When an employee pastes a contract into ChatGPT, or an AI agent answers your customers on WhatsApp, that data travels to a server. More and more companies (and their customers) are asking: where is that server, who keeps the data, and what for?
The short answer
- You can use AI and comply with the GDPR, but not with just any setup. Free and personal chat accounts aren’t designed for company data.
- The major providers offer processing in Europe, but rarely by default: you have to choose it, sometimes get approval, and pay a little more.
- Three questions matter: where the data is processed, how long it’s kept, and whether it’s used to train models.
- “Processed in Europe” isn’t the same as “a European provider”. A US provider with EU servers is still subject to US law.
Why it matters where data is processed
- The GDPR regulates international transfers. Sending personal data outside the European Economic Area needs a legal basis: today, usually the EU-US Data Privacy Framework or standard contractual clauses.
- That framework is under appeal. The Data Privacy Framework is in force, but a case is pending before the EU Court of Justice (C-703/25 P). Its two predecessors (Safe Harbor and Privacy Shield) were struck down by the same court. Processing in Europe reduces your reliance on it.
- Your customers ask. Tenders, supplier questionnaires and clients in health, legal or finance increasingly want to know where AI processes their data.
- It’s part of using AI responsibly. Article 4 of the EU AI Act requires you to train your team, and a good usage policy starts with knowing which tool processes which data.
Three questions to ask any AI provider
- Where is the data processed? Where the model runs (the “inference”), not just where files are stored. They’re separate guarantees.
- How long is it kept? Many providers keep requests for around 30 days to monitor abuse. Some offer zero data retention (nothing kept once the response is sent), usually subject to approval.
- Is it used to train models? On APIs and business plans, the major providers don’t train on your data by default. On free and personal chat accounts, they often do unless you switch it off.
Provider by provider (October 2026)
| Provider | Processes in the EU? | How | Watch out for |
|---|---|---|---|
| OpenAI (API) | Yes, with approval | A project with Europe data residency, once OpenAI approves it | Requires approved retention controls. 10% surcharge on the newest models. No training on API data by default |
| OpenAI on Microsoft Azure | Yes | Deployments in the EU “data zone” | Global deployments may process outside the EU at peak times |
| Anthropic (Claude’s own API) | No | US-only or “global” processing | For EU processing, use Claude through AWS or Google Cloud |
| Claude on AWS Bedrock or Google Cloud | Yes | Each cloud’s European regions | The region is set by the endpoint you choose. Check which models each region offers |
| Google Gemini on Vertex AI | Yes | EU multi-region, or regions such as Frankfurt, Paris or the Netherlands | Google guarantees the processing location only in the regions it lists. The free Gemini API is a different product |
| Mistral (France) | Yes, by default | Its platform is hosted in the EU | A European provider. Check in its contract whether it uses data to improve its models and how to opt out |
| Open models on your own server | Yes | Your own European server or a European host | Full control, but more technical overhead and often less capability than frontier models |
These offerings change every few months. Before you decide, confirm the current terms in each provider’s documentation and contract.
Consumer chat apps aren’t the API
This is the most common mix-up. ChatGPT, Claude or Gemini on a free or personal plan are consumer products: they may train on your conversations unless you opt out, and they don’t come with a data processing agreement. Business plans and APIs work under different terms: a data processing agreement, no training by default and, in some cases, processing in Europe.
If your team uses personal accounts for work, that’s the first risk to close.
“In Europe” comes with fine print
- Processing and storage are different things. A provider may store your files in Europe and process them elsewhere, or the other way round. Ask about both.
- System data is usually excluded. Billing, technical logs and some schemas aren’t always covered by residency.
- Not every feature is covered. Some tools from the same provider (agents, file storage, tracing) may lack European residency even when the model has it.
- US law still applies. A US company with EU servers can receive demands from its government (the CLOUD Act). For highly sensitive data, a European provider or a model on your own server reduces that risk.
How we set it up in our projects
We work with clients in Europe and beyond. For European clients, this is our default setup when we build an AI agent or platform:
- Processing in Europe for every model the system uses: the agent, document reading, voice note transcription and summaries.
- Zero data retention and no training. Providers don’t keep the requests or train on them.
- A backup model from another provider, also in Europe. If the main model fails, the system switches automatically to a second model from a different company, without leaving the EU. One provider’s outage doesn’t stop the service.
- The most sensitive data kept out of the AI’s reach. For example, an ID document number: the agent can save it but can’t read it back, so it can’t leak it even if someone tries to manipulate it.
- Credentials never leave your network. When AI queries your systems, it goes through a read-only gateway, as in this project for a group of companies.
- Separate keys for testing and production, with spending limits.
For clients outside the EU, who aren’t bound by the GDPR, we choose the models and regions that best fit their own laws, use case and budget, without limiting ourselves to European ones.
GDPR checklist for using AI in your company
- Inventory of the AI tools your team uses, including personal accounts
- Business accounts or APIs only, with a signed data processing agreement (DPA)
- EU processing configured wherever personal data is involved
- Minimal or zero retention, and training switched off
- A basis for international transfers, if any (Data Privacy Framework or standard clauses)
- Records of processing activities updated with your AI uses
- A data protection impact assessment (DPIA) if AI handles sensitive data or makes decisions about people
- Users told when they’re talking to an AI
- An internal AI usage policy and team training
Frequently asked questions
Is ChatGPT GDPR compliant? It depends on the version and how it’s used. The free or personal version isn’t suitable for your company’s personal data. ChatGPT Enterprise or the OpenAI API, with a data processing agreement and, if needed, European data residency, can be used in a GDPR-compliant way.
Is a European provider like Mistral safer? It reduces exposure to non-EU laws and simplifies international transfers. You still need to check the contract, retention and use of data for training. And for some tasks the most capable models still come from US providers, which offer processing in Europe.
Can I use AI with health data or children’s data? With great care: they’re special categories of data. You need a clear legal basis, an impact assessment and, ideally, EU processing with zero retention or a model on your own server.
Does processing in Europe cost more? Sometimes, a little. Some providers add around 10% on their newest models. For most small business projects, the difference is a few euros a month.
What’s the best option for my company? It depends on what data the AI handles and why. For drafting internal emails, a well-configured business account is usually enough. For an agent handling customer data, go for EU processing, zero retention and a backup from another provider.
Want to use AI without worrying about your data?
We help you choose the right models and setup for each case, and we build custom agents and platforms with data in Europe from day one when you need it. Book a free call.
This guide is for information only and isn’t legal advice. Provider terms change often. Last reviewed: 14 October 2026.
