ChatGPT and GDPR / AI Act: the compliance guide for your business

Overview and data processed

ChatGPT is the conversational assistant from OpenAI (a US company), built on GPT models. For the European Economic Area, OpenAI Ireland Limited is in principle responsible for GDPR compliance. ChatGPT exists in Free/Plus versions (consumer) and Team/Enterprise (business): this distinction determines all compliance matters.

Three data flows pass through OpenAI servers: the content of your exchanges (prompts and responses—the most sensitive: client names, emails, HR or health data), account data, and technical data (IP, browser, usage). In Free/Plus, training on your conversations is enabled by default (manual opt-out, not retroactive). In Team/Enterprise, business data is not used for training by default. As servers are in the United States, a transfer outside the EU takes place, governed by standard contractual clauses (SCCs).

Risks for your business

Four major risks: data leakage, legal liability (the company is responsible for its employees' actions), reputational damage, regulatory sanction. According to the IFOP/Talan 2025 barometer, 43% of generative AI users use it at work but only 9% via a tool provided by the organisation; 'shadow AI' is already in the business.

Main GDPR risks:

• Absent legal basis for transmitting a third party's data to OpenAI.
• Minimisation: users often enter more than necessary.
• Transfer outside the EU: US hosting, risk of access by US authorities (CLOUD Act, FISA), a sensitive issue since Schrems II.
• Data subject rights difficult to exercise (access, rectification, erasure).
• Automated decision-making: Article 22 applies if ChatGPT feeds a decision affecting an individual.

CNIL and the European Data Protection Board (EDPB), which published a dedicated report on ChatGPT in May 2024, have confirmed that these tools fall within the scope of the GDPR as soon as they process personal data.

GDPR obligations

1. Sign a DPA with OpenAI (Team/Enterprise/Business only).
2. Record the use in the record of processing activities.
3. Carry out a DPIA in case of high risk (sensitive data, large-scale profiling, systematic monitoring).
4. Inform data subjects.
5. Govern transfers outside the EU (SCCs, verified location).
6. Secure and govern: AI charter, training, DPO.

AI Act obligations

ChatGPT is a general-purpose AI model (GPAI): the corresponding obligations have applied since 2 August 2025. For the provider (OpenAI): technical documentation, information to downstream actors, copyright policy, summary of training data. For the deployer (your business): transparency (Article 50—signalling the use of AI and generated content), human oversight, AI literacy of teams (obligation in force since 2 February 2025). Caution: HR or decision-making use may elevate the system to 'high risk' (Annex III). See the AI Act guide.

Cybersecurity and best practices

Cyber risks: leakage via prompts, shadow AI via personal accounts (invisible to IT), prompt injection on assistants connected to your data, compromised accounts exposing history. NIS2 entities must incorporate these risks.

Best practices: pro version + DPA; training disabled; never sensitive data; pseudonymisation; AI charter; training; AI lead; record documentation.

Sanctions, conclusion and recommendations

Sanctions (two cumulative regimes): GDPR up to €20m or 4% of global turnover; AI Act up to €35m or 7% for prohibited practices, €15m or 3% for most other infringements. In March 2023, the Italian authority (Garante) temporarily suspended ChatGPT, then imposed a fine of €15 million on OpenAI at the end of 2024.

Recommendation: ChatGPT is neither banned nor 'magically compliant'—everything depends on the version, data entered and governance. The real risk is not the tool but its uncontrolled use via personal accounts. Take back control rather than ban: governed pro version, AI charter, training, documentation, unified GDPR + AI Act governance. Compare with other assistants: Copilot, Gemini, Claude, Mistral.