Is ChatGPT GDPR compliant? How to assess your data protection obligations when using AI at work

There is no general ban on generative AI at work. Specific uses can be restricted by law, by professional rules or by your own organisation's policy, and the AEPD, Spain's data protection authority, published a ten point list of recommendations for using AI tools in January 2026 whose workplace point is simple: follow your organisation's policy and do not enter confidential data about staff or clients into the tools.

Using AI in a way that respects GDPR is not about picking the right logo. It is about four things: the plan you use, the contract behind it, the data you put in, and the rules you give your people. This guide takes them one at a time. It is written for owners and office managers of Spanish SMEs, not for lawyers, and it is not legal advice.

Is it legal to use ChatGPT in my company?

There is no rule against it. GDPR does not name any tool. It asks, for any processing of personal data, whether there is a legal basis and a purpose, whether anyone processing data on your behalf is bound by a written contract, whether security is adequate, and whether transfer rules are respected if data leaves the EU. Not every prompt contains personal data; a question about a tax deadline does not. A prompt that contains a client's name, situation or documents does.

The provider's role depends on what it does with the data. For the content of business customers, the four providers in this guide state that they act as processors, that is, they process on your behalf under your instructions, and that is where GDPR Article 28 requires a written contract. For other processing the same provider can be an independent controller, deciding purposes itself: Microsoft, for example, states that it is an independent controller for Bing web queries made through Copilot. The AEPD's Laboratorio described the prompt as the new risk perimeter in an August 2026 post, which the post itself notes is not official AEPD guidance. The first step is not buying a subscription. It is an inventory: which tools, which uses, which data.

What happens to the data I type in?

It depends on the plan, and the difference is large. On ChatGPT consumer plans, OpenAI states that content may be used to improve its models unless you opt out, and that content tied to feedback you submit may still be used. On Claude's Free, Pro and Max plans, Anthropic states that your data is used for training only if you allow it, with exceptions for safety review, and that allowing it extends retention of related data to up to five years. On personal Gemini with activity kept on, Google states that conversations can be used for training and reviewed by humans, with retention periods set out on its page.

On business plans the default flips: OpenAI, Anthropic, Microsoft and Google all state that business customers' content is not used to train their models by default, and each offers a data processing agreement, a DPA, which is the written contract GDPR requires between you and anyone who processes personal data for you. Two cautions. No training is not the same as no retention and no human access; logs, abuse monitoring and support access are separate questions with their own answers in each provider's terms. And a DPA is a contract, not a legal basis: it does not by itself make a use lawful.

Free or Plus versus Business or Enterprise: what actually changes

• ·Contract: consumer plans run on consumer terms; business plans come with a DPA that sets out what the provider may do with your data as your processor.
• ·Training: consumer plans may use your content for training unless you opt out or do not allow it; business plans do not by default.
• ·Admin control: business plans let you create and remove users and set workspace rules, which matters the day someone leaves.
• ·Location: options to keep data in the EU exist on some business plans, differ between providers and plans, and are changing. See the table.

Do ChatGPT, Claude, Copilot and Gemini comply with GDPR?

Compliance is not a property of a tool. Providers have their own obligations, and you have yours for the use you make. What you can check is what each provider states in its official documents. The facts below were checked on 12 October 2026 and link to the provider's own pages in the sources list; residency and routing options are changing, so read the current page for the plan you would actually buy. Inference, in the table, means the moment the model computes an answer to your prompt; where data is stored and where inference happens can be different places.

Two things stand out. First, a business plan with a DPA is the baseline for all four; it is not an upgrade, it is the minimum for work use involving personal data. Second, keeping data in the EU is not the default on any of them: it is a specific option on specific plans, with exceptions and routing rules written into the fine print, and EU storage does not mean that all processing happens in the EU. If a client or your professional rules require EU processing, read that line before you buy, not after.

Do I need a DPA?

