Is ChatGPT GDPR-compliant for your organisation?

What it comes down to

The GDPR does not ban AI. It requires you to know which personal data you process, why, with whom, and that you can demonstrate it. The question “is ChatGPT GDPR-compliant?” is therefore really a different one: can you show that processing personal data through ChatGPT is lawful, secure and limited?

For most organisations the answer depends on which version is used and by whom: the organisation, with agreements in place, or an employee, on their own initiative.

Free, Plus or business: the difference under the GDPR

A business version solves a lot: you have a contract, a data processing agreement and administration. What it does not solve is that an outside party processes your data, with a parent company in the United States. For transfers to the US, many organisations rely on the EU-US Data Privacy Framework. The EU General Court upheld that framework in September 2025, but the case is on appeal at the Court of Justice. If you build your AI use on it, you build on a framework whose future is not yet settled.

When is using ChatGPT a data breach?

The Dutch Data Protection Authority (AP) has been clear about this. In 2024 it reported several data breaches in which employees had entered personal data into an AI chatbot. An employee of a GP practice had entered patients’ medical data; at a telecoms company it concerned a file containing, among other things, customer addresses.

The AP’s reasoning: when an employee, on their own initiative and against company agreements, puts personal data into a chatbot, the chatbot provider gains unauthorised access to that data. That is a personal data breach. The notification duty then applies: within 72 hours to the supervisory authority if there is a risk to the people concerned, and to those people themselves if the risk is high.

In practice this means: every pasted customer file, every excerpt from a case file and every email with names in it can be a notifiable data breach. And you usually do not know, because it happens in personal accounts you cannot see. How to deal with that is covered in Shadow AI: what to do when staff use ChatGPT on their own.

What do you need to arrange if you allow ChatGPT?

If you decide to use ChatGPT for business, at least arrange:

1. A business contract and a data processing agreement (Article 28 GDPR). Without that agreement you may not have personal data processed.
2. A DPIA if the processing is likely to result in a high risk, for example with special-category data, large-scale processing or new technology (Article 35 GDPR). With generative AI that is often the case.
3. An AI policy that says which data may and may not go into the tool, with concrete examples per department.
4. Agreements on transfers outside the EU, and an assessment of their risks.
5. Blocking personal accounts on the network, otherwise the old use simply continues.
6. AI literacy: staff need to understand what they should and should not put into a model. The AI Act asks you to support that. See The EU AI Act in 2026.

The alternative: AI that does not leave your organisation

For part of your work, a business AI subscription with good agreements is enough. For data you do not want at an outside party (patient data, client files, HR data, customer records) the defensible route is for the AI to come to the data, rather than the other way round.

With private AI the language model runs on a node of your own in your server room. There is no outside AI vendor in the processing, so no transfer and no processor with access to the content. In werqly AI Control your IT department sets which data is blocked, who uses which model and what is logged. Staff get what they were looking for in ChatGPT, and you keep the visibility you need.