--- title: "OpenAI API DPA: Yes — No Training by Default, EU Residency via Azure" description: "Yes — the OpenAI API has a DPA, and API inputs are not used for training by default. EU data residency: none — standard API traffic runs on US infrastructure." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/openai-api/" language: "en" --- ![OpenAI API GDPR compliance and data processing agreement for German businesses](https://compound.law/assets/images/tools/tools_2.webp) tools # OpenAI API DPA: Yes — No Training by Default, EU Residency via Azure 6 April 2026 **Yes — the OpenAI API has a Data Processing Agreement (DPA), and signing it is mandatory: German businesses must accept it as their Article 28 DSGVO Auftragsverarbeitungsvertrag before processing personal data through OpenAI endpoints.** Two facts decide the compliance outcome: API inputs and outputs are **not used for model training by default**, but **there is no EU data residency option** — standard API traffic is processed on US-based infrastructure, relying on Standard Contractual Clauses for the EU-US transfer. If your use case requires EU-only processing, evaluate the Azure OpenAI Service or ChatGPT Enterprise instead; otherwise the signed DPA plus documented SCC reliance is the standard, defensible setup. ## Does OpenAI Have a Data Processing Agreement for the API? Yes. OpenAI provides a **Data Processing Addendum (DPA)** for API customers, available directly through your OpenAI account settings or through an enterprise agreement with OpenAI sales. The DPA covers all API services and governs OpenAI’s role as a **data processor** on your behalf. Key terms of the OpenAI API DPA: - **Processor designation:** OpenAI acts as your data processor. You act as the data controller and are responsible for determining lawful bases and informing data subjects. - **No training on API data:** API inputs and outputs are not used to train OpenAI models by default. This is a key distinction from the consumer ChatGPT product, where data may be used for training unless users opt out. - **Standard Contractual Clauses:** The DPA incorporates EU SCCs (Commission Implementing Decision 2021/914) for transfers of personal data from the EU/EEA to OpenAI’s US infrastructure. - **Sub-processor list:** OpenAI publishes and maintains a list of sub-processors, including Microsoft Azure (the primary cloud infrastructure provider). Customers receive notice of sub-processor changes. - **Data retention:** API data is retained for a limited period for abuse monitoring and then deleted. Zero Data Retention (ZDR) options are available for some models through enterprise agreements — under ZDR, inputs and outputs are not stored after the API response is returned. The DPA must be in place **before** you process any personal data via the API. Processing EU personal data without an Article 28 DSGVO-compliant data processing agreement is a violation that supervisory authorities can fine. ## OpenAI API AVV for Germany (Auftragsverarbeitungsvertrag) Under German and EU data protection law, any company that instructs a service provider to process personal data on its behalf must enter an **Auftragsverarbeitungsvertrag (AVV)** — the German term for a data processing agreement under Article 28 GDPR. The OpenAI DPA functions as the AVV for German businesses using the API. Steps to establish a compliant AVV: 1. **Accept the OpenAI Data Processing Addendum** through your OpenAI account settings under Usage Policies → Data Controls, or negotiate a signed DPA for enterprise API contracts. 2. **Confirm SCCs are included:** The DPA must incorporate EU Standard Contractual Clauses (Controller-to-Processor, Module 2) for the EU-US data transfer. Verify the version matches the current Commission Decision. 3. **Update your processing register:** Add OpenAI as a processor in your **Verzeichnis von Verarbeitungstätigkeiten** (Article 30 DSGVO) for each API-based processing activity. 4. **Review sub-processors:** OpenAI’s primary sub-processor is Microsoft Azure. Review the full sub-processor list on OpenAI’s website and assess whether any sub-processor raises additional risk concerns. 