Does turning off ChatGPT's chat history make it GDPR compliant?

Under OpenAI's current terms, chat history and model-training use are separate settings: to stop new conversations from being used to train future models you switch off the model-training data control (or use a temporary chat), not the history toggle. Either way, it does not make your use of ChatGPT GDPR compliant on its own. Personal data is still sent to and processed by OpenAI, so you still need a lawful basis, a data processing agreement, and a way to honour access and deletion requests. On consumer plans the history toggle is a privacy setting, not a compliance guarantee.

Can I put special category data like health records into ChatGPT?

Special category data, such as health, biometric, or trade union information, carries stricter conditions under GDPR than ordinary personal data. Feeding it into a general consumer chatbot is hard to justify, because you rarely have the explicit consent or other condition these categories require, and no processing agreement covers it. If you handle this kind of data, mask or remove it before any AI tool sees it, or keep it out entirely.

Do data transfers to the US matter when using ChatGPT?

Yes. OpenAI can process data on infrastructure outside the EU and EEA, including in the United States, so you need a valid transfer mechanism (standard contractual clauses, or reliance on the recipient's certification under an applicable adequacy framework where available) plus a check, under the provider's current terms, that the safeguards hold in practice. Business and enterprise agreements usually address this in the contract, while consumer plans give you little to rely on. One way to reduce the exposure is pattern masking of identifiers before text leaves, so the provider processes placeholders rather than the real personal data.

Answers

Is ChatGPT GDPR compliant?

Not on its own, because GDPR compliance depends on how you use the tool, not on which tool you buy. The same ChatGPT account can process a generic drafting request lawfully and, two minutes later, a pasted client file unlawfully. Consumer ChatGPT is difficult to use compliantly with client or employee data. The business offerings can be part of a compliant setup, if your firm does its share of the work.

Compliance sits with you, not with OpenAI

Under GDPR, your firm is the controller of the personal data your staff type into a chat window. That means the firm needs a lawful basis for the processing, a contract with any processor handling the data, and safeguards appropriate to the risk. A vendor can make those things easier or harder to obtain. It cannot supply them for you.

So the real question is whether your specific use of ChatGPT can be made compliant. For some setups the answer is yes. For others it is no, whatever the plan page says.

Consumer ChatGPT: the difficult case

The free and Plus tiers are consumer products. Under OpenAI's current terms, no data processing agreement is available for those consumer plans, and GDPR requires a written contract before a processor may handle personal data on your behalf. Without that contract, entering client or employee data is hard to justify.

There is a second problem. As OpenAI's terms currently stand, consumer-plan conversations can be used to train models by default. An opt-out exists in Data Controls, but it depends on every individual employee finding it and switching it on. If training use is a concern, look at which AI tools don't train on your data before settling on a plan.

Business plans and the API are different

Under OpenAI's current terms, its API and business plans are covered by a data processing agreement, and business data is not used to train models by default. Enterprise plans currently add data residency options, including storage in Europe.

That closes the contractual gap that otherwise rules out consumer plans. It does not finish the job. A signed DPA covers the provider's side of the relationship; the lawful basis, staff behaviour and retention decisions remain yours.

Regulators are paying attention

European supervisory authorities have treated ChatGPT as a serious subject from early on. The Italian data protection authority temporarily blocked the service in 2023 over concerns about legal basis and transparency, and lifted the block only after OpenAI made changes. Other European authorities have examined the service since. If your firm processes personal data through ChatGPT, assume a regulator would expect you to explain how.

What compliant use actually requires

For a firm that wants to use ChatGPT with real work data, the checklist is short but strict:

A lawful basis for the processing, identified before use, not after.
A signed data processing agreement, which in practice means a business plan or the API, never a consumer account.
Written instructions to staff on what may be entered and what may not.
Retention and chat history settings configured deliberately, then checked.
Data minimisation: sending the model only what it needs to do the task.

Most firms that get into trouble skip the third and fifth points. The contract exists, but nobody told the trainee what a pasted client email actually is in GDPR terms.

Minimisation is the strongest lever

Every safeguard above manages personal data after it reaches the provider. Minimisation stops it from arriving. A prompt that contains no names, no account numbers and no addresses is far easier to defend, whichever plan you are on. Data that never reaches the provider raises no questions about the provider at all.

That is why redacting before you paste belongs in the workflow itself, not in a policy memo. We have written a guide on how to anonymize data before using ChatGPT. Manual redaction works for one document. It rarely survives a busy week.

How Cedreon approaches this

Cedreon is an AI workspace for sensitive data, developed in Switzerland, and it is built around that minimisation step. Before any text leaves for the model provider, Cedreon screens it: pattern matching plus layered best-effort machine detection finds names, IBANs, addresses and other identifiers and replaces them with placeholders. The originals stay in an encrypted vault on Cedreon's side, and the reply is filled back in for the signed-in user, so the model provider never sees the real values.

Two caveats. Detection is probabilistic, so an identifier can slip through; treat the screen as best-effort reduction, not certainty. And masking is pseudonymisation, not anonymisation, which is exactly why every exchange also lands in an append-only, hash-chained audit log: a firm can show afterwards what left the house and what was replaced first.

Admins and users can also write guardrails in plain language (block, warn or flag) that run on every chat. Try Cedreon free to see what a screened prompt looks like in practice.

Common questions

Does turning off ChatGPT's chat history make it GDPR compliant?: Under OpenAI's current terms, chat history and model-training use are separate settings: to stop new conversations from being used to train future models you switch off the model-training data control (or use a temporary chat), not the history toggle. Either way, it does not make your use of ChatGPT GDPR compliant on its own. Personal data is still sent to and processed by OpenAI, so you still need a lawful basis, a data processing agreement, and a way to honour access and deletion requests. On consumer plans the history toggle is a privacy setting, not a compliance guarantee.
Can I put special category data like health records into ChatGPT?: Special category data, such as health, biometric, or trade union information, carries stricter conditions under GDPR than ordinary personal data. Feeding it into a general consumer chatbot is hard to justify, because you rarely have the explicit consent or other condition these categories require, and no processing agreement covers it. If you handle this kind of data, mask or remove it before any AI tool sees it, or keep it out entirely.
Do data transfers to the US matter when using ChatGPT?: Yes. OpenAI can process data on infrastructure outside the EU and EEA, including in the United States, so you need a valid transfer mechanism (standard contractual clauses, or reliance on the recipient's certification under an applicable adequacy framework where available) plus a check, under the provider's current terms, that the safeguards hold in practice. Business and enterprise agreements usually address this in the contract, while consumer plans give you little to rely on. One way to reduce the exposure is pattern masking of identifiers before text leaves, so the provider processes placeholders rather than the real personal data.