You can use ChatGPT at work without exposing your data, on one condition: don’t let everyone use their personal account. On its business plans, ChatGPT Business and ChatGPT Enterprise, OpenAI doesn’t train its models on company data by default, and offers a data processing agreement (DPA) for the GDPR. What no plan changes: OpenAI remains a US company, and storing data in Europe is reserved for Enterprise.
ChatGPT plans compared
Checked on 22 October 2026 on OpenAI’s official pages (Business pricing, enterprise privacy, OpenAI help centre). OpenAI shows its prices in dollars and says they may vary by country and currency.
| Personal accounts (Free, Plus, Pro) | ChatGPT Business | ChatGPT Enterprise | |
|---|---|---|---|
| Price | free; Plus $20 a month; Pro $100 to $500 a month | $20 per seat per month billed annually, $25 billed monthly; 2 to 200 seats | on request |
| Your conversations train the models | yes, unless you turn off the model improvement setting | no, by default | no, by default |
| Deleted conversations | erased within 30 days, unless legally required | erased within 30 days, unless legally required | retention set by the admin; erased within 30 days |
| Data stored in Europe | no | no | yes, for new workspaces, at no extra cost |
| Data processing agreement (DPA) | no | yes | yes |
| Single sign-on (SAML SSO) | — | yes | yes |
| ISO 27001, 27701 certifications | — | no, according to OpenAI’s table | yes |
A business that enters its VAT number at checkout is billed without VAT, according to OpenAI’s help centre.
What the business plans guarantee
No training by default. OpenAI puts it this way: “By default, we do not use your business data for training our models.” The contract says the same thing, with the same caveat: unless the customer explicitly agrees. Some marketing pages say “never”: the text that binds OpenAI says “by default”.
A GDPR contract. OpenAI offers a DPA for ChatGPT Business, ChatGPT Enterprise and its API. Data transfers outside Europe are covered by the European Commission’s standard contractual clauses. For a customer based in the EU, the contract is signed with OpenAI Ireland Ltd. and governed by Irish law.
Security. OpenAI states that data is encrypted at rest (AES-256) and in transit (TLS 1.2 and above), and that both Business and Enterprise have passed a SOC 2 Type 2 audit.
What no plan changes
OpenAI remains a US company. The CLOUD Act, a US law of 2018, requires a service provider subject to US law to disclose, under a lawful request, the data in its possession, custody or control, whether it is stored in the United States or elsewhere (official text, 18 U.S.C. § 2713). OpenAI’s pages don’t comment on this. Its DPA only provides for warning the customer of a government request, to the extent the law allows. What this means for your data is a question for your DPO or your lawyer.
Storing in Europe doesn’t mean processing everything in Europe. European data residency, reserved for Enterprise and Edu, covers conversations, files and custom GPTs at rest. It excludes web search, connected apps, workspace metadata and login credentials.
A court can put deletion on hold. In 2025, in the lawsuit brought against it by The New York Times, OpenAI had to keep conversations it would normally have deleted. This affected personal accounts and the Team plan, the former name of Business; Enterprise and Edu weren’t affected. The obligation ended on 26 September 2025, according to OpenAI.
The alternatives
| Mistral Vibe (formerly Le Chat) | Microsoft Copilot Chat | |
|---|---|---|
| Provider | Mistral AI, a French company (Paris) | Microsoft, a US company |
| Price | Pro €14.99 excl. VAT a month; Team €24.99 excl. VAT per user per month; Enterprise on request | no extra cost for work accounts with an eligible Microsoft 365 subscription |
| Training | yes by default, unless you turn it off; Team: the admin can turn it off for the whole team; Enterprise: off by default | prompts and responses aren’t used to train the foundation models |
| Where the data is | in the European Union by default; some features may transfer it temporarily outside the EU | Microsoft’s EU Data Boundary, which excludes web search and Anthropic models |
Checked on 22 October 2026 on Mistral AI’s pricing page (in French, prices in euros), its help article on training and Microsoft’s enterprise data protection page. Mistral AI’s Le Chat has been called Vibe since 2026. French government departments have their own tool, Albert, which isn’t open to businesses.
Which plan for whom?
- You use ChatGPT on your own, with a personal account. Don’t paste in client data, personal data or internal documents, and turn off training in the settings. The CNIL, France’s data protection authority, considers a consumer service acceptable for non-confidential uses, with dedicated work email addresses and data reuse turned off (CNIL Q&A, in French, 18 July 2024).
- You’re equipping a small team. ChatGPT Business brings the DPA and no training by default, but not storage in Europe. Mistral Team keeps data in the EU by default, provided the admin turns off training.
- You handle sensitive data (health, HR, client data, professional secrecy). For personal data and sensitive documents, the CNIL recommends favouring “on-premises” solutions, and a processing contract with the host in other cases. That means Enterprise with European data residency, a European Enterprise plan, or an AI that runs on your own machines.
In every case, the CNIL advises starting with a written list of permitted and forbidden uses, training your teams, and involving your DPO and your head of security (CNIL recommendations, in French). More on the same subject: the confidentiality resources.
And without sending your texts anywhere?
On the free plan, Keypop works with local AI: the AI runs on each person’s computer, your texts stay on the machine, and all you need is a free account with your email. For large documents, the sovereign cloud AI in the Pro plan is hosted in Paris by a French provider, with no training on your texts and nothing stored.
