Turning off training in ChatGPT and Claude: is that enough for GDPR?
A training switch does not decide where files remain, who can access them or why your company may process the data. Here is what to check next.
Syntalith
“We turned off model training, so staff can now upload customer data.” That conclusion skips several decisions. The setting controls a particular use of data by the provider. It does not establish your company's purpose for processing, contractual coverage or who can open an uploaded file.
No training does not mean no processing or storage. Before admitting customer documents, the company still needs to decide what data is necessary, which terms apply and how access and retention work. The obligations depend on the workflow. GDPR, particularly Articles 5, 6 and 28
What the switch actually changes
| Service or setting | What the provider describes | What remains unresolved |
|---|---|---|
| ChatGPT: disable “Improve the model for everyone” | New conversations after opting out are not used for training | Conversations can still remain in history |
| ChatGPT Temporary Chat | Not used for training; deleted after 30 days; may be reviewed for abuse | This is not zero retention |
| Consumer Claude | Training depends on choices such as allowing model improvement, with separate feedback and safety rules | A Pro subscription alone does not establish company processing terms |
| OpenAI business and Anthropic commercial services | No training by default, with separate provisions for opt-ins or submitted feedback | Review the particular product, feature and agreement |
Sources checked on 30 September 2026: OpenAI Data Controls, OpenAI Enterprise Privacy, consumer Claude, commercial Claude.
Do not assume that opting out today reverses previous data use. Feedback buttons also deserve attention: the provider's feedback rules may cover the associated conversation.
A file can outlive the conversation
Consider a complaint document analysed in a chat, added to a shared project and then summarised in a CRM. Several copies now exist. Deleting one conversation does not establish that the file, shared copy and CRM record have all been removed.
OpenAI's documentation distinguishes chats, Library files, memory and connected-app data. Anthropic describes different retention arrangements for its API, products that retain conversation history and additional features. “The provider deletes everything after 30 days” is therefore too broad. OpenAI data and connection controls, Anthropic organisational data retention
Map the inputs, outputs and logs to their storage locations. Assign an owner, access rule and deletion procedure to each. When a feature cannot support the required controls, reduce the data involved or choose another workflow.
Run a practical access and deletion check
Use a synthetic document with an invented case reference. Save it through the paths your team intends to use: chat, project, connected application and resulting record. Check access from a second employee's account, remove the first person's access and carry out the agreed deletion procedure.
The test should establish who can retrieve the material and which copies the company can remove. A user-interface test cannot prove deletion from the provider's infrastructure. That part depends on the service terms and supported mechanisms. Recording this distinction prevents an acceptance report from promising more than the test establishes.
Process review or team training?
If nobody can describe where the data goes or which applications are connected, start with a Syntalith AI process audit, from €600 net. We agree the scope and produce a process map, architecture, implementation plan and fixed build quote. A review of settings and an access test for the selected use case can be included in the agreed engagement. The client's legal assessment and compliance approval remain separate responsibilities.
If the environment is already approved but staff confuse training, history and sharing, team training starts at €600 net per day. Participants practise what to submit, how to reduce the data involved and how to check an answer before using it. Software subscriptions are a separate cost.
Tell us about one workflow. The free 30-minute scan helps establish whether the next step is account governance, training or an integration project. You can describe the task without sending us customer files.
Related reading
Syntalith is an OpenAI Select Partner in the OpenAI Partner Network.
We help your team respond to customers faster and find information in company documents. We choose and set up the right AI tools, then teach your team how to use them.
How to introduce ChatGPT and OpenAI at workFree process scan
Start with a free process scan.
- A 30-minute call with the engineer who would lead the work.
- A review of the processes that cost you the most time and money.
- A written summary: a possible direction, missing information and the next step.
The scan chooses one process to assess, and within 2 business days you receive a recommendation, including when a simpler route is the better fit.
€0
30 minutes · written takeaway within 2 business days
Times are shown in your own time zone. We work with clients across time zones.
Describe the process in the form