Is ChatGPT GDPR-compliant? The legal position for Austrian companies

There is no blanket answer to the question ‘Is ChatGPT GDPR-compliant?’ – it depends on the version and the type of use. Consumer accounts (Free and Plus) are unsuitable for personal company data, because there is no data processing agreement (DPA) and inputs may be used to improve the models. Business variants (Team, Enterprise, API) offer considerably better contractual foundations, but do not shift the responsibility for compliant use away from the company: without internal rules and control of inputs, the risk remains.

In brief

• ChatGPT’s GDPR compliance depends on the type of account: consumer versions are unsuitable for company data, business versions create the contractual basis.
• Four critical points: use of inputs for training, data transfer to the USA, personal data in prompts, no DPA for private accounts.
• Even with a business contract, your company remains responsible as the controller – compliance is decided by everyday use.
• A short AI policy setting out permitted and prohibited inputs is the most effective immediate measure.
• For working with internal documents, EU-based systems with a training exclusion are the lower-risk alternative.

Why is there no simple yes/no answer?

ChatGPT is not a single product but a family of offerings with very different contractual and technical conditions. The General Data Protection Regulation (GDPR) – the European data protection law in force since 2018 – assesses precisely these conditions: who processes the data, on what legal basis, with what guarantees, and what happens to the content?

The core distinction is between consumer and business offerings:

Feature	Free / Plus (consumer)	Business / Enterprise / API
Contracting party	Private individual (even if used for work)	Company
DPA under Art. 28 GDPR	Not provided	Available (as a Data Processing Agreement)
Use of inputs for model training	Possible by default (can be switched off in the settings)	Excluded by default, according to the provider
Administrative control (who uses what)	None	Available
Suitability for personal company data	No	Only with additional internal measures

This table alone shows: anyone in the company who uses a private Free or Plus account for work tasks is using a tool that lacks the contractual foundations the GDPR provides for processors; how this is to be assessed is something to clarify with your data protection advisers.

Which four points are critical under data protection law?

1. Use of inputs for training. With consumer accounts, inputs may be used by default to improve the models. Once something has gone into training, it is practically impossible to retrieve. For personal data, this is hardly compatible with the GDPR principles of purpose limitation and erasability. Business versions contractually exclude use for training – this difference is the single most important point in the assessment.

2. Third-country transfer to the USA. ChatGPT is operated by a US company; data may be transferred to the USA. The GDPR only permits such transfers to a ‘third country’ (a country outside the EU or the European Economic Area) with special guarantees – in practice mainly standard contractual clauses (contract templates pre-drafted by the European Commission) or an adequacy decision by the European Commission. Such bases exist, but have already been overturned by the courts in the past. OpenAI bases transfers on standard contractual clauses; data storage in Europe can be selected for Enterprise, Edu and the API, but not for consumer accounts. Companies that use US services must keep an eye on this point on an ongoing basis.

3. Personal data in prompts. The biggest risk often sits in front of the keyboard: employees copy emails, job applications, customer complaints or contracts into the input field – including names, addresses and sometimes sensitive information. Every such input is data processing for which the company is answerable as the controller. Experience shows that without clear internal rules, this happens unnoticed and across the board.

4. No DPA for consumer accounts. A data processing agreement (DPA) under Art. 28 GDPR is mandatory if a service provider processes personal data on behalf of the company. With private accounts, this agreement does not exist – use for personal company data is therefore not formally safeguarded, regardless of how carefully the individual employee works.

What should Austrian companies regulate specifically?

The good news: the most important measures are organisational, not technical – and can be implemented with manageable effort.

Create an AI policy. A short, comprehensible document (one to two pages is enough) sets out:

• Which AI tools are permitted in the company and in which version (company accounts only, no private accounts for work purposes).
• Who may use the tools and who is responsible for approvals.
• That results must be checked by someone with the relevant expertise before use – AI answers can be wrong.

Define permitted and prohibited inputs. The most practical part of any policy is a clear list:

• Prohibited: names and contact details of customers, employees and applicants; health data; salary data; login credentials and passwords; contract content subject to confidentiality obligations; trade secrets such as costings.
• Permitted: general draft texts without personal reference, publicly available information, anonymised examples (from which no conclusions can be drawn about real people).

Train employees. A short briefing explains the rules and the reasons behind them. At the same time, this is a measure to promote AI literacy, as provided for in Art. 4 of the EU AI Act, the European regulation on artificial intelligence.

Assign and document responsibility. Appoint a person who looks after AI matters, checks new tools and documents their use in the record of processing activities. Guidance is available from the Austrian Data Protection Authority (dsb.gv.at) and the practical information of the Austrian Economic Chamber, WKO (wko.at).

Breaches of the GDPR can result in substantial fines – but the real everyday risk for SMEs is the loss of trust among customers and employees if their data ends up in third-party systems without control. This article provides general guidance and is no substitute for legal advice in an individual case.

What alternatives are there for working with company documents?

For many of the tasks for which employees use ChatGPT today – finding information in documents, summarising content, retrieving knowledge from past projects – a public chatbot is not the right tool anyway. It does not know the company documents and, if in doubt, invents plausible-sounding answers.

The lower-risk approach for such tasks is systems that are designed for the European legal framework from the outset. What matters:

1. EU server location: processing takes place in the EU; the DPA names sub-processors and guarantees.
2. Contractual training exclusion: your content does not go into any AI training.
3. DPA included: an agreement under Art. 28 GDPR is part of the package.
4. Answers only from your own documents, with sources: the AI answers on the basis of your documents and shows where a statement comes from – this reduces invented answers and makes results verifiable.
5. User and role management: only authorised persons see sensitive documents.

One example of this approach is the AI knowledge base, which was developed precisely for this scenario – AI queries exclusively over your own company documents. Public chatbots and internal document AI do not exclude each other: many companies use both, with a clear division of which task belongs in which tool.

How does the ChatGPT question relate to the wider GDPR framework?

Assessing ChatGPT is ultimately one application of the general principles for using AI in a company: where is data processed, is it used for training, is there a DPA, who has access? If you ask these questions systematically for every tool, you can assess new services quickly and consistently too – instead of starting from scratch with every hype. A complete overview of these principles, the allocation of roles under the GDPR and a checklist for choosing a provider can be found in the article AI and the GDPR in Austria.

A principle to remember for everyday work: it is not the provider’s logo that decides GDPR compliance, but the contract, the data flow and discipline with inputs.