Is ChatGPT GDPR-Compliant? Examples, Costs and How to Start

“Is ChatGPT GDPR-compliant?” is the question that lands on the managing director’s desk the moment someone in support pastes a customer email, address and order number into ChatGPT to draft a reply. IT worries about where that data went, the data protection officer asks for a lawful basis and a processing agreement, and nobody is sure which of the ChatGPT plans is actually allowed. This article answers it plainly, as of October 2026: what the GDPR requires, which ChatGPT tiers give you a data processing agreement and EU hosting, and the European way to get the work done without the personal data ever leaving Europe. This is not legal advice - confirm the details with your own data protection officer.

Is ChatGPT GDPR-compliant?

ChatGPT is not automatically GDPR-compliant, but it can be used in a GDPR-compliant way on the right plan with the right setup. Whether a given use is compliant depends on three things you control: the plan (consumer plans have no business data processing agreement and may train on your chats, while ChatGPT Business, Enterprise and the API run under OpenAI’s DPA and exclude business data from training by default), where the data is processed (default is primarily the US; EU data residency is available for Enterprise and the API), and your own paperwork (a lawful basis under Art. 6 GDPR, a signed DPA, a record of processing and, where needed, a DPIA). A chat tool cannot make you compliant; it can only give you the terms you need to be¹²⁵.

The GDPR-compliant way with Superkind

The quickest way to stay on the right side of the GDPR is to keep the data in Europe from the start. Superkind is the AI employee for your team: you write to Superkind in Outlook or any email, Microsoft Teams, Slack or the Superkind web app like you would to a colleague, and it does the task in your programs through 1,500+ integrations such as Outlook, Teams, DATEV, HubSpot and SharePoint. Superkind is hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act and never trains models on your data. It works with AI models from OpenAI (the company behind ChatGPT), Anthropic, Mistral and Google, all processed in Europe, and the data processing agreement comes through the Trust Center.

1. 1

   You write the task

   In Outlook, Teams, Slack or the web app, in plain words: “Draft a reply to Ms Berger’s complaint about order 4012.” No prompt course, and no customer data copied into a public chat window.

2. 2

   Superkind does it in your systems

   It reads the case from the inbox or your CRM, uses your company knowledge (the order, past tickets, your policy) and follows your rules, such as “Refunds over EUR 200 need sign-off”. The personal data stays in Europe the whole time.

3. 3

   Superkind asks before anything goes out

   You get the draft with Approve or Reject. Nothing is sent, booked or changed without your OK, and your colleague can approve in Teams or Slack, wherever they work.

4. 4

   Next time it runs as a routine

   What you explain once keeps running, for example “Every complaint about a delivery - draft the reply and flag me”. Every task adds to your Company Brain, and that knowledge stays when people leave.

How ChatGPT and the GDPR fit together

The GDPR does not ban ChatGPT. It puts duties on you, the company, as the controller of the personal data. Six parts decide whether a given use is compliant.

1. You are the controller, and you need a lawful basis - when you put a customer’s or employee’s personal data into any tool, you need a legal ground under Art. 6 GDPR, usually a contract, a legal obligation or legitimate interest after a balancing test. Special categories such as health data need an extra basis under Art. 9⁵⁶.
2. Where the data is processed - by default ChatGPT runs on OpenAI’s infrastructure, primarily in the US. EU data residency is available for ChatGPT Enterprise, ChatGPT Edu and the API Platform; new Enterprise workspaces can store content in Europe, and since January 2026 eligible accounts can run in-region inference in Europe².
3. Training on your data - on the consumer plans OpenAI may use your chats to improve its models unless you switch training off; Business, Enterprise and the API exclude business data from training by default under the DPA¹⁴.
4. The data processing agreement (DPA, or AVV in German) - Art. 28 GDPR requires a processing contract with any provider that handles personal data for you. OpenAI offers a DPA for Business, Enterprise and the API; the consumer plans are not set up for a controller DPA by default¹³.
5. Record of processing and DPIA - you log the processing in your record of processing activities (Art. 30) and run a data protection impact assessment (Art. 35) when the use is likely to be high risk, such as large-scale or automated decisions with real effects on people⁷⁸.
6. AI literacy under the EU AI Act - separate from the GDPR, Art. 4 of the EU AI Act has required since February 2025 that you take measures for a sufficient level of AI literacy among staff who use AI on your behalf: training and clear rules on what may go into a chat tool⁹.

ChatGPT tiers and the GDPR compared

This table shows how each ChatGPT tier stands on the points that decide GDPR fit, with Superkind in the first row for comparison. It is a plan-level summary, not a compliance sign-off: your own lawful basis and documentation still apply.

As of October 2026. ChatGPT sources: OpenAI enterprise privacy¹ and data residency². Confirm the current terms for your account with OpenAI and your data protection officer.

The short version: the plans people reach for first (Free and Plus) are the weakest fit for personal data, and the compliant ChatGPT setups (Business, Enterprise, API) need a DPA, the training opt-out and, for EU processing, Enterprise or the API. Superkind starts from the European side of all of this.

Examples: ChatGPT and the GDPR in practice

Five realistic set-ups, from the whole team in Europe to your own API tool. Each shows what you would need to do to stay compliant.