5. **Update privacy notices:** Your employee and customer-facing privacy notices must disclose that personal data may be processed by OpenAI as a processor, including the international transfer to the US. ## Data Residency: Where Does OpenAI Process Your API Data? Standard OpenAI API requests are processed on **Microsoft Azure infrastructure in the United States**. There is no EU-region option for the standard OpenAI API. This creates a mandatory EU-US data transfer subject to Chapter V GDPR obligations (covered by the SCCs in the OpenAI DPA). Organizations with strict data residency requirements have two alternatives: **Azure OpenAI Service:** Microsoft offers OpenAI models (GPT-4, GPT-3.5, etc.) through Azure, with the ability to select EU data center regions (e.g., Sweden Central, West Europe). Data processed through Azure OpenAI in a European region does not leave the EU. The DPA is then with Microsoft (Azure’s Data Processing Agreement), not OpenAI. This is the preferred option for organizations in regulated sectors — banking, insurance, healthcare — that require EU data localization. **ChatGPT Enterprise:** OpenAI’s enterprise product includes a DPA with enhanced terms, an option for EU data processing, and additional controls. ChatGPT Enterprise is primarily a chat interface, not an API — but it can be relevant for business use cases that do not require direct API integration. For most German startups and SMEs using the standard API, the SCCs in the OpenAI DPA provide the required EU-US transfer mechanism. Documented reliance on the SCCs, combined with a Transfer Impact Assessment (TIA) where required, is the standard approach. ## OpenAI API vs. ChatGPT Enterprise — Compliance Differences | Feature | OpenAI API | ChatGPT Enterprise | | ------------------------------ | ----------------- | -------------------- | | DPA / AVV available | Yes (API DPA) | Yes (Enterprise DPA) | | Data used for training | No (default) | No | | EU data processing option | No (Azure US) | Yes (via enterprise) | | Zero Data Retention option | Yes (enterprise) | Yes | | Sub-processor SCCs | Yes | Yes | | SAML SSO / Access controls | No | Yes | | Suitable for regulated sectors | With Azure OpenAI | Better fit | If your use case involves processing sensitive personal data — health records, financial data, HR records — and EU data localization is a hard requirement, **Azure OpenAI Service** (not the standard OpenAI API) is the more defensible choice under German data protection law. ## Using OpenAI API in Germany: EU AI Act Implications The OpenAI API provides access to **General-Purpose AI (GPAI) models** — primarily GPT-4o, GPT-4, and GPT-3.5. Under the EU AI Act (Regulation (EU) 2024/1689), GPAI models placed on the EU market are subject to transparency and documentation requirements. OpenAI, as the GPAI model provider, bears these obligations — not the API customer directly. However, as a **deployer** of the API, German businesses must: - **Classify the risk level** of their specific application. An internal FAQ chatbot is limited risk; an automated decision system affecting employees or customers may be high risk. - **Implement human oversight** where outputs of the AI system influence significant decisions. - **Disclose AI interaction** to users when they interact directly with an AI-generated interface (Article 52 EU AI Act). - **Document use cases** that fall within the high-risk categories listed in Annex III of the AI Act, which include systems used in employment, education, essential services, and law enforcement. Most API-based productivity tools, code assistants, content generation, and search applications fall under **limited or minimal risk** under the AI Act. More complex use cases — automated CV screening, AI-assisted credit scoring, predictive HR analytics — require a full conformity assessment and registration before deployment. ## Checklist for GDPR-Compliant OpenAI API Integration - [ ] **DPA/AVV accepted:** OpenAI Data Processing Addendum accepted via account settings or signed enterprise agreement - [ ] **SCCs confirmed:** EU Standard Contractual Clauses (Module 2) incorporated in DPA for US data transfers - [ ] **Sub-processor list reviewed:** OpenAI’s sub-processor list reviewed; Microsoft Azure noted as primary processor - [ ] **Processing register updated:** OpenAI API added to Art. 30 DSGVO register for each relevant processing activity - [ ] **Legal basis documented:** Art. 6(1) lawful basis identified for each API use case (b — contract, f — legitimate interest, a — consent where required) - [ ] **Privacy notices updated:** Customer- and employee-facing notices disclose API-based processing and US data transfer - [ ] **Zero Data Retention assessed:** Evaluated whether ZDR is needed for sensitive use cases; enterprise agreement in place if required - [ ] **Azure OpenAI evaluated:** If EU data residency required, Azure OpenAI Service assessed as an alternative - [ ] **AI Act classification done:** Use case risk level assessed under EU AI Act Annex III categories - [ ] **DPIA conducted:** If processing is high risk under Art. 35 DSGVO (large-scale, special category, or automated decision-making) - [ ] **Works council consulted:** Betriebsrat