If the provider processes personal data on your behalf, yes: GDPR Article 28 requires a written contract with any processor. For the four providers above the DPA exists and is part of the business terms; your job is to make sure the plan you buy is covered by it, to keep a copy, and to record the tool in your list of processors. Consumer plans do not offer a DPA. That does not make every use on a personal account unlawful by itself, but it means that any use involving personal data lacks the contract GDPR requires, which is a plain reason to keep work with personal data off personal accounts.

Does my data leave the EU, and what are the exceptions?

Often, yes. Claude states that data is stored in the United States unless you use its separate EU regional processing options. ChatGPT offers EU residency on specific plans and is rolling it out. Copilot's EU Data Boundary has exceptions for certain subprocessor models, for web queries and for some routing options. Workspace regionalises processing depending on edition and options.

A transfer outside the EU needs a valid mechanism. The EU-US Data Privacy Framework covers recipients that are certified and in scope; standard contractual clauses require you to assess the transfer, not only to sign. The provider DPAs name the mechanism they rely on. What a small firm has to do is know that a transfer happens, know on what basis, and be able to say so if a client asks. The exceptions matter more than the headline: a product that is EU hosted except for one feature is, for that feature, not EU hosted.

What should not go into an AI tool? A classification we suggest

The following three colour classification is our own suggestion for an internal policy. It is not a legal standard and it is not the AEPD's; the Laboratorio post mentioned above recommends classifying uses, and this is one way to do it. Your firm sets the colours; the law sets the obligations behind them.

• ·Green, allowed in approved tools: text with no personal data, general questions, your own drafting that identifies nobody. Note that publicly available personal data is still personal data and does not become green because it is public.
• ·Amber, allowed only on an approved business plan with a DPA, within an approved use case, with human review of the output: internal documents with limited personal data, routine correspondence that names clients, summaries of your own files.
• ·Red, not allowed in cloud AI tools under the policy unless a documented assessment approves a specific use: health data, data under professional secrecy, financial records that identify clients, employee data beyond work contact details, credentials, anything a client contract forbids you to share. Treating personal accounts as red for every use is a choice many firms make in their policy, not a legal requirement; we suggest it because personal accounts carry no DPA.

Do I need a data protection impact assessment?

A DPIA, data protection impact assessment, is the formal risk analysis GDPR Article 35 requires before processing that is likely to result in a high risk. There is no exemption by company size. High risk is assessed before the processing starts, using the AEPD's criteria, and combining several criteria, such as health data and an innovative technology, strengthens the case for a DPIA. An office drafting general letters with no personal data has no processing to assess. A clinic that wants an AI tool to summarise patient reports combines a special category of data with a new technology and should assess before starting. In between, write down what the tool will do, which data it will see, and why the risk is acceptable; that record is what an authority or a client will ask for.

What does the AI Act require from a small company in 2026?

Less than the headlines suggest, after the Digital Omnibus Regulation (EU) 2026/1744 entered into force on 27 July 2026. Article 4 on AI literacy now asks providers and deployers to take measures to support the development of AI literacy among their staff, without prescribing a level. A short training and a written policy are the usual measures a small firm takes; whether they are enough depends on how the firm uses AI, and the measures should match the use. A firm that uses a chatbot or a downloaded model is a deployer.

Article 50 transparency, the duty to tell people they are interacting with an AI system, applies generally from 2 August 2026; the transition to 2 December 2026 concerns only the marking obligations of providers for specified systems already on the market. The obligations for high risk systems in Chapter III, Sections 1 to 3, tied to Annex III, move to 2 December 2027. For an office using AI to draft and summarise, the AI Act is not the hard part; GDPR is.

How do I write an AI usage policy? A draft you can adapt

The AEPD published its own internal policy for generative AI and an implementation annex in December 2025, with an English summary in January 2026. It is written for the AEPD's own administration, but its structure is useful for any organisation: an inventory of tools, approval per use case, a contracting checklist, and a ban on unregistered tools. The bullet points below are our adaptation of that structure for a small firm. They are a starting point for your own document, not legal advice, and the choices in them, such as yearly training or excluding personal accounts, are organisational choices, not legal requirements.