1. The whole team works GDPR-compliant with Superkind

Nadine in support writes to Superkind in Teams: “Draft a reply to Ms Berger’s complaint.” Superkind pulls the case from the CRM, drafts the reply with your policy, and asks Nadine for approval before it goes out. The personal data is processed in Europe the whole time, there is no training on it, and the DPA is in place through the Trust Center. Superkind works with models from OpenAI, Anthropic, Mistral and Google, processed in Europe, and connects through 1,500+ integrations such as HubSpot, Zendesk and Outlook. See the AI support agent for how this runs in customer service. As of October 2026 you start for free with a one-off up to EUR 150 in credits.

2. One person on ChatGPT Plus

The owner uses ChatGPT Plus to draft offers and emails for $20 a month¹. That is fine for general text, but Plus is a personal account with no business DPA, and OpenAI may train on the chats unless training is switched off. It is the wrong place to paste a customer list, an invoice or an employee record.

3. A small team on ChatGPT Business

Five colleagues get ChatGPT Business seats. Business excludes business data from training by default and gives you a DPA, so it can be used with personal data once you sign the DPA and set the controls¹³. The open point is processing location: Business has no EU data residency option, so the data is still handled primarily in the US, which your data protection officer has to assess.

4. ChatGPT Enterprise with EU data residency

A larger organisation sets up a new ChatGPT Enterprise workspace with European data residency, signs the DPA, runs a DPIA and adds AI literacy training²⁸⁹. This is the most complete ChatGPT path for personal data, but it is a negotiated annual contract and the residency option applies to new workspaces only.

5. Your own API tool with EU residency

A self-built tool classifies incoming emails using the OpenAI API with European data residency set per project and zero data retention². Training is excluded by default and you get a DPA, but you build, host and document the tool yourself, and you still own the lawful basis, the record of processing and the DPIA.

What GDPR-compliant AI needs (and what it costs)

Whichever tool you choose, the GDPR gives you the same short checklist. None of it is automatic on any chat plan.

• A lawful basis - name your ground under Art. 6 for each use, and an extra basis under Art. 9 for special categories such as health or union data⁵⁶.
• A data processing agreement - sign the DPA (AVV) with the provider before personal data goes in. Available on ChatGPT Business, Enterprise and the API, and through the Trust Center for Superkind¹³.
• Known processing location - know where the data is processed. EU residency on ChatGPT Enterprise and the API; in Europe by default for Superkind².
• No training on your data - switch training off on consumer ChatGPT; excluded by default on the business tiers and never done by Superkind¹⁴.
• Record of processing and DPIA - log the processing (Art. 30) and run a DPIA (Art. 35) where the risk is high⁷⁸.
• AI literacy - train staff and set rules under Art. 4 of the EU AI Act⁹.

Data protection and EU hosting

For a support reply with a customer’s name and order, a CRM full of contact data or an invoice with a person’s details, the processing location and the DPA are the whole ball game. Superkind keeps that personal data in Europe by default, so you spend your time on the lawful basis and the record, not on routing the data back out of the US.

What Superkind costs

As of October 2026. Prices excl. VAT, for the whole company with unlimited users.

• Free - EUR 0 with a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and every connection, in Slack, Teams, email and the app, hosted in the EU.
• Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
• Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, a DPA and help with the security review, payment by invoice.
• What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.

How to start

You can set the ground rules in an afternoon. Three steps:

From the first task to your own app

With Superkind, the data stays in Europe from the first task to the app you build later. Four stages, on the support example from above:

1. 1

   Ready in minutes

   Sign up for free with up to EUR 150 in credits, send the first task in Teams, Slack or by email (“Draft a reply to Ms Berger’s complaint”) and watch it get done, with the personal data processed in Europe.

2. 2

   Tasks become routines

   What you explain once keeps running as a routine, for example every delivery complaint drafted and flagged to you. Before anything goes out, Superkind asks for approval.

3. 3

   Learns from day one

   Every task makes Superkind smarter. Your policies, past tickets and tone of voice end up in your Company Brain, and that knowledge is never lost, even when people leave.

4. 4

   Your own app, without starting over

   When support gets more complex, you build custom solutions, apps and integrations on the platform, on top of what Superkind already knows, for example your own complaints app with its own approvals: your Super App. Built yourself or together with us. It all belongs to you.

Conclusion

ChatGPT is not GDPR-compliant out of the box, but it can be used compliantly: pick ChatGPT Business, Enterprise or the API for a DPA and a training opt-out, use Enterprise or the API for EU data residency, and keep the lawful basis, the record of processing and the DPIA on your side. The consumer plans are the wrong place for customer or employee data. If you want the personal data to stay in Europe from the first task without that setup work, Superkind is hosted in Europe, never trains on your data, provides its DPA through the Trust Center, and runs the task in Outlook, Teams, Slack, DATEV or your CRM through 1,500+ integrations (as of October 2026). Write down the rule for staff this week, then send Superkind one real task and compare.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, the AI employee teams write to in Outlook, Teams and Slack. Henri helps companies, from small teams to the Mittelstand, hand their routine work to AI - without new tools, consultants or an in-house AI team.