notified if the API tool affects employee work processes under §87 BetrVG - [ ] **Prompt security review done:** API prompts reviewed to ensure personal data minimization — do not include unnecessary personal data in prompts Compound Law advises German businesses on OpenAI API deployments: DPA review, Transfer Impact Assessments, DPIA preparation, and AI Act compliance. See our [compliance services](https://compound.law/en-DE/compliance/) for details. For related guidance, see our guides on [OpenAI Whisper GDPR compliance](https://compound.law/en-DE/tools/whisper/) and the [AI Act compliance hub](https://compound.law/en-DE/compliance/). *** ## Frequently Asked Questions ### Does OpenAI have a Data Processing Agreement (DPA) for the API? Yes. OpenAI provides a Data Processing Addendum for API customers, available through your OpenAI account settings. The DPA designates OpenAI as a data processor, incorporates EU Standard Contractual Clauses for EU-US data transfers, and confirms that API data is not used for model training. For German businesses, this DPA functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO. It must be accepted before any personal data is processed via the API. ### Is the OpenAI API GDPR compliant? The OpenAI API can be used in a GDPR-compliant manner, but compliance depends on how you configure and use it. You must have a signed DPA with OpenAI, document a lawful basis for processing, update your privacy notices to disclose the API use and US data transfer, and add OpenAI to your Article 30 processing register. OpenAI itself does not certify GDPR compliance — your organization’s implementation determines whether use is lawful under the DSGVO. ### What is the OpenAI API AVV in Germany? The OpenAI Data Processing Addendum functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO for German businesses using the API. It sets out the subject matter, duration, nature, and purpose of the processing, the type of personal data involved, and the categories of data subjects, as required by Art. 28(3) DSGVO. You can accept it through your OpenAI account portal or negotiate a custom signed version for enterprise contracts. ### Does OpenAI process API data in the EU? Standard OpenAI API requests are processed on Microsoft Azure infrastructure in the United States, not in the EU. The OpenAI DPA includes Standard Contractual Clauses to cover this EU-US transfer. If EU data residency is a hard requirement for your organization, consider Azure OpenAI Service, which allows you to select European Azure regions (e.g., Sweden Central) and process data entirely within the EU under a Microsoft DPA. ### Do I need a works council agreement to use the OpenAI API? If you deploy the OpenAI API in a way that affects how employees work — for example, an AI writing assistant, code assistant, or internal search tool — the Betriebsrat may have co-determination rights under §87(1) No. 6 BetrVG. Any technical system that monitors employee behavior or performance, or significantly changes work processes, requires prior works council involvement. Consult your Betriebsrat before rolling out API-based tools to employees, and consider concluding a Betriebsvereinbarung governing acceptable use, data access, and monitoring limitations. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. OpenAI provides a Data Processing Addendum for API customers, available through your OpenAI account settings. The DPA designates OpenAI as a data processor, incorporates EU Standard Contractual Clauses for EU-US data transfers, and confirms that API data is not used for model training. For German businesses, this DPA functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO. It must be accepted before any personal data is processed via the API. The OpenAI API can be used in a GDPR-compliant manner, but compliance depends on how you configure and use it. You must have a signed DPA with OpenAI, document a lawful basis for processing, update your privacy notices to disclose the API use and US data transfer, and add OpenAI to your Article 30 processing register. OpenAI itself does not certify GDPR compliance — your organization's implementation determines whether use is lawful under the DSGVO. The OpenAI Data Processing Addendum functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO for German businesses using the API. It sets out the subject matter, duration, nature, and purpose of the processing, the type of personal data involved, and the categories of data subjects, as required by Art. 28(3) DSGVO. You can accept it through your OpenAI account portal or negotiate a custom signed version for enterprise contracts. Standard OpenAI API requests are