--- title: "ChatGPT Enterprise GDPR & DPA: Compliance Guide for German Companies 2026" description: "Is ChatGPT Enterprise GDPR compliant? OpenAI DPA, EU data residency, SOC 2, AI Act obligations, and works council requirements for German companies." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/chatgpt-enterprise/" language: "en" --- ![ChatGPT Enterprise GDPR and DPA compliance guide for Germany](https://compound.law/assets/images/tools/tools_4.webp) tools # ChatGPT Enterprise GDPR & DPA: Compliance Guide for German Companies 2026 18 April 2026 **ChatGPT Enterprise is deployable in Germany under the GDPR, but only with the right contractual and operational setup in place.** OpenAI provides a Data Processing Agreement (DPA) covering Article 28 GDPR requirements, offers an EU data residency option, and contractually guarantees no training on enterprise customer data. The compliance burden for your organisation depends heavily on how you use the platform — who inputs what data, for which purposes, and whether employee or customer personal data is involved. German companies also need to address works council co-determination rights under BetrVG §87 No. 6 before a company-wide rollout. This guide covers ChatGPT Enterprise GDPR compliance, the OpenAI DPA, EU data residency, SOC 2 certification, EU AI Act obligations, and the works council requirements that frequently surprise German procurement teams. For an overview of how ChatGPT Enterprise fits into the broader enterprise AI landscape, see the [AI tools assessed by Compound Law](https://compound.law/en-DE/tools/). ## Is ChatGPT Enterprise GDPR Compliant? **Yes — ChatGPT Enterprise can be used in a GDPR-compliant way in Germany, but that result depends on your specific deployment, not just the product.** OpenAI has built enterprise-specific compliance infrastructure into ChatGPT Enterprise: a formal DPA for Article 28 GDPR, an EU data residency option, contractual no-training-on-enterprise-data guarantees, and SOC 2 Type II certification. Those features establish the compliance foundation. What determines whether your deployment is actually lawful: - Whether you have executed the OpenAI DPA before processing begins - Whether EU data residency is activated in the admin console - Whether your legal bases for each use case are clearly mapped - Whether you have addressed works council requirements before rollout - Whether high-risk use cases — HR, credit assessments, legal advice workflows — have received additional scrutiny under the EU AI Act For a broader overview of [AI chatbot compliance under GDPR](https://compound.law/en-DE/compliance/ai-chatbots/), our compliance guide covers the key obligations that apply to conversational AI tools. ## ChatGPT Enterprise Data Processing Agreement (DPA) The **OpenAI DPA** is the contractual core of any compliant ChatGPT Enterprise deployment. Under Article 28 GDPR, you need a processor agreement before you can lawfully process personal data through OpenAI’s systems. OpenAI provides an enterprise DPA that covers: - **Processing scope and instructions:** The DPA defines what processing OpenAI is authorised to perform on your behalf. - **Subprocessors:** OpenAI lists approved subprocessors — including Microsoft Azure as the primary infrastructure provider — and commits to notification procedures when subprocessors change. - **Standard Contractual Clauses (SCCs):** Because OpenAI is a US company, the DPA incorporates EU SCCs under Article 46 GDPR for international data transfers when data leaves the EEA. - **Deletion and retention obligations:** The DPA specifies how data is handled at contract termination, including deletion timeframes. - **Security commitments:** Technical and organisational measures (TOMs) under Article 32 GDPR are addressed in the contract. ### Processor vs. controller roles Under the DPA, OpenAI acts as a **data processor** and your organisation acts as the **data controller** for personal data you input into ChatGPT Enterprise. This is the standard Article 28 relationship. It means you bear primary GDPR responsibility for the lawfulness of the processing, the legal basis, and what data your teams actually input. **Critical point:** The DPA does not execute itself. Many companies proceed with enterprise licensing without formally completing the DPA process. Before activating the platform for business use, ensure the DPA is in place and reviewed against your specific use cases — general productivity workflows have different requirements from customer-data or employee-data