other, check with OpenAI | not rated |
Data protection challenges with LLMs at a glance
Integrating ChatGPT into business processes brings specific data protection risks. You need to clarify these points:
Legal basis and choice of plan
As soon as personal data ends up in prompts, you need a legal basis under Art. 6 GDPR – for example legitimate interest or the performance of a contract. Stricter rules apply to special categories such as health data. Employees’ personal accounts are unsuitable for business use, because, according to e-recht24, no data processing agreement is available there and inputs can be used for training by default.
Data flows and processing: the crux of international transfers
Many companies use ChatGPT directly from OpenAI or via cloud platforms such as Azure OpenAI. For choosing the deployment, see our article on US cloud, EU cloud or on-prem AI deployment. You need a data processing agreement (DPA) and a legal basis for the international transfer: either the provider’s certification under the EU-US Data Privacy Framework or standard contractual clauses (SCC) with a transfer impact assessment (TIA). e-recht24 lists OpenAI as certified under the Data Privacy Framework. The General Court dismissed the action against the Framework on 3 September 2025; the appeal of 31 October 2025 is pending before the Court of Justice (according to WilmerHale, as of 1 December 2025). Keep SCCs ready as an alternative.
Transparency and information obligations
Art. 13 and Art. 14 GDPR require you to inform data subjects about the purpose, nature and scope of the processing. If you use ChatGPT in customer service or recruiting, for example, this must be included in your privacy notices. With LLMs this is demanding because the processing is complex – but with clear internal rules and proper documentation, it is achievable.
Practical risk areas in companies: where do the dangers lie?
Careless use of ChatGPT can lead to data protection violations in various areas. Typical scenarios:
- Marketing: When drafting texts, confidential CRM data such as customer information or strategic plans ends up in the prompt.
- Human resources (HR): Candidate communication may involve special categories of personal data, such as health data or information on ethnic origin. See our article on AI in recruiting.
- Legal and compliance: AI output is used as the basis for legal decisions despite a lack of traceability, or confidential legal documents are entered.
- Customer service: Names, addresses or order histories of customers are unintentionally disclosed when answering enquiries.
- Research and development: Trade secrets are entered when generating code or analysing data – and, depending on the plan, could be used for training.
The EU AI Act: what applies to companies that use ChatGPT?
The EU AI Act applies in stages. The distinction between providers and companies using AI (deployers) is important. Status: 2 November 2026.
| Applies from | Rule | What it means for your company |
|---|---|---|
| 2 Feb 2025 | Art. 4 AI Act: AI literacy | You take measures to support the AI literacy of your employees who work with AI. You do not have to guarantee a specific level of literacy. More: AI literacy under the AI Act. |
| 2 Aug 2025 | Obligations for GPAI models (Chapter V) | These apply to providers such as OpenAI, not to your company. |
| 2 Aug 2026 | Art. 50 AI Act: transparency | Providers make AI interaction recognisable and mark synthetic content in a machine-readable format (paras. 1 and 2). As a deployer, you disclose deepfakes and label AI-generated text published to inform the public on matters of public interest, unless it has undergone human review and editorial responsibility is held (para. 4). For systems placed on the market before 2 Aug 2026, para. 2 applies only from 2 Dec 2026. |
| 2 Dec 2027 | High-risk systems under Annex III | If you use ChatGPT for decisions in sensitive areas, such as pre-selecting job applicants, it may qualify as a high-risk system – with considerably stricter obligations. |
Regulation (EU) 2026/1744 (“Digital Omnibus on AI”) has been in force since 27 July 2026 and postponed the high-risk deadlines (Annex III to 2 December 2027, Annex I to 2 August 2028). For background, see our article on the Digital Omnibus. Find out more about implementation in our article on practical steps for the EU AI Act. For your own AI agents, our guide to GDPR-compliant AI also applies.
Recommendations for GDPR- and AI Act-compliant AI use
These steps help you use ChatGPT securely and in compliance with data protection law:
- Define the context of use: Specify which departments may use ChatGPT and for which purposes. Record this in an AI policy.