processed on Microsoft Azure infrastructure in the United States, not in the EU. The OpenAI DPA includes Standard Contractual Clauses to cover this EU-US transfer. If EU data residency is a hard requirement for your organization, consider Azure OpenAI Service, which allows you to select European Azure regions (e.g., Sweden Central) and process data entirely within the EU under a Microsoft DPA. If you deploy the OpenAI API in a way that affects how employees work — for example, an AI writing assistant, code assistant, or internal search tool — the Betriebsrat may have co-determination rights under §87(1) No. 6 BetrVG. Any technical system that monitors employee behavior or performance, or significantly changes work processes, requires prior works council involvement. Consult your Betriebsrat before rolling out API-based tools to employees, and consider concluding a Betriebsvereinbarung governing acceptable use, data access, and monitoring limitations. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "OpenAI API DPA: Yes — No Training by Default, EU Residency via Azure", "description": "Yes — the OpenAI API has a DPA, and API inputs are not used for training by default. EU data residency: none — standard API traffic runs on US infrastructure.", "image": "https://compound.law/assets/images/tools/tools_2.webp", "datePublished": "2026-04-06T00:00:00.000Z", "dateModified": "2026-04-06T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/openai-api/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "OpenAI API DPA: Yes — No Training by Default, EU Residency via Azure", "item": "https://compound.law/en-DE/tools/openai-api/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does OpenAI have a Data Processing Agreement (DPA) for the API?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. OpenAI provides a Data Processing Addendum for API customers, available through your OpenAI account settings. The DPA designates OpenAI as a data processor, incorporates EU Standard Contractual Clauses for EU-US data transfers, and confirms that API data is not used for model training. For German businesses, this DPA functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO. It must be accepted before any personal data is processed via the API." } }, { "@type": "Question", "name": "Is the OpenAI API GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "The OpenAI API can be used in a GDPR-compliant manner, but compliance depends on how you configure and use it. You must have a signed DPA with OpenAI, document a lawful basis for processing, update your privacy notices to disclose the API use and US data transfer, and add OpenAI to your Article 30 processing register. OpenAI itself does not certify GDPR compliance — your organization's implementation determines whether use is lawful under the DSGVO." } }, { "@type": "Question", "name": "What is the OpenAI API AVV in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "The OpenAI Data Processing Addendum functions as the Auftragsverarbeitungsvertrag (AVV) required under Article 28 DSGVO for German businesses using the API. It sets out the subject matter, duration, nature, and purpose of the processing, the type of personal data involved, and the categories of data subjects, as required by Art. 28(3) DSGVO. You can accept it through your OpenAI account portal or negotiate a custom signed version for enterprise contracts." } }, { "@type": "Question", "name": "Does OpenAI process API data in the EU?", "acceptedAnswer": { "@type": "Answer", "text": "Standard OpenAI API requests are processed on Microsoft Azure infrastructure in the United States, not in the EU. The OpenAI DPA includes Standard Contractual Clauses to cover this EU-US transfer. If EU data residency is a hard requirement for your organization, consider Azure OpenAI Service, which allows you to select European Azure regions (e.g., Sweden Central) and process data entirely within the EU under a Microsoft DPA." } }, { "@type": "Question", "name": "Do I need a works council agreement to use the OpenAI API?", "acceptedAnswer": { "@type": "Answer", "text": "If you deploy the OpenAI API in a way that affects how employees work — for example, an AI writing assistant, code assistant, or internal search tool — the Betriebsrat may have co-determination rights under §87(1) No. 6 BetrVG. Any technical system that monitors employee behavior or performance, or significantly changes work processes, requires prior works council involvement. Consult your Betriebsrat before rolling out API-based tools to employees, and consider concluding a Betriebsvereinbarung governing acceptable use, data access, and monitoring limitations." } } ] } ] ```