• ·Scope: this policy covers every AI tool used for work, on any device. Personal accounts are not used for work that involves personal or confidential data.
• ·Approved tools: only the tools in the firm's inventory, on the firm's accounts, may be used. The inventory names for each tool the plan, the DPA, the data location and transfer basis, the retention of prompts and outputs, and who administers access.
• ·Purpose and approval per use: each use case (for example summarising client files) is approved by the person responsible before it starts, with a note of its purpose, the data it involves, its colour, and the legal basis for any personal data.
• ·Data minimisation: users enter only the data the task needs. Removing names is not anonymisation; a file that can still be linked to a person is still personal data.
• ·Data rules: red category data is not entered into cloud AI tools unless a documented assessment approves the specific use. Amber data only on approved business plans, within the approved use case.
• ·Access: accounts are personal to each user, removed on the day a person leaves, and reviewed when roles change.
• ·Retention and deletion: chat histories and uploaded files are deleted within the period set for each tool in the inventory, and in any case when the use case ends.
• ·Data subject rights: requests from people whose data was used in a tool are handled by the person responsible, who knows which tool holds what.
• ·Human review: AI output is checked by a person before it leaves the firm or is acted on. The person who sends it is responsible for it.
• ·Contracting checklist: before any tool is added, the firm checks and records the DPA, the training default, logs and retention, data location and transfers, and how users are removed.
• ·Training: every user receives a short training on this policy before access; the firm sets the refresh interval and records attendance.
• ·Incidents: anyone who enters data they should not have, or sees an unexpected output involving personal data, reports it without delay to the named incident owner, who decides whether a breach procedure applies.
• ·Review: this policy and the inventory are reviewed at a set interval and whenever a tool, plan or provider term changes.

Ten steps to assess AI use in your firm

• ·1. List every AI tool and every use your staff have today, including personal accounts, and the data each use involves.
• ·2. Move work that involves personal data to business plans with a DPA.
• ·3. Keep a copy of each DPA and add each tool to your record of processors.
• ·4. Check where each tool stores and processes data, which exceptions apply, and on what transfer basis; write it down.
• ·5. Classify your uses; name the red data for your firm.
• ·6. Decide which uses need a DPIA, using the AEPD criteria, before those uses start.
• ·7. Write the usage policy; the draft above is a starting point.
• ·8. Train everyone, in proportion to how they use AI, and record it.
• ·9. Make human review the rule for anything that leaves the firm.
• ·10. Review tools, plans and the policy at a set interval, and whenever a provider changes its terms.

Law firms: professional secrecy comes first

Lawyers in Spain are bound by professional secrecy under the Estatuto General de la Abogacía (Royal Decree 135/2021). That duty does not disappear because a tool has a DPA, and EU processing alone does not settle it either: the question is whether the lawyer can account for where a client document was processed and by whom, and whether the professional rules allow that processing at all. Removing a client's name from a document is not anonymisation if the matter can still be linked to a person. A firm should decide, in writing, which categories of work may touch a cloud tool and which stay inside its own systems, and should be able to show that decision to a client or the bar.

Clinics: health data is a special category

Health data is a special category under GDPR Article 9, and Spanish Law 41/2002 adds confidentiality duties for clinical information (articles 7 and 16.6). Processing it needs a legal basis under Article 6 and a condition under Article 9, a contract with the provider, and an assessment of whether a DPIA is required, which the combination of health data and a new technology makes likely. A clinic should treat any AI use on patient data as a project with those pieces in place before it starts. Administrative work that does not involve patients may still involve employee data, which is personal data too; it is lower risk, not no risk.

And a private or local AI?

For firms whose red category is most of their daily work, there is a fourth option: an open model running on a machine in your own office, so the model processing happens on your premises. It carries its own costs, it needs someone accountable for the machine, and it does not make a firm compliant by itself; the rules above still apply, and whoever maintains it remotely processes data on your behalf under a contract. We describe who it fits and what it involves on the Private AI service page, and our assessment often ends by recommending a business cloud plan instead.

