Using OpenAI Models in GDPR-Compliant Way?
Frequently asked questions about using OpenAI models in MeinGPT in compliance with data protection via Azure OpenAI Service and OpenAI with EU data residency
This FAQ explains how we at MeinGPT use OpenAI models in full compliance with GDPR and European data protection standards.
Azure OpenAI Service Instead of Standard OpenAI
Why Azure OpenAI Service is the GDPR-Safe Way
Fundamental difference from normal OpenAI API:
Tip
Microsoft contractual framework instead of OpenAI Inc. Most OpenAI models in MeinGPT run through Azure OpenAI Service, an independent Microsoft service with no contractual relationship to OpenAI Inc. For these models, your data does not leave the Microsoft contractual framework. A few models are operated instead by OpenAI Ireland Ltd. with EU data residency, as a separate sub-processor.
The most important guarantees for models served through Azure OpenAI Service (Microsoft Documentation):
- ❌ NOT available to OpenAI Inc.
- ❌ NOT used for OpenAI model training
- ❌ NOT available to other customers
- ✅ Exclusively hosted in Microsoft Azure environment
🇪🇺 EU-DataZone: Guaranteed Data Residency
How do Azure OpenAI DataZones work?
New since November 2024: Azure OpenAI DataZones for the EU
Note
EU-DataZone Guarantee: With EU-DataZone deployments, your data is processed exclusively within EU member states - never in third countries.
Deployment options and our choice:
- 🌍 Global - Worldwide processing (❌ not GDPR-safe)
- 🇪🇺 EU-DataZone - EU-only processing (✅ our choice for EU-hosted models)
- 🏢 Regional - Single region (✅ strictest option)
Why We Chose EU-DataZone
- 🚀 Better performance than Regional
- 🔒 EU data residency guaranteed
- 💰 More cost-effective than Regional-only
- 📈 Higher availability of latest models
🛡️ Technical GDPR Compliance
How do we technically protect your data?
Zero-Trust Architecture (Microsoft Trust Center):
- 🔐 TLS 1.2+ encryption in transit
- 🏭 Logically isolated GPU processing
- 🚫 Zero Data Retention (no permanent copy of your inputs at the provider)
- 🔑 AES-256 + Customer Managed Keys
Legal Safeguards:
- ✅ EU-US Data Privacy Framework certified
- ✅ Standard Contractual Clauses (SCCs)
- ✅ Microsoft GDPR-Commitments (Details here)
Attention
Important: Standard OpenAI API offers none of these guarantees - data can be processed globally and used for training.
⚖️ Legal Bases and Data Subject Rights
GDPR Legal Bases (Art. 6 GDPR)
- Art. 6(1)(b) - Contract performance (AI services)
- Art. 6(1)(f) - Legitimate interests (security)
- Art. 6(1)(a) - Consent (advanced features)
Your Rights
Data Subject Rights:
- 📋 Access (Art. 15) - Direct requests to your company as the controller; MeinGPT supports it in doing so under the data processing agreement
- 🗑️ Deletion (Art. 17) - Complete removal within 30 days
- 📤 Data Portability (Art. 20) - Individual content (e.g. artifacts, slides, generated files and images) can be downloaded one item at a time, and single replies can be copied. There is currently no function to export all your chats or all generated files at once.
🔍 Trust Through Transparency
How can you verify our compliance?
As the controller, your company can satisfy itself of the technical and organisational measures. As a rule, this is done through the current ISO/IEC 27001:2022 certificate together with the statement of applicability, supplemented by information, documentation and an audit questionnaire; MeinGPT provides these documents on request.
Public Evidence:
Tip
Bottom line: EU-hosted OpenAI models in MeinGPT run with data processing in the EU and without a permanent copy of your inputs at the provider (zero data retention). Which provider is behind a model depends on the model you choose; the providers used are listed in the sub-processor list of your DPA.
📞 Further Information
For questions about GDPR compliance:
- 📧 Data Protection Officer: datenschutz@heydata.eu
- 🏢 heyData GmbH - Your external DPO with 20+ years experience
Technical Details: