gdpr · openai · ai compliance · data protection · legal

Is it GDPR-compliant to send customer data to OpenAI?

An engineering guide to reviewing LLM data flows: GDPR scope, provider roles, retention, minimisation and evidence for qualified privacy advice.

Godfrey Lebo Founder, Sether July 9, 2026 · updated October 17, 2026 · 10 min read

Sether™ / Field notes gdpr A control needs a wider plan. Review data handling alongside technical redaction.

When does GDPR apply to an LLM prompt?

First establish scope. GDPR can apply through an EU establishment or, for organisations outside the EU, through relevant offers of goods or services to people in the Union or monitoring of their behavior there. A person’s citizenship alone is not the test. The EU’s business guide explains these starting points.

SetherThe idea, illustrated Your map. Your side.

There is no prompt exception. If your support bot forwards "Hi, I'm Sarah Chen, sarah@acme.com, my card was charged twice" to the OpenAI API, you just processed personal data and disclosed it to a third party. The same is true for background jobs, evals, and fine-tuning datasets, not just live chat.

Start with a fictional request that represents the feature, then inventory its fields and recipients. An email is easy to spot; a ticket reference or distinctive incident description can also connect the request to a person. Calling the payload “synthetic” or “redacted” is not a substitute for checking what it contains.

What is OpenAI, legally, in this relationship?

The roles are functional. A controller determines purposes and means; a processor acts on a controller’s behalf. Your business may itself act as a processor for a customer. Review the activity and provider terms before deciding which role applies; do not infer every relationship from the fact that an API call was made.

Where a controller uses a processor, GDPR Article 28 requires a binding arrangement containing specified terms, in writing including electronic form. Locate the agreement that actually governs your account. Not having personally signed a separate PDF does not prove that nobody accepted applicable terms.

What paperwork do you actually need?

1. Locate the governing terms. Ask your account owner which entity, product terms and data-processing arrangement cover the service; keep the version reviewed.
2. Map the recipients. Record the model service, hosting, subprocessors, observability and support paths rather than assuming the visible API endpoint is the whole flow.
3. Record the purpose and lifecycle. Show why each field is sent, where replies and logs persist, who can access them and how deletion works.
4. Ask your privacy adviser which duties apply. Lawful basis, transparency, records, customer authorizations and impact assessment requirements depend on the processing; a generic blog checklist is not a determination.

OpenAI’s API data controls state that API inputs are not used for training unless you opt in. They also distinguish abuse-monitoring logs from application state: default logs may be retained up to 30 days, while endpoint and feature behavior varies. Zero Data Retention has eligibility and feature limits. Review the controls for your actual account and endpoint; consumer chat settings are a separate service question.

Does sending data to a US company break the transfer rules?

A company’s name or headquarters does not by itself describe every transfer in your integration. Check the contracting entity, processing locations, remote access and subprocessors against the actual service configuration.

For transfers outside the EU, adequacy decisions and appropriate safeguards such as standard contractual clauses are possible routes, with conditions that must be assessed. The EU business guide’s transfer section is a starting point, not confirmation that a particular vendor or transfer qualifies.

For an engineering review, keep the provider’s documented locations and selected settings beside the contract version. If your team relies on certification, contractual clauses or residency controls, have the responsible adviser verify the current coverage and any remaining access paths.

What technical measures does GDPR expect?

The Commission’s GDPR principles guide connects purpose, minimisation, retention and safeguards. For an AI feature, translate that into an engineering question: does drafting this refund reply require the actual email address, or just an address-shaped reference?

Try removing unnecessary fields before adding detection. Then use replacement for supported values the task can do without. Verify the edited request, including metadata and error paths. Redaction is one useful control alongside access restrictions, retention settings and review; it is not universally the strongest control for every use case.

Reversible replacement keeps a way to reconnect data to a person. The Commission explains that re-identifiable pseudonymised data remains personal data. Identifying context can remain even without the mapping. The implementation mechanics are in the complete guide to PII redaction for LLM apps; they are not a legal exemption.

What have regulators signaled, and where does the EU AI Act fit?

Treat privacy review as a description of what the feature actually does, rather than a badge conferred by a model provider or a library. A useful review can show the request before and after minimisation, the destinations, retention choices and the handling of errors without circulating real customer records.

The EU AI Act is a separate, role- and use-dependent framework. Its obligations have a staged timetable; there is no single deadline or fine that describes every application calling an LLM. Check the Commission’s current AI Act page for the applicable categories and dates. Neither an SDK installation nor this article certifies compliance with it.

What do you need for each type of data?

So, is it compliant or not?

There is no responsible yes-or-no answer for an unspecified application. The conclusion depends on the actual processing, agreements and controls. A redaction demo is evidence about one technical step; it is not evidence that the entire data flow meets the law.

Prepare a short review packet: a fictional request and reply, the field inventory, a diagram of recipients, the provider settings and terms reviewed, and the chosen behavior when detection or restoration fails. That gives your adviser concrete facts to assess and gives engineering a record it can maintain as the feature changes.

This post is not legal advice. It is an engineer's map of the terrain, written to help you ask your lawyer better questions. For decisions about your specific data and contracts, consult a qualified data protection professional.

Written by Godfrey Lebo

Founder of Sether. Ships production software for a living and reads every comment below. More about the team.