Common questions

• ·Is ChatGPT safe to use at work? On a business plan with a DPA, for data your policy allows, with human review, it can be used like other software that processes data for you, with the same checks. On a personal account with client data, the contract GDPR requires is missing.
• ·Has the AEPD banned ChatGPT? No. The AEPD has published recommendations for using AI tools and its own internal policy; it has not banned any tool.
• ·Is Copilot compliant because it is Microsoft? Copilot has a DPA and an EU Data Boundary with stated exceptions. Compliance still depends on your data, your policy and your use.
• ·When should we ask a professional? When a use involves special categories of data, when a client contract restricts processing, when a DPIA is likely, or when you cannot answer the ten steps above with confidence.

No tool makes a firm compliant, and nobody can promise what an AI model will answer. What a firm can do is know its uses, choose the plan, hold the contract, draw the data line, assess the risky uses, and train its people in proportion to how they use AI.

Sources

• ·AEPD, decálogo de recomendaciones para proteger la privacidad al usar IA, 27 January 2026: https://www.aepd.es/prensa-y-comunicacion/notas-de-prensa/aepd-publica-decalogo-recomendaciones-proteger-privacidad-al-usar-ia and https://www.aepd.es/guias/recomendaciones-ia-aepd.pdf
• ·AEPD, política de uso de IA generativa (internal policy): https://www.aepd.es/documento/politica-iag-aepd.pdf ; implementation annex, 12 December 2025: https://www.aepd.es/documento/anexo-implementacion-politica-iag-aepd.pdf ; English summary, January 2026: https://www.aepd.es/en/guides/summary-recommendations-iag-aepd.pdf
• ·AEPD Laboratorio, Prompts, datos personales y confidencialidad, 25 August 2026 (blog post, not official AEPD guidance): https://laboratorio.aepd.es/blog/prompts-datos-personales-y-confidencialidad-el-nuevo-perimetro-de-riesgo-de-la-ia-generativa
• ·Regulation (EU) 2016/679 (GDPR), articles 6, 9, 28, 35: https://eur-lex.europa.eu/eli/reg/2016/679/oj
• ·Regulation (EU) 2026/1744 (Digital Omnibus), in force 27 July 2026: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744
• ·OpenAI, Enterprise privacy, updated 8 January 2026: https://openai.com/enterprise-privacy/ (checked 12 October 2026)
• ·OpenAI, Data residency and inference residency for ChatGPT: https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt (checked 12 October 2026)
• ·OpenAI, How your data is used to improve model performance: https://help.openai.com/en/articles/5722486-how-your-data-is-used-to-improve-model-performance (checked 12 October 2026)
• ·Anthropic, Commercial terms and DPA: https://www.anthropic.com/legal/commercial-terms and https://www.anthropic.com/legal/data-processing-addendum (checked 12 October 2026)
• ·Anthropic, Is my data used for model training, 18 August 2026: https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training
• ·Anthropic, Where is my data stored, 15 June 2026: https://privacy.claude.com/en/articles/7996890 ; regional processing: https://claude.com/regional-compliance
• ·Anthropic, Updates to consumer terms, 28 August 2025: https://www.anthropic.com/news/updates-to-our-consumer-terms
• ·Microsoft, Microsoft 365 Copilot privacy, 18 August 2026: https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy ; Copilot privacy and protections, 24 August 2026: https://learn.microsoft.com/en-us/copilot/privacy-and-protections
• ·Google, Generative AI in Google Workspace privacy hub: https://knowledge.workspace.google.com/admin/generative-ai/generative-ai-in-google-workspace-privacy-hub ; data covered by data regions, 9 October 2026: https://knowledge.workspace.google.com/admin/compliance/data-covered-by-data-regions ; Gemini Apps privacy: https://support.google.com/gemini/answer/13594961 (checked 12 October 2026)
• ·Estatuto General de la Abogacía Española, Real Decreto 135/2021: https://www.boe.es/boe/dias/2021/03/24/pdfs/BOE-A-2021-4568.pdf
• ·Ley 41/2002, de autonomía del paciente, articles 7 and 16.6: https://www.boe.es/buscar/act.php?id=BOE-A-2002-22188