Is ChatGPT GDPR Compliant? A Guide for Small Businesses (Even Outside the EU)

If you run a small clinic, firm, or practice and you have ever wondered whether typing a client's details into ChatGPT is a GDPR problem, the honest answer starts with a question back: which ChatGPT, and does GDPR even reach you? Both halves matter, and most of the generic "GDPR for small business" content online answers neither for your specific situation. This guide traces exactly what happens to a client's personal data when it lands in ChatGPT, against the specific parts of the regulation that govern it — and where running a model on your own hardware quietly removes the problem.

The short answer: consumer ChatGPT (free or Plus) is a weak GDPR fit for other people's personal data because, on that tier, OpenAI is the data controller under its own EU privacy policy — you have no processing contract and OpenAI sets the terms (OpenAI EU privacy policy). The paid business tiers are built differently: OpenAI will sign a Data Processing Addendum and act as your processor "in support of" your GDPR compliance (OpenAI enterprise privacy). But on every cloud tier, your client's data still lives on someone else's servers — which keeps two of GDPR's hardest duties, erasure and cross-border transfer, on your plate. Local processing is the one option that makes both of those disappear.

Does GDPR Even Apply to My Small, Non-EU Business?

This is the question most owners quietly assume the answer to — usually wrongly, in the reassuring direction. GDPR is not "an EU-only law for big companies."

The reach is set by Article 3(2), which extends the regulation to a controller or processor not established in the Union where the processing relates to "the offering of goods or services... to such data subjects in the Union" or "the monitoring of their behaviour... within the Union" (GDPR Art. 3). The European Commission puts the same rule in plainer words: the law applies to "a company established outside the EU" that "is offering goods/services (paid or for free) or is monitoring the behaviour of individuals in the EU" (European Commission). So an accounting practice with a handful of EU clients, or a clinic whose website tracks EU visitors, can be in scope wherever its building physically sits. This is the same "wherever your building is" logic behind data residency and sovereignty — obligations follow the data subject, not the postcode of your office.

And no, being small does not exempt you. People point to a "under 250 employees" rule, but that carve-out is Article 30(5), and it is narrow: it relieves smaller organisations of only the records-of-processing obligation, and it withdraws even that relief when processing "is likely to result in a risk to the rights and freedoms of data subjects," is "not occasional," or "includes special categories of data" (GDPR Art. 30). Health notes, therapy records, and case files are special-category or otherwise sensitive data — exactly the material that voids the exemption. The offices most eager for a small-business pass are usually the ones who don't get it.

(If your clients are Canadian rather than European, the parallel law is PIPEDA rather than GDPR — same shape of duty, different statute. We cover it separately in PIPEDA-compliant AI.)

What Actually Happens to a Client's Data Inside ChatGPT?

Here is where the "which ChatGPT" question decides everything. The custody chain is genuinely different across tiers.

On the consumer app (free or Plus), OpenAI's EU privacy policy states that OpenAI itself is the controller and relies on "the Standard Contractual Clauses as approved by the European Commission pursuant to Article 46(2)(c) GDPR" for transfers out of the EEA (OpenAI EU privacy policy). Read that carefully: on this tier you are not the controller of the data you paste in — OpenAI is, under its own terms. There is no Data Processing Addendum between you and OpenAI. For your own client data, that is the wrong relationship: you are handing personal data to a company that will process it as its controller, on its terms.

On ChatGPT Business, Enterprise, or the API, the relationship flips. OpenAI's DPA states that "Module Two (Controller to Processor) of the SCCs apply when Customer is a Data Controller and OpenAI is processing Customer Data as a Data Processor" (OpenAI DPA), and OpenAI confirms it will "execute a Data Processing Addendum (DPA) with customers for their use of ChatGPT Business, ChatGPT Enterprise, and the API in support of their compliance with GDPR" (OpenAI enterprise privacy). Now you are the controller and OpenAI is your vetted processor — the correct GDPR structure. Microsoft describes the same arrangement for its assistant: Microsoft 365 Copilot inherits the Microsoft 365 commercial commitments "including the General Data Protection Regulation (GDPR) and European Union (EU) Data Boundary," and "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs" (Microsoft Learn). Good terms — but still cloud custody. Your text is processed on their servers, under contract. Which brings us to the two duties that contract cannot fully solve.

