Is ChatGPT GDPR compliant? What universities should check

Researchers, teachers and students use ChatGPT every day, often on personal accounts. This page sets out what OpenAI publicly documents for each plan, what that means for a university acting as controller, and the questions to put to OpenAI before an institutional rollout.

Published 7 October 2026 · Sources checked 7 October 2026

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers an AI assistant for research work with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What ChatGPT documents publicly

Everything below comes from OpenAI's own pages, the official Data Privacy Framework List and the Italian data protection authority, all read on 7 October 2026. "Organisational plans" means ChatGPT Business, Enterprise and Edu.

What this means for a university

The plan decides almost everything. The same chat window sits on two very different legal set-ups. On a Free or Plus account, OpenAI is the controller and the university has no contract with OpenAI at all. If staff use personal accounts for university work, the institution cannot give OpenAI processing instructions, set retention or control training, and the user's own settings decide whether content is used to train models. On ChatGPT Business, Enterprise or Edu, OpenAI processes content on the institution's behalf, training is off by default, and the institution controls retention and access. Article 28 GDPR requires a controller to use processors under a binding contract, which only the organisational plans offer [12].

Edu terms deserve a close read. OpenAI's enterprise privacy page says ChatGPT Edu data is processed under its Student Data Privacy Agreement rather than the GDPR-oriented DPA [2]. The agreement we read is written around US education law [7]. That does not mean an EU university cannot obtain GDPR terms, but it does mean the DPO should confirm in writing which agreement governs the contract, which OpenAI entity signs it, and whether the SCCs and subprocessor terms of the DPA apply. Credit where it is due: Enterprise and Edu give universities European data residency at no extra cost, inference residency in Europe for eligible customers, admin-controlled retention and an audit log, which are the controls most DPOs ask for first [5], [2].

Personal data will be in it. In academic use, prompts routinely contain names in emails, student work, interview excerpts, peer review comments and draft papers about identifiable people. Research data can include special category data such as health information. Article 35 GDPR requires a DPIA where processing "using new technologies" is likely to result in a high risk [12]. An institution-wide rollout to staff and students, possibly including sensitive research data, is the kind of deployment many DPOs will want to assess before launch, and national DPA lists may make it mandatory.

Transfers remain even with EU residency. Residency covers content at rest and, where enabled, model inference. OpenAI states that logins, workspace metadata, billing data, some CPU processing and external integrations can be handled outside the region [5]. The subprocessor list includes US and Philippine processing for support and infrastructure [4]. These transfers rely on SCCs or adequacy decisions [3]; OpenAI did not appear in our search of the Data Privacy Framework List [9], so a transfer impact assessment based on SCCs is the safer working assumption.

Students and staff are different cases. Staff use for university work belongs on an institutional plan. Students who choose ChatGPT privately are making their own choice under OpenAI's terms, but if a course requires the tool, the university is steering that processing and should provide an institutional route. Article 8 GDPR sets 16 as the default age for consent to information society services where consent is the legal basis, with Member States able to lower it to 13 [12]; most university students are above it, but some first-year students and pupils on bridging programmes may not be.

Regulatory history, stated neutrally. In November 2024 the Italian Garante announced a EUR 15 million fine and an order to run a six-month information campaign, citing an unnotified 2023 data breach, the legal basis for training, transparency and the lack of age verification. The Garante also passed the file to the Irish DPC as lead authority because OpenAI had set up its European headquarters in Ireland. The Garante's own page now notes that the decision was temporarily removed after the Court of Rome (judgment no. 4153/2026, published 18 March 2026) upheld OpenAI's challenge [10].

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask ChatGPT before approving it

1. Which agreement governs our ChatGPT Edu or Enterprise contract: the Data Processing Addendum, the Student Data Privacy Agreement, or both? Which OpenAI entity is the counterparty for an EU university?
2. Will our workspace be provisioned with European data residency from day one, and is inference residency in Europe available for our plan and the models we will use?
3. Which features are outside data residency for our workspace, and can we disable them by policy?
4. Which subprocessors on the current list will process our content (not only metadata), from which countries, and how do we subscribe to change notices?
5. What transfer impact assessment does OpenAI provide for transfers to the United States and the Philippines under the SCCs?
6. Can we set retention to a short period for all users, and how do we export conversations for access requests and records management?
7. Can admins block the use of personal ChatGPT accounts on university devices or prevent staff from linking personal and work accounts?
8. Can we see the SOC 2 Type 2 report and the ISO/IEC 27001 and 27701 certificates covering the Edu service?
9. How are students under 18 handled in an Edu workspace, and can we restrict features for them?
10. How will OpenAI notify us of model changes and new features that change what data is processed?

The EU AI Act angle

Regulation (EU) 2024/1689, the AI Act, has applied in stages [11]. Article 4 on AI literacy has applied to deployers since 2 February 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, replaced Article 4: providers and deployers must now take measures to support the development of AI literacy of their staff, without having to guarantee a specific level for any individual [13], [14]. A university that rolls out ChatGPT is a deployer and should still train and guide its users.

A general-purpose assistant used for writing and research is normally not a high-risk system. That changes if the university uses it for the purposes listed in Annex III point 3: deciding admission, evaluating learning outcomes, assessing the appropriate level of education, or monitoring students during tests [11]. After the Omnibus, the Annex III high-risk rules apply from 2 December 2027 [13], [14]. The obligations for general-purpose AI models in Chapter V have applied since 2 August 2025 and sit with the model provider, OpenAI, rather than with the university [11]. OpenAI appears on the European Commission's list of signatories of the General-Purpose AI Code of Practice [15].

Sources

1. OpenAI, Europe privacy policy (updated 24 August 2026), retrieved 7 October 2026.
2. OpenAI, Enterprise privacy at OpenAI (updated 8 January 2026), retrieved 7 October 2026.
3. OpenAI, OpenAI Data Processing Addendum (updated 1 December 2025, effective 1 January 2026), retrieved 7 October 2026.
4. OpenAI, OpenAI Sub-processor list (last updated 9 July 2026), retrieved 7 October 2026.
5. OpenAI Help Center, Data residency and inference residency for ChatGPT, retrieved 7 October 2026.
6. OpenAI Help Center, How your data is used to improve model performance, retrieved 7 October 2026.
7. OpenAI, Student Data Privacy Agreement (PDF), retrieved 7 October 2026.
8. OpenAI, Security and privacy at OpenAI, retrieved 7 October 2026.
9. U.S. Department of Commerce, Data Privacy Framework List (searched for "OpenAI"), retrieved 7 October 2026.
10. Garante per la protezione dei dati personali, press release: ChatGPT, il Garante privacy chiude l'istruttoria (in Italian), retrieved 7 October 2026.
11. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal L, 12 July 2024, Articles 4 and 113 and Annex III, retrieved 7 October 2026.
12. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 8, 28 and 35, retrieved 7 October 2026.
13. Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal L, 24 July 2026, retrieved 7 October 2026.
14. European Commission, AI Act (application timeline), retrieved 7 October 2026.
15. European Commission, The General-Purpose AI Code of Practice (signatories), retrieved 7 October 2026.

About this page

We read OpenAI's public privacy, contract, subprocessor, security and help pages, the official Data Privacy Framework List, the Italian Garante's press release and the EU legal texts on 7 October 2026, and summarised what they say for each ChatGPT plan. We did not test the product or review any non-public contract. Vendors change their terms often, so check the linked pages before you rely on them. This page is not legal advice and is not a verdict on whether any organisation's use of ChatGPT complies with the GDPR. If you work at OpenAI or spot an error, please contact us and we will correct it.