Blog · Published · Updated
Turning off training in ChatGPT and Claude: is that enough for GDPR?
Short answer
Turning off training in ChatGPT or Claude covers one way the vendor uses data. It does not set the purpose of processing in the company, the scope of the contract, retention or who will open an attached file. No training does not mean no storage. An AI Act and GDPR audit at Syntalith costs from €700 net and ends with a register of tools, a list of settings changes and a training plan.
- net for implementation for a team of up to 10 people, paid once
- from €1,150
- from start to work of the entire team
- 2 weeks
- after this time, we measure the effect on the same tasks
- 30 days
- conversation with an engineer and a written plan within 2 business days
- €0
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Syntalith · 3 min read
Statistics
GDPR and AI in companies: statistics 2026
30 days
is how long OpenAI keeps Temporary Chat conversations, although they are not used for training. No training does not mean zero retention.
48.8%
According to Eurostat (2025), 48.8% of EU companies that considered AI and did not use it named concerns about data protection and privacy.
52.5%
According to Eurostat (2025), 52.5% of EU companies that considered AI and did not use it named a lack of clarity about the legal consequences.
78%
According to Microsoft's Work Trend Index (2024), 78% of AI users bring their own AI tools to work.
Source: Microsoft and LinkedIn, Work Trend Index 2024 (2024) ↗
84%
According to the European Commission (2025), 84% of Europeans think AI at work needs careful management to protect privacy and ensure transparency.
Source: European Commission, Special Eurobarometer 554 (2025) ↗
Figures checked: 22 October 2026
What the switch actually changes
„We turned off training, so we can paste customer data” goes too far. The obligations depend on the process, and GDPR, above all Articles 5, 6 and 28, covers the purpose, the legal basis and processing on your behalf.
| Service or setting | What the vendor describes | What it does not settle |
|---|---|---|
| ChatGPT with „Improve the model for everyone” turned off | New conversations do not train models | Conversations stay in the history |
| ChatGPT Temporary Chat | No training, deletion after 30 days, possible abuse monitoring | It is not zero retention |
| Consumer Claude | Training depends on consent to improving models | A Pro subscription does not set business terms |
| OpenAI business services and Anthropic commercial services | No training by default | The product, the feature and the contract still need assessing |
Sources: OpenAI Data Controls, OpenAI Enterprise Privacy, consumer Claude, commercial Claude. Turning off training today does not undo earlier use of data, and the feedback button can pass on the content of the related conversation.
A file lives longer than a conversation
An analysis of complaints from a file goes into a shared project, and the result goes into the CRM. Several places of storage appear, and deleting one conversation does not delete the file, a shared copy or the record in the system.
Conversation
the account history
the setting and deleting the conversation
File in a project
the project space
the project owner and access
Connected app
a drive or a mailbox
the connection's permissions
Result in the CRM
the company's system
the CRM's retention rules
Anthropic gives different retention rules for the API, products with history and extra features (organisation data retention), so the sentence „the vendor deletes everything after 30 days” is too broad. Give each place an owner, access rules and a deletion rule.
You check the setting for the feature you use
In OpenAI's documentation, the training control for conversations is separate from the training setting for Codex environments. Changing one does not change the other, so do not carry a finding from chat over to all of an employee's tools.
- Product and account type: personal, team, company
- Feature: chat, project, connected app, Codex
- The training setting for that feature
- Retention of conversations and files
- Who can send feedback to the vendor, and with what content
According to Eurostat (2025), 48.8% of EU companies that considered AI and did not use it named concerns about data protection and privacy. A settings inventory is the cheapest first step, because it needs no new licence. A list of accounts and one person who goes through the settings of each tool are enough.
A trial before launch
- 01DocumentAn invented case number, with no real data.
- 02FlowConversation, project, connected app and result, the way the department works.
- 03AccessA check from a second employee's account.
- 04RemovalRemoving access for the first person.
- 05DeletionRunning the agreed procedure and recording which copies disappeared.
The result of the trial shows who can read the material and which copies the company can delete. A test of the interface does not prove that data was deleted from the vendor's infrastructure. You assess that part on the basis of the service terms and the mechanisms available, which keeps the company from making promises it cannot check.
An audit or training
An AI Act and GDPR audit at Syntalith costs from €700 net and ends with a register of AI tools, a list of settings changes and a training plan for the team. If nobody knows which way the data flows, start with an AI Act and GDPR audit or an AI process audit from €600 net. If the environment is approved, but employees confuse history, training and sharing, team training from €1,150 net a day is enough. Legal advice and approval of compliance stay on the client's side.
„I already use AI.”
Your people too. Just no rules.
From our conversations with companies
5 na 10 employees paste sensitive data into private AI accounts: contracts, invoices, customer data.
In ESET survey (2026)
1 na 10 admits this in the survey.
Customer data pasted into a private AI account without an data processing agreement is a violation of the GDPR.