The Two Duties Cloud AI Makes Hard: Erasure and Transfer

Erasure (Article 17). A data subject "shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay" (GDPR Art. 17). If a client's personal data has been typed into a chat and may sit in stored logs, honouring a deletion request means being able to reach into a vendor's systems and prove it's gone. On a business tier with a DPA and deletion mechanisms, that is workable but ongoing. On the consumer tier, where you are not even the controller, it is not a duty you can meaningfully discharge — you don't hold the levers.

Cross-border transfer (Chapter V, Article 44). Sending personal data to a US-based cloud AI is a transfer to a third country, permitted "only if... the conditions laid down in this Chapter are complied with" (GDPR Art. 44). OpenAI's answer is the EU Standard Contractual Clauses with OpenAI Ireland Ltd as the EEA contracting entity, plus a UK Addendum (OpenAI DPA). That is a legitimate mechanism — but it is a mechanism you have to have in place, keep valid, and be able to defend. It exists precisely because the data is crossing a border it otherwise shouldn't.

Both of these are real, recurring homework. Neither disappears on a cloud tier — the business tier just gives you the paperwork to manage them.

How Does Running the Model Locally Change the GDPR Picture?

This is the part the vendor-blog listicles never reach, because they only sell cloud. Local AI means the model runs on a computer you own — a desktop in your office — using free software like Ollama or LM Studio, instead of a provider's data centre. (New to the idea? Start with What Is Local AI?)

Trace the two hard duties again with a local model. If the text is processed on hardware you own and never leaves the building, there is no third-party processor to appoint, vet, and contract with under a DPA — because there is no third party. And there is no cross-border transfer to justify under Chapter V — because the data crossed no border. The processor obligation and the transfer obligation don't get satisfied; they stop existing. That is a structurally different position from "we signed the SCCs."

What local AI does not do is make you compliant on its own. You are still the controller. You still need a lawful basis for holding the data, still owe access control, and still must answer data-subject requests — but now from your own systems, which you already know how to manage. It's the same honest split we draw in local AI vs cloud AI: local changes who else holds your data, not your own internal obligations.

Which Route Fits Which Office? A Side-by-Side

	Consumer ChatGPT (free/Plus)	ChatGPT Business / Enterprise / API, or Copilot	Local AI (your own hardware)
Your GDPR role	Not the controller — OpenAI is (EU policy)	You are controller; vendor is processor under a signed DPA (OpenAI DPA)	You are controller; there is no processor
Processor to vet (Art. 28)	No DPA available to you	Yes — DPA + SCCs to keep valid	None — no third party
Cross-border transfer (Ch. V)	OpenAI's own transfer terms apply	Your responsibility, via SCCs/UK Addendum	None — data never leaves the building
Training on your data	May be used unless you opt out (OpenAI data controls)	Not by default (enterprise privacy; Copilot)	Nothing is sent anywhere when run offline
Erasure (Art. 17)	Hard — you don't hold the levers	Workable via vendor deletion tools	Your own disk, your own delete
Good fit for	Non-personal, public material only	Offices that will read and maintain the contracts	Sensitive work you'd rather never send out

There is no dishonest column here. If your AI use touches nothing personal — marketing copy, public research, rewriting your own website — consumer ChatGPT is fine and cheaper to start. If you'll actually sign the DPA, read the SCCs, and maintain them, the business tier is a legitimate GDPR route. For a fuller privacy ranking across ChatGPT, Copilot, Gemini, and Claude, see the most-private AI comparison; the GDPR-adjacent HIPAA version of this same logic is in Is ChatGPT HIPAA compliant?.

So, Should You Go Local?

The honest close. Local AI is not a magic compliance button. It costs real money up front — a capable small machine, plus the time to set it up — and it runs open models a step behind the very largest cloud models, so hard reasoning tasks may still be better served by a frontier model handling nothing confidential. You also still own your controller duties.

What you buy in exchange is the disappearance of the two questions that make GDPR-plus-AI genuinely stressful for a small office: who is our processor and are the papers valid, and where did that personal data get transferred. When the model runs on hardware you own, there is no processor and no transfer to answer for. It's the position one trial lawyer on r/LawFirm was pointing at: "Yes, sharing that information with ChatGPT (OpenAI), is not a good idea. Using your own self-hosted language model would be better." Whether that trade is worth it depends on how much of your daily work touches personal data — which is exactly what the readiness quiz estimates in a couple of minutes.