ChatGPT and Data Protection: A Guide for Businesses in the EU

Can companies use ChatGPT in compliance with data protection law?

Yes, if you put the right conditions in place. Use a Business or Enterprise plan with a data processing agreement in which your inputs are not used for training. Check the legal basis for transferring data to the US, set out in an AI policy which data may be entered in prompts, and train your employees. Personal or confidential data should only go into ChatGPT if there is a legal basis for it and the purpose requires it.

ChatGPT and other large language models (LLMs) have become firmly embedded in the European business landscape. But with this innovation come growing requirements for data protection, IT security and regulatory compliance. This guide covers the data protection challenges, the impact of the EU AI Act and pragmatic steps to set up your company in a compliant way.

How ChatGPT works: technical understanding as the basis for compliance

ChatGPT is based on a general-purpose AI model (GPAI) trained on large amounts of text. From a data protection perspective, the critical point is that inputs can be used to further develop the models, depending on the plan and settings. In the free and personal plans, this is possible by default and must be actively switched off. In the Business, Enterprise and API offerings, OpenAI states that it does not use customer data for training by default.

In addition, it is often only partly transparent to users which data is stored, for how long and how it is processed. This calls for a good understanding of data processing before ChatGPT is used in the company.

Data protection challenges with LLMs at a glance

Integrating ChatGPT into business processes brings specific data protection risks. You need to clarify these points:

Legal basis and choice of plan

As soon as personal data ends up in prompts, you need a legal basis under Art. 6 GDPR – for example legitimate interest or the performance of a contract. Stricter rules apply to special categories such as health data. Employees’ personal accounts are unsuitable for business use, because there is no data processing agreement and inputs may be used for training.

Data flows and processing: the crux of international transfers

Many companies use ChatGPT directly from OpenAI or via cloud platforms such as Azure OpenAI. Even with data stored in Europe, sub-processors in the US may be involved. You therefore need a data processing agreement (DPA) and a legal basis for the international transfer: either the provider’s certification under the EU-US Data Privacy Framework or standard contractual clauses with a transfer impact assessment (TIA). Without these, you risk GDPR violations and fines.

Transparency and information obligations

Art. 13 and Art. 14 GDPR require you to inform data subjects about the purpose, nature and scope of the processing. If you use ChatGPT in customer service or recruiting, for example, this must be included in your privacy notices. With LLMs this is demanding because the processing is complex – but with clear internal rules and proper documentation, it is achievable.

Practical risk areas in companies: where do the dangers lie?

Careless use of ChatGPT can lead to data protection violations in various areas. Typical scenarios:

• Marketing: When drafting texts, confidential CRM data such as customer information or strategic plans ends up in the prompt.
• Human resources (HR): Candidate communication may involve special categories of personal data, such as health data or information on ethnic origin.
• Legal and compliance: AI output is used as the basis for legal decisions despite a lack of traceability, or confidential legal documents are entered.
• Customer service: Names, addresses or order histories of customers are unintentionally disclosed when answering enquiries.
• Research and development: Trade secrets are entered when generating code or analysing data – and, depending on the plan, could be used for training.

The EU AI Act: what applies to companies that use ChatGPT?

The EU AI Act has applied in stages since 2024. The distinction between providers and companies using AI (deployers) is important:

• Obligations of providers: Since 2 August 2025, obligations have applied to providers of GPAI models such as OpenAI – for example technical documentation, information for downstream providers, a copyright compliance policy and a summary of the training data. These obligations do not apply to your company.
• AI literacy: Since February 2025, you must ensure that employees who work with AI systems have sufficient AI literacy (Art. 4 AI Act).
• Transparency obligations: Since August 2026, labelling obligations have applied, for example if you create deepfakes or publish AI-generated texts to inform the public without human review (Art. 50 AI Act).
• High-risk use: If you use ChatGPT for decisions in sensitive areas, such as pre-selecting job applicants, it may qualify as a high-risk system – with considerably stricter obligations.

There is also a voluntary code of practice for GPAI providers, which OpenAI, among others, has signed. It makes it easier for providers to demonstrate compliance with their obligations. It is worth considering when choosing a provider. Find out more about implementation in our article on practical steps for the EU AI Act.

Recommendations for GDPR- and AI Act-compliant AI use

These steps help you use ChatGPT securely and in compliance with data protection law:

1. Define the context of use: Specify which departments may use ChatGPT and for which purposes. Record this in an AI policy.
2. Assess the risks: For each purpose, check which data may be processed and whether a data protection impact assessment is required.
3. Implement technical and organisational measures: Use a Business or Enterprise plan, manage access centrally and, where possible, use filters to anonymise inputs.
4. Secure it contractually: Sign a data processing agreement with the provider and check the legal basis for the international transfer.
5. Train employees: AI literacy training is mandatory under the AI Act. It also raises awareness of data protection risks when using AI.
6. Establish governance: Assign responsibilities, review usage regularly and adapt your rules to new tools and legal developments.

heyData’s role: enablement, not legal advice

heyData does not offer traditional legal AI Act consulting. Our AI-related services are designed to enable companies to use AI safely:

• Risk assessment of AI use in your company
• Training on AI literacy and the privacy-compliant use of AI systems
• GDPR-compliant templates and policies for AI use

Conclusion: regulation doesn’t have to slow down innovation

ChatGPT and similar AI systems are here to stay. Anyone who wants to stay on the safe side long-term needs clear internal processes, technical safeguards and a basic understanding of the legal framework. The EU AI Act and the GDPR are not obstacles but guardrails for responsible AI use.

With heyData’s AI compliance, you get the tools, training and structures to use ChatGPT and other AI tools safely.

Take the first step: Book a free demo now