A DPA with OpenAI is not enough. ZDR, MAM and the EU region in the API

A data processing agreement (DPA) with OpenAI sets who is responsible for the data and on what terms the provider processes it. It does not change what the API does with the content of a request. Without further approvals, OpenAI stores prompts and responses in abuse monitoring logs for up to 30 days, and processing may take place outside the EU. To keep content from staying with the provider and to have it processed in Europe, you need three things: OpenAI's approval for ZDR or MAM, a project in the EU region, and an application that avoids the features that store data.

We describe each of them from OpenAI's API data documentation, checked on 27 October 2026.

What OpenAI keeps under a DPA alone

Since 1 March 2023, data sent to the API has not been used to train OpenAI models unless the company opts in. Training is one question. The second is how long a copy of the content stays with the provider.

Assistants objects you never delete are kept indefinitely. Once deleted, they leave OpenAI's servers within 30 days.

For the data controller, this means a copy of every request sits with the provider for a month. If requests contain customer data, HR documents or information under professional secrecy, that copy belongs in the record of processing activities, with the recipient and the planned erasure time (Article 30 GDPR).

ZDR and MAM: two approvals you have to apply for

OpenAI offers two retention controls. Both need OpenAI's prior approval and acceptance of additional requirements. You ask OpenAI's sales team for access. Once approved, you choose the setting for the whole organization or for a single project.

MAM (Modified Abuse Monitoring) excludes content from abuse monitoring logs on all endpoints. The rest of the platform works as before, including stored responses.

ZDR (Zero Data Retention) does the same in the logs. In addition, the store parameter on the Responses API and Chat Completions is always treated as false, even when the application sends true.

The choice depends on where the conversation history should live. Under ZDR your application keeps it, in your database, and you set the retention period yourself. MAM fits when the application needs state stored on OpenAI's side, such as stored responses. That state then has to be deleted.

Both approvals have the same limits:

• Endpoints that are not ZDR-eligible still store data: files, vector stores, Assistants, batches, fine-tuning, evals and Conversations.
• Images and files sent to the model are scanned for CSAM. A file the classifier flags is kept for manual review, even under ZDR.
• Data sent to external services, such as an MCP server, falls under those services' terms.
• OpenAI may, with written notice, make specific models ineligible for ZDR and MAM for a given customer. Content then goes to encrypted logs excluded from human review (Private Retention with PSP), or it is retained and may be reviewed when a classifier flags it as a possible policy violation (Safety Retention).

The EU region: eu.api.openai.com

Data residency is set per project. You ask OpenAI's sales team for access to it as well. The Europe region covers the EEA and Switzerland. It provides two things: storage in the region and inference, the computation of the response, in the region. TLS connections terminate in the region through Cloudflare Regional Services.

Any region other than the US requires an approved retention control, ZDR or MAM, and a signed Modified Retention amendment. You cannot run a project in the EU region without one of these approvals. For models released on or after 5 March 2026, requests to data residency endpoints cost 10% more.

The EU region has its own limits:

• System data may be processed and stored outside the region. It covers account data, metadata, usage statistics, billing, support requests and structured output schemas. Keep personal data out of field names and JSON schema descriptions.
• Third-party services the model calls, such as MCP servers, process data under their own terms and in their own locations.
• If a user or your infrastructure operates outside the EU, the data passes through those places too.

The same question at other providers

So Claude runs in the EU through Amazon Bedrock with the EU profile or through Google Cloud with a European region. Under ZDR, Anthropic still keeps safety classifier results. On Google Cloud, Grounding with Google Search stores prompts and responses for 30 days, with no way to turn it off. In Microsoft Foundry, content from EEA deployments is reviewed by Microsoft employees located in the EEA.

The newest models require retention

A ZDR approval covers the organization. It does not automatically cover every model.

• Since 9 June 2026, Anthropic requires 30-day retention for its Covered Models: Claude Fable 5, Fable 5.1, Mythos 5 and Mythos 5.1. This applies on every platform that offers them, unless Anthropic expressly authorizes an exception. On Bedrock and Google Cloud, the retained data stays in the cloud provider's environment.
• Google logs all prompts and responses of models designated "Advanced AI" for up to 30 days, in the project region. Zero retention may not be available for them.
• OpenAI reserves the right to make specific models ineligible for ZDR and MAM, with written notice.

Choosing a model is therefore also a retention decision. Send the most capable model the tasks whose data allows it. Sensitive data goes to a ZDR model in the EU region or to a private model on your own infrastructure.

Transfers outside the EEA still need a basis

Even with the EU region, some data, such as system data, may be processed outside the region. A transfer outside the EEA needs a basis under Chapter V of the GDPR: an adequacy decision or standard contractual clauses. For US recipients that have joined the EU-US Data Privacy Framework, that basis is the Commission decision of 10 July 2023. The General Court dismissed the action against it on 3 September 2025 in case T-553/23. The appeal to the Court of Justice, case C-703/25 P, is pending. Record which basis you rely on.

Checklist before the first request

1. Write down what data will reach the model: personal data, special category data, trade secrets, professional secrecy.
2. Check whether a 30-day copy at the provider fits your retention periods. If it does not, apply for ZDR or MAM.
3. Decide where processing happens: a project in the EU region or a cloud service with an EU region.
4. List the endpoints your application uses. Set expires_after on files, and delete vector stores and Assistants objects when the work is done.
5. Check that the chosen model is covered by ZDR on the chosen platform.
6. Keep personal data out of structured output schemas.
7. Record the date you checked the terms, the project settings and the transfer basis.

How we do it at Syntalith

An API project starts with a data map of one task: what goes into the model, which endpoints the application needs and where copies appear. From that we choose the provider, the region and the retention control. We keep conversation history in the client's database in the EU, so the application needs no state stored at the provider. The company that holds the OpenAI account applies for ZDR or MAM. We help prepare the application and configure the project once it is approved. When no copy at the provider is acceptable, we move to a private model in your cloud account or on your own server.

We set the scope in an AI process audit from €600 net, credited toward the build. The data controller, with the data protection officer, makes the legal assessment of the specific processing. Start with a free 30-minute call: describe the task and the kind of data.

FAQ

Is a DPA with OpenAI enough to work with personal data?

The DPA sets the roles and obligations of the parties. Without further approvals, OpenAI keeps prompts and responses in abuse monitoring logs for up to 30 days and may process them outside the EU. The data controller decides whether that fits its policy. If it does not, you need ZDR or MAM and a project in the EU region.

How do ZDR and MAM differ?

Both controls exclude content from abuse monitoring logs, and both need OpenAI's approval. ZDR also forces store=false on the Responses API and Chat Completions, so OpenAI does not store responses. Under MAM, stored responses still work.

Does the OpenAI EU region require ZDR?

The EU region requires an approved retention control, ZDR or MAM, plus a signed Modified Retention amendment. For models released on or after 5 March 2026, data residency requests cost 10% more.

Does Claude have an EU region in the API?

Anthropic's first-party API processes requests globally or in the US. For Claude processing in the EU, use Amazon Bedrock with the EU profile or Google Cloud with a European region.

Sources

Checked on 27 October 2026:

• OpenAI: Data controls in the OpenAI platform
• Anthropic: API and data retention and how long Anthropic stores organization data
• Anthropic: Covered Models and Claude API data residency
• Google Cloud: abuse monitoring and zero data retention
• Microsoft: data and privacy in Foundry
• AWS: geographic cross-Region inference in Bedrock
• GDPR, English text

Related: GDPR and DPA when deploying AI, Is Claude GDPR compliant, Private LLM: data, EU hosting and on-premise.