Don't worry, we won't tell anyone :)
What do we see in companies that "already use"
- Only ChatGPT or Claude accounts, without plugins, skills, integrations and MCP servers with company tools.
- Company programs are not connected to AI. People still click through systems and Excel, and enter chat data manually.
- Lack of company standards: everyone writes instructions in their own way, no one shares what works.
- No rules for personal data, GDPR and company secrets.
- No limits and no visibility: no one knows who uses AI, how much and for what.
62% Polish employees use AI at work · 27% companies have written rules for working with AI.
Source: ESET and DAGMA, Cyberportrait of Polish business 2026 (March 2026, 1,026 people) ↗
ChatGPT or Claude space review
Accounts, permissions, rules for working with data and 5 tasks set for the team. 1 day.
€450 net
Company accounts, rules of working with data and team training in 2 weeks, from €1,150 net.View implementation for the team →
„Is my data safe?”
Yes. You choose where they go: from your company account to the model on your server.
00Employee's private account
Customer and company data ends up in an account that the company cannot see or control. There is no data processing agreement, so it is a violation of the GDPR. When an employee leaves, the chat history goes with them.
01ChatGPT or Claude corporate account
The provider does not use your data to train models. A copy of the queries remains in his logs for up to 30 days.
02API with zero retention (ZDR)
The provider processes the request and does not save anything. It requires his consent, we prepare the application together.
03Processing in the EU
Queries are counted and stored in Europe: OpenAI in the EU region, Claude via clouds with the EU region.
04Model at your place
The open model runs on your server or in your cloud in the EU. The data does not go outside the company.
What we do with every implementation
- Confidentiality agreement and data processing agreement before we receive any data.
- You choose the cases for the prototype and we anonymize them upon request.
- The data stays in the EU and we delete it after the test.
- Corporate accounts with an administrator on your side.
When data cannot leave the company
The open model runs on your server or in your cloud in the EU. To choose from:
- White-tailed eagle
- Polish model, SpeakLeash and ACK Cyfronet AGH
- PLLUM
- Polish model, HIVE consortium commissioned by the Ministry of Digitization
- Qwen
- Alibaba
- GLM
- Zhipu AI
- DeepSeek
- DeepSeek
We select a model for the task and check it on your cases. We run it, tune it and maintain it.
Source: Bielik and PLLuM, ACK Cyfronet AGH ↗ · PLLuM, Ministry of Digitization ↗
Do you have a lot of your own data? We will fine-tune the small model.
- 1 Your examples
- 2 tuning
- 3 test on new cases
- 4 model at your place
When you have thousands of similar emails, documents or reports, we teach a small open model based on your examples. It works for you, responds quickly and costs less to maintain than a large model. We measure quality on issues that the model has not seen while learning.
Przemysław and Piotr did it in large programming and consulting companies. Artem did it before and does it today at Syntalith. It's about models on your own infrastructure, tuning and quality measurement.
You choose the protection level during the interview. We sign the data processing agreement before we see any data.Schedule a free analysis →
Price
Three packages. You know the price right away.
Team of up to 10 people
from €1,150
net, paid once · 2 weeks
Company, from 11 to 40 people
from €2,300
net, paid once · 3–4 weeks
Organization, over 40 people
from €4,600
net, paid once · 6–8 weeks
- The same packages once you have licenses. To start, an inspection of the space in 1 day is enough: €450 net.
- You buy Claude Team licenses directly from Anthropic, without our markup: USD 20 per person per month for annual payment or USD 25 for monthly payment, from 2 to 150 people.
From conversation to measurement
01 · 30 min
Free process review€0
An engineer picks 3 to 5 of your team's tasks with you. Written plan within 2 working days.
02 · 2 weeks
Rolloutfrom €1,150
Accounts and roles, rules for working with data, training on your team's tasks. You buy licences directly from the provider.
03 · after 30 days
Measurementincluded
We compare task times before and after. We name in writing the tasks worth handing to a system.
or call+48 888 78 48 78WhatsAppMon–Fri 9:00–17:00 CET
Questions
Is turning off training in ChatGPT enough for GDPR?
No. The setting covers the use of conversations to train models. The company still settles the purpose and legal basis of processing, the terms of the contract with the vendor, access, retention and deletion of data.
How long does OpenAI keep Temporary Chat?
According to OpenAI, Temporary Chat conversations are not used for training and are deleted after 30 days. During that time they may be subject to abuse monitoring. That is not zero retention.
Do business services train the models?
OpenAI and Anthropic describe no training by default in their business and commercial services, with separate rules for consents and submitted feedback. The specific product, feature and contract are assessed separately.
How much does it cost to sort out AI settings in a company?
An AI Act and GDPR audit at Syntalith costs from €700 net and ends with a register of AI tools, a list of settings changes and a training plan for the team. An AI process audit costs from €600 net, and team training from €1,150 net a day. Licences are a separate cost.