processing. For users comparing OpenAI’s enterprise DPA with the standard API contract, our [OpenAI API compliance guide](https://compound.law/en-DE/tools/openai-api/) covers the API data processing terms in detail. ## EU Data Residency for ChatGPT Enterprise OpenAI offers an **EU data residency option** for ChatGPT Enterprise customers. When enabled, conversation data — prompts, outputs, and conversation histories — is stored and processed within the European Union, primarily in Ireland. This matters for GDPR compliance in two concrete ways: 1. **Reduced transfer risk:** EU data residency significantly limits the international transfer risk under Chapter V GDPR and simplifies the Schrems II analysis for your DPIA. 2. **Simplified documentation:** If data stays in the EU, you do not need to document individual data transfers to the US for the data covered by this option. **How to activate it:** EU data residency must be explicitly enabled in the ChatGPT Enterprise admin console. It is not the default. German procurement teams should verify this setting is activated — and document it — as part of the deployment checklist. ### Does EU data residency protect against US government access? This is a question German legal teams regularly raise. **EU data residency reduces but does not eliminate US government access risk.** OpenAI is a US company subject to the **CLOUD Act**, which allows US authorities to compel production of data held by US companies even when that data is stored abroad. EU data residency is the right technical control and is meaningfully better than no residency option. But for organisations handling highly sensitive data — trade secrets, regulated financial data, health information — the CLOUD Act risk should be acknowledged in your risk register and DPIA documentation. ## ChatGPT Enterprise Security & Certifications ChatGPT Enterprise includes a security profile designed for enterprise deployment: - **SOC 2 Type II certification:** OpenAI maintains an active SOC 2 Type II certification for ChatGPT Enterprise, covering security, availability, and confidentiality controls. This is typically required by German procurement and vendor-risk functions. - **Encryption in transit and at rest:** Data is encrypted in transit using TLS and at rest in OpenAI’s infrastructure. - **No training on enterprise data:** OpenAI contractually guarantees that data processed through ChatGPT Enterprise is not used to train or improve its models. This is one of the most frequently asked procurement questions and the answer is clearly documented in the enterprise terms. - **SSO and SCIM:** Centralised identity management through single sign-on and SCIM integration supports IT governance requirements. - **Audit logs:** Enterprise admin consoles include usage and activity logs that support compliance documentation and internal monitoring. - **Admin access controls:** Role-based management allows IT and security teams to control who accesses the platform and with what permissions. These controls are a strong foundation. Certifications should be used as inputs to vendor-risk assessment alongside the contractual DPA and transfer analysis above — not as a substitute for it. ## ChatGPT Enterprise and the EU AI Act ### GPT-4o as a GPAI model GPT-4o, the model powering ChatGPT Enterprise, is classified as a **General Purpose AI (GPAI) model** under the EU AI Act. This means OpenAI, as the GPAI provider, carries specific obligations under the Act: - Technical documentation and transparency reports (Article 53 AI Act) - Copyright and training data compliance - Watermarking capabilities for AI-generated content (Article 50 AI Act) OpenAI is responsible for these obligations as the model provider — not your organisation. ### Your obligations as deployer in Germany As the **deployer** of ChatGPT Enterprise, your EU AI Act obligations depend on how you use the system. **What applies now (from 2 February 2025):** - **AI literacy obligation (Article 4 AI Act):** You must ensure employees using AI tools have sufficient AI competency. Structured training and awareness programs are the practical implementation. - **Prohibited practices check:** Review your ChatGPT Enterprise use cases against the prohibited AI practices that took effect on 2 February 2025. Standard enterprise productivity use is not affected. **High-risk use cases to document:** | Use case | AI Act risk level | Notes | | -------------------------------------------- | -------------------------------- | --------------------------------------------- | | Drafting, research, summaries | Minimal | Standard practice, no additional requirements | | Code assistance, document analysis | Minimal to limited | Transparency recommended | | HR screening or candidate evaluation | **High-risk** (Annex III, No. 4) | Full compliance obligations apply | | Credit scoring or financial assessment | **High-risk** (Annex III, No. 5) | Detailed review required | | Legal decision support (courts) | **High-risk** (Annex III, No. 8) | Strictest requirements apply | | Customer-facing chatbot (direct interaction) | Limited (Art. 50) | Transparency obligation from August 2026 | For [legal services firms in Germany](https://compound.law/en-DE/ai-act/legal-services/) and [professional services companies](https://compound.law/en-DE/ai-act/professional-services/), the high-risk thresholds are particularly relevant where AI assists with client-facing decisions. **Transparency obligations from August 2026:** From 2 August 2026, Article 50 AI Act requires deployers of AI systems that interact directly with individuals to make that AI interaction recognisable. If you deploy ChatGPT Enterprise in customer-facing workflows — support, communication, automated responses — plan for this requirement now. ## Works Council & Employee Data (Betriebsrat) For German companies, the works council dimension is one of the most practically significant and most frequently underestimated compliance requirements for ChatGPT Enterprise. ### Mandatory co-determination under BetrVG §87 No. 6 Under **§87 Abs. 1 Nr. 6 BetrVG**, the works council (Betriebsrat) has statutory co-determination rights over the introduction of technical systems capable of monitoring employee behaviour or performance. ChatGPT Enterprise — with its admin console, SSO usage data, and audit logs — typically triggers this right. **What this means for your rollout:** 1. **Engage the Betriebsrat before deployment**, not after. Retroactive justification rarely works and risks injunctive action. 2. Explain how the tool works, what usage data is collected, how audit logs are used, and what limits apply to management access. 3. Negotiate a **Betriebsvereinbarung** that defines permitted and prohibited uses, data access rules, and monitoring limits. 4. Do not activate ChatGPT Enterprise company-wide until the Betriebsvereinbarung is signed. ### Employee monitoring considerations The audit logs and usage data in ChatGPT Enterprise can in principle be used to monitor employee activity — which prompts employees submitted, how often they used the tool, what workflows they ran. Even if you do not intend to use this data for performance monitoring, the technical capability exists and the Betriebsrat will likely raise it. Address this directly in the Betriebsvereinbarung by limiting access to usage analytics to IT and security purposes and explicitly excluding individual performance monitoring. For detailed guidance on AI-based workplace monitoring requirements, see our guide on [AI employee monitoring compliance](https://compound.law/en-DE/compliance/ai-employee-monitoring/). ## ChatGPT Enterprise vs. Claude Enterprise: Compliance Comparison For German companies evaluating enterprise AI tools, this comparison covers the core compliance dimensions: | Feature | ChatGPT Enterprise (OpenAI) | Claude Enterprise (Anthropic) | | ---------------------------------- | ---------------------------------- | --------------------------------------------- | | DPA / AVV included | Yes — enterprise agreement | Yes — incorporated into commercial terms | | EU data residency | Yes — available, must be activated | Via AWS Bedrock or Google Vertex AI only | | SOC 2 Type II | Yes | Yes | | ISO 27001 | Yes | Yes | | No training on enterprise data | Yes — contractual guarantee | Yes — commercial product default | | AI Act GPAI status | Yes (GPT-4o) | Yes (Claude 3 family) | | Works council trigger (BetrVG §87) | Yes — audit logs and SSO data | Yes — similar enterprise admin infrastructure | | Zero-data-retention option | Not standard | Yes — optional add-on for Enterprise | Neither product is automatically more compliant than the other. The better choice depends on your specific use case, data sensitivity, and infrastructure preferences. For a detailed analysis of Anthropic’s compliance profile, see our [Claude Enterprise compliance guide](https://compound.law/en-DE/tools/claude-enterprise/). ## Practical Compliance Checklist for German Companies Use this checklist before a company-wide ChatGPT Enterprise rollout: 1. **Execute the OpenAI DPA** — do not assume it is covered by the enterprise license alone. 2. **Activate EU data residency** in the admin console and document the configuration. 3. **Map legal bases** for each use case — legitimate interest works for general productivity but not for all data types. 4. **Engage the Betriebsrat** before deployment and negotiate a Betriebsvereinbarung. 5. **Inventory your use cases** and classify each against the EU AI Act risk table above. 6. **Run AI literacy training** for employees (Article 4 AI Act, in force February 2025). 7. **Draft an internal acceptable use policy** — define what data may and may not be inputted. 8. **Update your privacy notice** to reflect ChatGPT Enterprise as a processing tool. 9. **Conduct a DPIA** if you process special-category data, large-scale customer data, or plan high-risk use cases. 10. **Plan for Article 50 AI Act transparency** requirements before August 2026 for customer-facing deployments. ## How Compound Law Helps - DPA review and gap analysis against your specific use cases - Works council negotiation support and Betriebsvereinbarung drafting - AI Act use-case risk classification - DPIA for ChatGPT Enterprise deployments - Acceptable use policy and employee training materials - Ongoing compliance support as OpenAI updates its platform ## Frequently Asked Questions ### Does ChatGPT Enterprise have a DPA? Yes. OpenAI provides a Data Processing Agreement for ChatGPT Enterprise customers that covers Article 28 GDPR requirements, including subprocessors, Standard Contractual Clauses for US transfers, deletion procedures, and security commitments. The DPA must be formally executed — it does not apply automatically through the enterprise license. ### Does OpenAI offer EU data residency for ChatGPT Enterprise? Yes. OpenAI offers an EU data residency option for ChatGPT Enterprise that keeps conversation data within the EU, primarily in Ireland. This option is not enabled by default and must be activated in the admin console. It significantly reduces — but does not entirely eliminate — international transfer risk due to the US CLOUD Act. ### Is ChatGPT Enterprise SOC 2 certified? Yes. OpenAI maintains an active SOC 2 Type II certification for ChatGPT Enterprise, covering security, availability, and confidentiality controls. This certification is typically required by German vendor-risk and procurement functions but should be reviewed alongside the contractual DPA and transfer terms. ### Can German companies use ChatGPT Enterprise for HR decisions? Only with significant additional compliance work. HR screening, candidate evaluation, and workforce analytics using ChatGPT Enterprise are classified as **high-risk** under EU AI Act Annex III, No. 4, triggering full AI Act compliance obligations — risk management systems, human oversight, logging, and a conformity assessment. Additionally, any HR-related AI deployment at a company with a works council requires specific Betriebsvereinbarung provisions addressing data use, automated decision support, and employee rights. ### What are ChatGPT Enterprise’s AI Act obligations for deployers? As a deployer, your main EU AI Act obligations are: (1) AI literacy training for employees using the tool (Article 4, in force from 2 February 2025); (2) avoiding prohibited AI practices; (3) identifying and separately managing any high-risk use cases such as HR, credit scoring, or legal decision support; and (4) implementing transparency disclosures for customer-facing AI interactions from 2 August 2026 under Article 50 AI Act. OpenAI handles its separate obligations as the GPAI model provider. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. OpenAI provides a Data Processing Agreement for ChatGPT Enterprise customers that covers Article 28 GDPR requirements, including subprocessors, Standard Contractual Clauses for US transfers, deletion procedures, and security commitments. The DPA must be formally executed — it does not apply automatically through the enterprise license. Yes. OpenAI offers an EU data residency option for ChatGPT Enterprise that keeps conversation data within the EU, primarily in Ireland. This option is not enabled by default and must be activated in the admin console. It significantly reduces — but does not entirely eliminate — international transfer risk due to the US CLOUD Act. Yes. OpenAI maintains an active SOC 2 Type II certification for ChatGPT Enterprise, covering security, availability, and confidentiality controls. This certification is typically required by German vendor-risk and