- Assess the risks: For each purpose, check which data may be processed and whether a data protection impact assessment is required.
- Implement technical and organisational measures: Use a Business or Enterprise plan, manage access centrally and, where possible, use filters to anonymise inputs. More on technical and organisational measures.
- Secure it contractually: Sign a data processing agreement with the provider and check the legal basis for the international transfer.
- Train employees: AI literacy training is one way to implement the measures required by Art. 4 AI Act. It also raises awareness of data protection risks when using AI.
- Establish governance: Assign responsibilities, review usage regularly and adapt your rules to new tools and legal developments. Where required, include the use in your record of processing activities (Art. 30 GDPR).
Don't miss an update.
New laws, deadlines, and practical tips delivered straight to your inbox – once a month, no spam.
heyData’s role: enablement, not legal advice
heyData does not offer traditional legal AI Act consulting. Our AI-related services are designed to enable companies to use AI safely:
- Risk assessment of AI use in your company
- Training on AI literacy and the privacy-compliant use of AI systems
- GDPR-compliant templates and policies for AI use
Conclusion: regulation doesn’t have to slow down innovation
ChatGPT and similar AI systems are here to stay. Anyone who wants to stay on the safe side long-term needs clear internal processes, technical safeguards and a basic understanding of the legal framework. The EU AI Act and the GDPR are not obstacles but guardrails for responsible AI use.
With heyData’s AI compliance, you get the tools, training and structures to use ChatGPT and other AI tools safely.
Take the first step: Book a free demo now
EU AI Act: Guide to AI Compliance | heyData
Learn what the EU AI Act requires of companies and how to manage AI risks, documentation, oversight, and governance in a structured way.
Free & no obligation
FAQ
Can ChatGPT even be used in compliance with data protection law?
Can ChatGPT even be used in compliance with data protection law?
Yes, if you put the right conditions in place: a Business or Enterprise plan for which, according to e-recht24 (as of 16 July 2026), OpenAI provides a data processing addendum as the basis for a data processing agreement under Art. 28 GDPR, a legal basis under Art. 6 GDPR, a basis for the international transfer, clear internal usage rules and trained employees. Personal or confidential data should only be entered if there is a legal basis for it and the purpose requires it. This is not legal advice for your individual case.
What are the biggest data protection risks for my company when using ChatGPT?
What are the biggest data protection risks for my company when using ChatGPT?
The main risks lie in unintentionally entering confidential or personal data, which – depending on the plan – may be stored or used for training. In addition, data is transferred to the US. For this, you need a data processing agreement and a transfer mechanism: the EU-US Data Privacy Framework or standard contractual clauses with a transfer impact assessment. An appeal against the Framework is pending before the Court of Justice (according to WilmerHale, as of 1 December 2025), so keep standard contractual clauses ready as an alternative.
How are the EU AI Act and the GDPR related?
How are the EU AI Act and the GDPR related?
The EU AI Act and the GDPR complement each other but are separate laws. The GDPR protects personal data. The AI Act regulates the safety, transparency and governance of AI systems and general-purpose AI models – such as the model behind ChatGPT. When using AI, both sets of rules often apply at the same time.
What obligations does the EU AI Act bring for companies that use ChatGPT?
What obligations does the EU AI Act bring for companies that use ChatGPT?
The obligations for GPAI models (since 2 August 2025) apply to providers such as OpenAI. For your company, the main points are: since 2 February 2025, Art. 4 AI Act requires you to take measures to support your employees’ AI literacy, without having to guarantee a specific level. Since 2 August 2026, the transparency obligations under Art. 50 AI Act apply, for example for deepfakes or published AI-generated texts. For high-risk systems under Annex III, for example in recruitment, the stricter obligations apply from 2 December 2027 (as of 2 November 2026).
What practical steps should my company take now to prepare for these regulations?
What practical steps should my company take now to prepare for these regulations?
As a first step, a company should define a clear policy for AI use. It's crucial to conduct a risk assessment for every AI application, put the necessary contractual agreements (such as DPAs) in place with providers, and train all employees on "AI literacy" and the associated data protection risks.
