Is ChatGPT Safe for Confidential Information? Business, Enterprise and Personal Plans Compared
On ChatGPT Business and Enterprise, OpenAI does not train on your data by default. On Free, Plus and Pro it does, unless each person turns it off. The difference between the two is not the chat window, which looks the same. It is who agreed the terms: your company, or the employee on their own.
Below: what each plan does with your data, how long it is kept, what Business and Enterprise differ on, the setting most companies miss on Business, and four checks to run before putting client work in.
Does ChatGPT train on your data?
| Free, Plus, Pro | Business, Enterprise | |
|---|---|---|
| Used to train models? | Yes by default. Each person can turn it off under Data Controls | No by default, unless your company agrees otherwise |
| Who agreed the terms | The employee, personally | Your company |
| Data processing agreement (DPA) | No | Yes, on request |
| Admin control | None | Yes |
One detail catches people out on the personal plans: giving a thumbs up or down on an answer can let OpenAI use that whole conversation for training, even when training is switched off. Sources: how OpenAI uses your data and OpenAI’s enterprise privacy page. ChatGPT Team was renamed ChatGPT Business in August 2025; the terms carried over.
How long OpenAI keeps your data
On every plan, chats are kept until the person deletes them, and deleted chats are removed within 30 days unless OpenAI has to keep them for security or legal reasons. Enterprise administrators can set their own retention period for the workspace.
In 2025 a US court order in the New York Times case forced OpenAI to keep deleted chats on Free, Plus, Pro and Team. Enterprise was not covered. The order ended on 26 September 2025 and normal deletion resumed, according to OpenAI. The lesson for companies is not about OpenAI in particular: what a vendor promises about deletion can be overridden by a court, and business plans are the ones designed to limit that.
Business or Enterprise
| Business | Enterprise | |
|---|---|---|
| No training on your data | Yes | Yes |
| Single sign-on | Yes | Yes |
| User provisioning from your directory (SCIM) | No | Yes |
| Audit logs through the Compliance API | Not listed | Yes |
| Your own retention period | Not confirmed | Yes |
| Data residency in Europe | Rolling out, not for everyone yet | Yes |
| Control over which apps each role may use | On or off for the whole workspace | Per role |
Business costs $20 per seat a month on an annual plan or $25 monthly for a Standard seat, from two seats, according to OpenAI’s help centre in October 2026. Enterprise has no published price. The full comparison is in ChatGPT Business vs Enterprise.
The setting most companies miss: apps
ChatGPT can connect to Google Drive, SharePoint, the CRM and other tools through apps (once called connectors). On Business, apps are switched on by default, and an admin can only turn each one on or off for the whole workspace. On Enterprise they are off by default and can be allowed per role. See OpenAI’s admin controls for apps.
That is where the confidentiality question has moved. Training is settled on a business plan. What is not settled is which company systems ChatGPT can reach, for whom, and whether anyone can see what it fetched. With Deployed OS the company decides that once: user groups set who may read or change what in each system, every person signs in with their own login and every call is logged, in ChatGPT and Claude alike. More in what an MCP gateway is.
GDPR and data residency
Business and Enterprise come with a data processing agreement, and OpenAI holds SOC 2 Type 2 for them. Storing and processing data in Europe is available on Enterprise and is being rolled out gradually on Business, according to OpenAI. If data must stay in Europe, check what applies to your workspace before you roll out, not after.
Four checks before real work
- Company workspace, not personal accounts. Ask a few people which account they are signed into. Expect at least one personal Plus account used for client work.
- Get the DPA in place. Request it for your Business or Enterprise workspace.
- Review the apps. On Business, switch off every app you have not decided to use. Then decide, per system, who may reach it.
- Write the rule down. One paragraph on what may go into ChatGPT and from which account.
For the same question about other tools, see is Claude safe for confidential information and is Microsoft Copilot safe for confidential information.
Frequently asked questions
Is ChatGPT safe for confidential information?
On ChatGPT Business or Enterprise, yes, with the usual care: OpenAI does not train on your workspace’s data by default, your company has a data processing agreement, and an administrator controls the workspace. On Free, Plus and Pro, content is used for training unless each person turns it off, and the company has no control, so confidential work does not belong there.
Does ChatGPT train on your data?
On Free, Plus and Pro, yes by default; each person can turn it off under Data Controls, but giving feedback on an answer can still let OpenAI use that conversation. On Business, Enterprise and Edu, OpenAI does not train on your data unless your organisation agrees to it.
Does ChatGPT Business train on your data?
No. ChatGPT Business, formerly ChatGPT Team, does not use your workspace’s data for training by default. That is part of the business terms your company agrees to, and it is the main difference from a personal Plus account.
How long does OpenAI keep ChatGPT data?
Chats are kept until they are deleted, and deleted chats are removed within 30 days unless OpenAI must keep them for security or legal reasons. Enterprise administrators can set their own retention period. In 2025 a court order forced OpenAI to keep deleted chats on consumer plans and Team; it ended on 26 September 2025 and did not cover Enterprise.
What is the difference between ChatGPT Business and Enterprise for data security?
Both exclude your data from training and support single sign-on. Enterprise adds SCIM user provisioning, audit logs through the Compliance API, its own retention period, data residency in Europe, and per-role control over which apps each group may use. On Business, apps are on by default and can only be switched on or off for the whole workspace.
Is ChatGPT GDPR compliant?
For business use, OpenAI offers a data processing agreement on Business and Enterprise and holds SOC 2 Type 2 for them. Storing and processing data in Europe is available on Enterprise and is being rolled out gradually on Business. Personal accounts are not suitable for personal data the company is responsible for.
Found this useful? Send it to someone who needs it.