Guide5 min read

Is ChatGPT GDPR compliant? What you can ask OpenAI as a European

The verdict is still out. Your rights aren’t: here’s how to use them, step by step.

Short answer

Nobody has settled that yet. Italy fined OpenAI €15 million in 2024, but a Rome court cancelled the fine in 2026 because Ireland, not Italy, should have handled it; it didn’t judge the rest. What is settled: as a European, you can download and delete your data, stop OpenAI training on new chats, and ask it to fix wrong information about you.

You’ve probably told ChatGPT things you wouldn’t tell most of your colleagues. If you live in Europe, there’s a law that lets you ask what happens to all of it, and make OpenAI do something about it. Almost nobody uses it. Here’s how.

Who’s on the other side

For people in the EU, the EEA and Switzerland, your data is handled by OpenAI Ireland Limited in Dublin. Its main regulator is the Irish Data Protection Commission, but you can also go to the regulator in your own country (OpenAI privacy policy). Good to know: OpenAI processes your data on servers outside Europe, under the EU’s rules for data transfers (same policy).

So, is it GDPR compliant?

Nobody with the power to decide has given a final answer. Here’s the scoreboard so far:

  • March 2023: Italy’s regulator temporarily blocked ChatGPT. It came back a month later, after OpenAI added a form to object to the use of your data and a way to delete wrong information (Garante).
  • May 2024: Europe’s privacy regulators said in a first report that “technical impossibility cannot be invoked to justify non-compliance”: if ChatGPT says wrong things about people, the accuracy rules still apply (EDPB).
  • December 2024: Italy fined OpenAI €15 million, among other things for training ChatGPT without a proper legal basis and for not checking users’ ages (Garante).
  • March 2026: a court in Rome cancelled that fine. Not because OpenAI did nothing wrong: the court said Ireland, not Italy, should have handled the case, and didn’t look at the rest (Diritto.it).
  • Still open: two complaints by the privacy group noyb about ChatGPT making things up about real people. In one, it described a Norwegian man as a convicted child murderer, which he isn’t (noyb). Both are now with the Irish regulator.

The good news: you don’t have to wait for a verdict. Your rights work today.

Asking something personal? Melo, Kamelo’s free private chat, answers on your own computer, so your question isn’t sent anywhere. How it works

Five things you can ask for today

  1. See everything it has. In ChatGPT: Settings → Data controls → Export data. You get an email with a download. It can take up to 7 days, and the link works for 24 hours (OpenAI).
  2. Stop the training. Turn off Improve the model for everyone under Settings → Data controls, or choose Do not train on my content at privacy.openai.com. It works for new chats. Watch out: a thumbs up or down can still send that whole chat to training (OpenAI).
  3. Delete it. Deleted data is removed from OpenAI’s systems within 30 days, unless it has to be kept longer (OpenAI). Leaving for good? Settings → Account → Delete account. Paid through Apple? Cancel that subscription separately (OpenAI).
  4. Fix what it says about you. If ChatGPT gets facts about you wrong, ask for a correction or removal at privacy.openai.com, also without an account. You’ll need to prove who you are, and OpenAI weighs it against freedom of expression, so it isn’t automatic (OpenAI).
  5. Anything else. Email dsar@openai.com. Under the GDPR, OpenAI has to answer within one month, or explain why it needs up to two more (GDPR, article 12). No answer? Complain to your national regulator, like the Autoriteit Persoonsgegevens in the Netherlands.

What the GDPR can’t do for you

  • It works after the fact. Everything above is about data OpenAI already has. What you type is still sent to OpenAI first.
  • A court can overrule deletion. In 2025, a US court made OpenAI keep chats it would have deleted, for months (how that worked).
  • “Data in Europe” isn’t for you. OpenAI offers storage in Europe, but for business plans like Enterprise and Edu, not for regular accounts (OpenAI).

Where Kamelo helps

Your rights clean up afterwards. Kamelo helps before you send. When you type something personal on ChatGPT, Claude or Gemini, it suggests a temporary chat, which stays out of your history and training, or Melo, which answers on your own computer in Chrome, so there’s nothing to export, correct or delete later. Kamelo doesn’t change your message and can’t hide who you are to your AI account.