OpenAI on Thursday launched data residency in Europe, allowing European organizations to meet local data sovereignty requirements while using the AI company’s products.
Data residency refers to the physical location of an organization’s data, as well as the local laws and policy requirements imposed on that data. Most tech giants and cloud providers offer European data residency programs, which help customers comply with European local privacy and data protection laws like the GDPR, Germany’s Federal Data Protection Act, and the UK’s data protection legislation.
Beginning Thursday, OpenAI customers using the company’s API can choose to process data in Europe for “eligible endpoints,” and new ChatGPT Enterprise and Edu customers can choose to have customer content stored at rest in Europe. Data “at rest” refers to data that’s not actively moving between networks or being accessed.
OpenAI says that, with European data residency enabled, API requests will be handled in-region by OpenAI with zero data retention, meaning that AI model requests and responses won’t be stored at rest on the company’s servers. When switched on for OpenAI’s AI-powered chat platform, ChatGPT, customer info including conversations with ChatGPT, user prompts, images, uploaded files, and custom bots will be stored at rest in the region, per OpenAI.
OpenAI notes that, as of now, European data residency can only be configured for new projects using the company’s API. Existing projects can’t be updated to have European residency.
European data regulators have targeted OpenAI in the past for what they’ve alleged is potential noncompliance with local data laws. Spain and Germany, among other countries, have initiated probes into OpenAI’s ChatGPT data processing practices, and in December, Italy’s data protection watchdog — which briefly blocked ChatGPT several years ago — fined the company €15 million ($15.6 million) for supposedly violating European consumer data protection requirements. Where data is stored for AI services has been a hot-button issue beyond OpenAI. DeepSeek, the viral AI startup that runs an LLM and chatbot, processes related data out of its home country of China, something that has caught the attention of regulators.
Early last year, a task force of the European Data Protection Board, the European body that ensures consistent application of data protection rules across the EU, released a report to guide member countries’ data protection authorities as they investigate ChatGPT. The report touched on subjects including the lawfulness of collecting training data for ChatGPT, transparency, and data accuracy.
