ChatGPT and GDPR: which plan fits your business?

Choosing a plan is the first ChatGPT privacy decision

A paid plan does not authorize every use of customer data. Businesses assessing ChatGPT under the GDPR should distinguish personal Free and Plus workspaces from Business and Enterprise. Their training defaults and contractual framework differ. Whether particular customer details may be used still depends on the purpose, applicable terms and configured processing.

Our recommendation for a small business: public product copy and fictional examples do not require an Enterprise project. For regular work involving identifiable customers, assess Business as the first business-plan option. Consider Enterprise when specific location or administration requirements go further. Start with the general AI data-protection review; this article focuses on the differences between ChatGPT plans.

This comparison draws on OpenAI’s business privacy commitments and current product documentation; it does not replace a legal assessment of an individual business.

Free and Plus require the same training check

Plus does not automatically turn model training off.

According to OpenAI’s help page, training data sharing starts enabled in personal Free and Plus workspaces. You can switch it off under Settings, Data Controls and “Improve the model for everyone”. This applies to new conversations while allowing chat history to remain. Voice has additional controls.

For an initial trial, we recommend switching training off, using public information or entirely fictional cases, and leaving original customer files out. A sample instruction is: “Write an understandable description from these public product specifications. Do not invent warranties, delivery dates or certifications.” Someone then checks the draft against the specifications.

For this workflow, choose Plus based on the features you need. A plus sign is not a privacy policy. If the task later needs real customer details, conduct a new approval review; the original trial does not cover that expansion.

Business requires a documented contractual basis

The business needs to know which terms it accepted.

OpenAI specifies no training by default for Business and Enterprise. Its Services Agreement incorporates the DPA when personal data is processed. DPA stands for Data Processing Addendum. Check the terms actually accepted for your workspace, including any separately negotiated provisions.

The DPA identifies OpenAI as a processor for the processing it covers. The customer remains responsible for necessary authorizations and compliant configuration, among other obligations. This does not provide blanket clearance for health records or personnel files.

Before starting, keep three items together: the contract version, the incorporated DPA and the approved task description. Assign someone to review changes. In our example, the business initially permits drafts about products and order quantities only; staff add names and contact details later in their own system. This records the actual scope of approval even if the subscription subsequently changes.

Business storage regions come with an important limit

A storage region does not determine every processing location.

OpenAI is gradually introducing regional storage for Business; it is not available to every customer yet. The choices offered at checkout cover primary customer content at rest, not where responses are computed. Even with a non-US region, OpenAI says it temporarily retains a copy of each prompt and response in the US for safety and abuse monitoring.

The purchasing question is therefore precise: does this documented processing meet our requirement? Write down the required region before buying and compare it with the actual offer. Do not rely on older comparison lists claiming either that Business always stores everything in the US or that choosing a region keeps everything there.

If a business must exclude all content copies outside a specified area, this Business description is insufficient evidence. Keep that requirement unresolved until an appropriate offer explicitly covers it.

Enterprise separates storage from model computation

Enterprise offers additional location controls for eligible workspaces.

The Enterprise documentation distinguishes regional storage from separately enabled inference residency. The latter covers model execution on graphics processors (GPUs) for in-scope content. Its Europe region includes the European Economic Area and Switzerland. Other processing, system data and external services may remain outside it. The commitments do not cover every feature.

Ask for a short mapping between your proposed features and the applicable commitment. Summarizing a PDF without connected services is a different workflow from research involving web search and several third-party apps. Acceptance checks should follow the planned workflow rather than simply ticking a box marked “Europe”.

Our decision rule: investigate Enterprise when a named requirement cannot be demonstrably met by Business. For text ideas based only on public information, we would not recommend that procurement effort. A larger package still needs a tightly defined data-use approval.

Deletion and apps need separate decisions

The approval must include files and connected services.

According to the retention documentation, archiving is not deletion. Deleted chats are generally scheduled for permanent deletion within 30 days, subject to the stated exceptions for legal or security requirements and for data already de-identified and disassociated from the account. Deleting a chat does not remove a file saved separately in Library.

Data passed to external apps is also subject to the respective provider’s terms and privacy policy. Business apps can already be enabled, although administrators can change access. We recommend initially allowing only the connections required for the approved task and documenting their data flows separately.

Copyable check: “Create a fictional case, upload a fictional file and list visible storage locations and the storage flows documented by the provider. Check the documented deletion process separately for the chat and the file. Record which apps receive data and who approves their use.” Disappearance from the interface does not replace the documented rules governing further retention.

Three seats cost $720 a year in this example

The seat count follows the approved tasks.

The Business pricing page lists Standard seats at US$20 per person per month billed annually, or US$25 billed monthly. The Business FAQ requires at least two paid seats. Country and currency prices may differ; this USD example excludes taxes, additional usage and setup.

Assume a five-person business initially needs three individual Standard seats: two for reviewed text drafts and one for the responsible manager. Annual billing gives 3 × $20 × 12 = $720. Five seats would cost $1,200. The difference is $480 a year; this is a license calculation, not a measured productivity saving.

With monthly billing, the same three seats cost $75 a month, or $900 over twelve unchanged months. We would establish tasks and actual demand before committing to annual billing. The other two employees do not thereby gain permission to copy the same customer information into personal accounts.

This approval record makes the choice checkable

The decision needs an owner and explicit boundaries.

Add this template to your internal AI usage policy. Complete the contract and location fields with verified details; an empty field remains an open action.

• Task: drafts based on public product information. Personal customer data: initially excluded. Original case files: excluded.
• Plan and workspace: [exact name]. Owner: [name or role]. Contract version and DPA incorporation: [evidence].
• Training use: [verified setting/commitment]. Storage and processing locations, including exceptions: [evidence].
• Apps: [individually approved connections or none]. Chats and files: [deletion method and deadline]. Outputs: subject-matter review before use.
• Expansion: review new data types, features or connections before use. Next review date: [date].

Questions to settle before ordering

Three questions determine the next step.

Is switching training off enough? It addresses training for new conversations, not the contract, storage and deletion questions. Any use of customer details must fit the complete approved workflow.

Is ChatGPT Team a different plan? The Business FAQ confirms the change of name to Business on August 29, 2025. For purchasing, use the current service description and applicable terms rather than the old name.

What if a required commitment is missing? Keep the affected data out of the trial and request that specific evidence. Our AI consulting and implementation services can help define a concrete task for the technical selection. Start now with the approval record and mark the first field still missing evidence.