OpenAI: DPA, subprocessors and data location
Where to find the OpenAI DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: llm api. The table is the short version; the sections below add detail.
OpenAI at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | Not stated in the source we checked (2026-10-16). Details on subprocessors |
| Objection window and remedy | Window: 30 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on OpenAI
The OpenAI entity you contract with depends on where you are: OpenAI Ireland Ltd. for customers in the EEA or Switzerland, OpenAI OpCo, LLC otherwise. The DPA supplements the Services Agreement, and you agree to it by clicking "I agree", accepting the Order Form or using the Services.
The DPA states no advance-notice period in days. OpenAI announces subprocessor changes by blog post, in-product notice or other reasonable means, and emails you only if you subscribe on the list site. You have 30 days from receiving notice to object (section 2.9).
Data residency is a per-project setting for eligible customers, not a default. Regional processing is listed for the US, Europe and the UAE; the other regions (Australia, Canada, Japan, India, Singapore, South Korea, United Kingdom) are regional storage only. It does not apply to system data such as account data, metadata and usage data. The SCCs in the DPA are governed by the laws of England and Wales, and the DPA does not name the DPF.
OpenAI DPA: where to find it and how it is accepted
Read the DPA on openai.com. Supplements and is incorporated into the OpenAI Services Agreement; you agree by clicking "I agree", accepting the Order Form or using the Services (preamble). Updated December 1, 2025, effective January 1, 2026..
Source: openai.com, checked 2026-10-16Not stated in the source we checked (2026-10-16).
The DPA applies to the Services under the OpenAI Services Agreement and states no list of plans. The subprocessor list names API, ChatGPT Enterprise, Edu and Business. We did not verify whether other plans fall under it.
Source: openai.com, checked 2026-10-16OpenAI subprocessors: the list and how change notices reach you
OpenAI's subprocessor list (16 entries on the check date).
Source: openai.com, checked 2026-10-1616 rows in the third-party table (Cloudflare appears twice, so 15 distinct companies). 5 OpenAI affiliates are listed separately and not counted.
Source: openai.com, checked 2026-10-16How changes are announced: Blog post, in-product notice or other reasonable means; email if you subscribe to notifications on the sub-processor list site (DPA section 2.9).
Source: openai.com, checked 2026-10-16Not stated in the source we checked (2026-10-16).
Section 2.9: OpenAI notifies of changes by blog post, in-product notice or other reasonable means, or by email if you subscribe on the sub-processor list site. No advance-notice period in days is stated.
Source: openai.com, checked 2026-10-16You can object within 30 days. OpenAI works with you on alternatives. If none is feasible, or the objection is unresolved 30 days after OpenAI receives it, either party may terminate the affected Services, and prepaid fees for the period after termination are refunded (section 2.9).
Section 2.9: object within 30 days of receiving notice, by following the instructions on the list or emailing privacy@openai.com.
Source: openai.com, checked 2026-10-16Source: openai.com, checked 2026-10-16Where OpenAI stores data
- United States
- Europe (EEA + Switzerland)
- Australia
- Canada
- Japan
- India
- Singapore
- South Korea
- United Kingdom
- United Arab Emirates
You can choose the region.
Data residency is a per-project setting for eligible customers; contact sales to check eligibility. Customer content is stored at rest in the chosen region. The support-by-region table shows regional storage and regional processing for the United States, Europe (EEA + Switzerland) and the United Arab Emirates (processing only for some endpoints and models). Australia, Canada, Japan, India, Singapore, South Korea and the United Kingdom are listed with regional storage only (Processing: No); the docs say that if a region does not support regional processing, OpenAI may also process and temporarily store Customer Content outside the region. Non-US regions require approval for abuse monitoring controls and a Modified Retention amendment; the table also marks Europe as requiring Zero Data Retention, Modified Abuse Monitoring, Private Retention with PSP or Safety Retention, and the UAE needs additional approval. Data residency does not apply to system data (account data, metadata, usage data). The DPA itself states no location.
Source: developers.openai.com, checked 2026-10-17How OpenAI moves data outside the EU and UK
- SCCs (Modules 2 and 3)
- UK Addendum
- EU adequacy decision where available
Sections 4.1 and 4.2 and Schedule 1. SCCs are governed by the laws of England and Wales with the ICO as supervisory authority. The DPA does not name the EU-U.S. Data Privacy Framework.
Source: openai.com, checked 2026-10-16Not stated in the source we checked (2026-10-17).
A search of the Data Privacy Framework participant list on 2026-10-17 returned no organisation under this name. That can also mean a different legal name, so we record no value; check the list yourself. The DPA does not mention the DPF either.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is OpenAI a processor or a controller?
Processor: it handles your customers' data on your instructions.
Section 1.1: OpenAI acts as a data processor on your behalf. Contracting entity is OpenAI OpCo, LLC, or OpenAI Ireland Ltd. if you are based in the EEA or Switzerland.
Source: openai.com, checked 2026-10-16Is OpenAI GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what OpenAI's own documents say:
- A DPA is published: Supplements and is incorporated into the OpenAI Services Agreement; you agree by clicking "I agree", accepting the Order Form or using the Services (preamble). Updated December 1, 2025, effective January 1, 2026.
- A subprocessor list is published.
- Transfer mechanisms named: SCCs (Modules 2 and 3), UK Addendum, EU adequacy decision where available.
- Data locations named: United States, Europe (EEA + Switzerland), Australia, Canada, Japan, India, Singapore, South Korea, United Kingdom, United Arab Emirates.
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add OpenAI to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use OpenAI, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| OpenAI | LLM API | United States; Europe (EEA + Switzerland); Australia; Canada; Japan; India; Singapore; South Korea; United Kingdom; United Arab Emirates | SCCs (Modules 2 and 3); UK Addendum; EU adequacy decision where available | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| OpenAI | LLM API | United States; Europe (EEA + Switzerland); Australia; Canada; Japan; India; Singapore; South Korea; United Kingdom; United Arab Emirates | SCCs (Modules 2 and 3); UK Addendum; EU adequacy decision where available | [DPA](https://openai.com/policies/data-processing-addendum/) | [Subprocessors](https://openai.com/policies/sub-processor-list/) |
If you add or replace OpenAI: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
In the source we checked, OpenAI doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked every row of the data residency table (storage vs processing). Corrected: only the US, Europe and the UAE have regional processing; Australia, Canada, Japan, India, Singapore, South Korea and the UK are storage only. Added the Europe and UAE approval conditions.
- Searched the Data Privacy Framework list for "OpenAI" (active and inactive): no organisation found. dpf_listed set to false.
- First check: facts recorded from OpenAI's own DPA (effective January 1, 2026), sub-processor list (October 14, 2026) and data residency docs.
Related vendors
Sources and method
- https://openai.com/policies/data-processing-addendum/ checked 2026-10-16
- https://openai.com/policies/sub-processor-list/ checked 2026-10-16
- https://developers.openai.com/api/docs/guides/your-data checked 2026-10-17
- https://www.dataprivacyframework.gov/list checked 2026-10-17
Facts come from OpenAI's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: openai.com.