procurement functions but should be reviewed alongside the contractual DPA and transfer terms. Only with significant additional compliance work. HR screening, candidate evaluation, and workforce analytics using ChatGPT Enterprise are classified as \*\*high-risk\*\* under EU AI Act Annex III, No. 4, triggering full AI Act compliance obligations — risk management systems, human oversight, logging, and a conformity assessment. Additionally, any HR-related AI deployment at a company with a works council requires specific Betriebsvereinbarung provisions addressing data use, automated decision support, and employee rights. As a deployer, your main EU AI Act obligations are: (1) AI literacy training for employees using the tool (Article 4, in force from 2 February 2025); (2) avoiding prohibited AI practices; (3) identifying and separately managing any high-risk use cases such as HR, credit scoring, or legal decision support; and (4) implementing transparency disclosures for customer-facing AI interactions from 2 August 2026 under Article 50 AI Act. OpenAI handles its separate obligations as the GPAI model provider. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "ChatGPT Enterprise GDPR & DPA: Compliance Guide for German Companies 2026", "description": "Is ChatGPT Enterprise GDPR compliant? OpenAI DPA, EU data residency, SOC 2, AI Act obligations, and works council requirements for German companies.", "image": "https://compound.law/assets/images/tools/tools_4.webp", "datePublished": "2026-04-18T00:00:00.000Z", "dateModified": "2026-04-18T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/chatgpt-enterprise/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "ChatGPT Enterprise GDPR & DPA: Compliance Guide for German Companies 2026", "item": "https://compound.law/en-DE/tools/chatgpt-enterprise/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does ChatGPT Enterprise have a DPA?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. OpenAI provides a Data Processing Agreement for ChatGPT Enterprise customers that covers Article 28 GDPR requirements, including subprocessors, Standard Contractual Clauses for US transfers, deletion procedures, and security commitments. The DPA must be formally executed — it does not apply automatically through the enterprise license." } }, { "@type": "Question", "name": "Does OpenAI offer EU data residency for ChatGPT Enterprise?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. OpenAI offers an EU data residency option for ChatGPT Enterprise that keeps conversation data within the EU, primarily in Ireland. This option is not enabled by default and must be activated in the admin console. It significantly reduces — but does not entirely eliminate — international transfer risk due to the US CLOUD Act." } }, { "@type": "Question", "name": "Is ChatGPT Enterprise SOC 2 certified?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. OpenAI maintains an active SOC 2 Type II certification for ChatGPT Enterprise, covering security, availability, and confidentiality controls. This certification is typically required by German vendor-risk and procurement functions but should be reviewed alongside the contractual DPA and transfer terms." } }, { "@type": "Question", "name": "Can German companies use ChatGPT Enterprise for HR decisions?", "acceptedAnswer": { "@type": "Answer", "text": "Only with significant additional compliance work. HR screening, candidate evaluation, and workforce analytics using ChatGPT Enterprise are classified as **high-risk** under EU AI Act Annex III, No. 4, triggering full AI Act compliance obligations — risk management systems, human oversight, logging, and a conformity assessment. Additionally, any HR-related AI deployment at a company with a works council requires specific Betriebsvereinbarung provisions addressing data use, automated decision support, and employee rights." } }, { "@type": "Question", "name": "What are ChatGPT Enterprise's AI Act obligations for deployers?", "acceptedAnswer": { "@type": "Answer", "text": "As a deployer, your main EU AI Act obligations are: (1) AI literacy training for employees using the tool (Article 4, in force from 2 February 2025); (2) avoiding prohibited AI practices; (3) identifying and separately managing any high-risk use cases such as HR, credit scoring, or legal decision support; and (4) implementing transparency disclosures for customer-facing AI interactions from 2 August 2026 under Article 50 AI Act. OpenAI handles its separate obligations as the GPAI model provider." } } ] } ] ```