ChatGPT

GDPR overview

GDPR implementation is documented rather than merely claimed. A dedicated European privacy policy names OpenAI Ireland Limited, Dublin, as the controller for the EEA and Switzerland, which means the publisher has an establishment inside the Union. A Data Protection Officer is appointed and reachable at dpo@openai.com; access, deletion and portability requests go through privacy.openai.com or dsar@openai.com. A Data Processing Addendum can be executed for Business, Enterprise and the API, standard contractual clauses are annexed to it, and a sub-processor list is published with an email subscription for change notices. Transfers outside the EEA are covered by safeguards, a copy of which is available on request. Data from children under 13 is not knowingly collected.

Who owns the data?

You keep what you bring and what you get back. The terms state that you retain ownership of your inputs and own the outputs, and OpenAI formally assigns to you whatever rights it might otherwise hold in them. In exchange, OpenAI may use your content worldwide to provide, maintain, develop and improve its services, comply with the law, enforce its policies and keep the service safe. Human review is possible: authorised employees, and third-party contractors bound by confidentiality, may read content when investigating abuse or misuse. On Business, Enterprise, Edu, Teachers and the API, customer data is not used for model training by default, and workspace administrators can view, export and delete members' conversations.

Reuse rights

Reuse is broad and explicit. Because OpenAI assigns you its rights in the output, you may use what ChatGPT produces without asking further permission, including commercially. Three limits matter. Outputs are not guaranteed to be unique, so another user may receive something very similar, and the assignment does not extend to other users' outputs or to content returned by third-party services. You may not present an output as human-written when it is not. And you may not use outputs to build models that compete with OpenAI, nor extract outputs programmatically. Sharing published content is further governed by the Sharing and Publication Policy, while Enterprise and API use falls under separate business terms.

Data retention & training

Hosting summary

OpenAI publishes a sub-processor list, last updated 9 July 2026. Cloud infrastructure comes from Microsoft Corporation, which alone declares processing across 23 countries, plus Amazon Web Services, Google Cloud Platform, Oracle Cloud Infrastructure and CoreWeave. Cloudflare provides content delivery and web hosting, processing at whichever data centre is closest to the end user. Within the group, data is handled by OpenAI OpCo LLC and OpenAI LLC in the United States, OpenAI Ireland Ltd in Ireland, OpenAI UK Ltd in the United Kingdom and OpenAI Japan Ltd in Japan. Data residency is an Enterprise feature, offered across ten regions - the US, EU, UK, Japan, Canada, South Korea, Singapore, India, Australia and the UAE - and unavailable on Free, Go, Plus, Pro and Business. Data is encrypted with AES-256 at rest and TLS 1.2+ in transit, and transfers out of the EEA rely on contractual safeguards available on request. One caveat on the network trace: the domain resolves to a Cloudflare anycast address, which marks a point of presence, not a place where anything is stored.