Image: Pexels, used under the Pexels License.
ChatGPT Business, called ChatGPT Team until August 29, 2025, gives you the same privacy terms as Enterprise: the same Data Processing Addendum, no training on your data by default, and a SOC 2 Type 2 audit. So if your only question is "is it GDPR-safe?", Business answers it.
Enterprise is for the next question: "can you prove it, and can you control it?" We checked both plans against OpenAI's pricing page, help center and DPA on October 15, 2026, and it comes down to five questions.
The upgrade checklist
Tick any line that's true for your team. One tick is enough reason to price Enterprise; no ticks means Business already gives you the terms that matter.
- Offboarding. Leavers go through several managers, and you can't rely on one person removing each ChatGPT seat by hand. (Enterprise has SCIM.)
- Logs. A client, auditor or regulator could ask for records of what staff did in ChatGPT, or you use it for something the EU AI Act calls high-risk, such as screening job applicants. (Enterprise has the Compliance API.)
- Location. A contract or your DPO requires customer content to be stored in the EU or another named region now. (Enterprise has residency; Business is still rolling it out.)
- Health data. Anyone will put patient information into ChatGPT. (Business can't sign a BAA.)
- Size. You need more than 200 paid seats on one subscription.
Here's how the two plans line up on everything else.
| What you need | ChatGPT Business | ChatGPT Enterprise | Checked |
|---|---|---|---|
| Data Processing Addendum | Yes | Yes, same DPA | Oct 15, 2026 |
| No training on your data by default | Yes | Yes | Oct 15, 2026 |
| SOC 2 Type 2 | Yes | Yes | Oct 15, 2026 |
| ISO 27001, 27017, 27018, 27701 | Not listed | Yes | Oct 15, 2026 |
| SAML SSO and domain verification | Yes | Yes | Oct 15, 2026 |
| SCIM provisioning | No | Yes | Oct 15, 2026 |
| Compliance API (audit and content logs) | No | Yes | Oct 15, 2026 |
| Enterprise key management, IP allowlisting | No | Yes | Oct 15, 2026 |
| Data residency | Rolling out; abuse logs stay in the US | Ten regions, including the EU | Oct 15, 2026 |
| HIPAA BAA | No | With Regulated Workspace | Oct 15, 2026 |
| Seats | 2 to 200 paid | Through sales | Oct 15, 2026 |
| Price per seat | Standard $25 monthly or $20 billed annually; Premium $125 or $100 | Custom | Oct 15, 2026 |
Screenshot: ChatGPT business pricing, OpenAI. Local-currency prices shown; the USD prices are in the small print.
Charlie Cowan's ten-minute walkthrough of the team and enterprise tiers of ChatGPT and Claude dates from November 2024, before Team became Business, so ignore its prices and feature lists. The logic of when to step up a tier still holds, and it's a useful primer for a non-technical budget holder.
What's the same on both plans
The contract. OpenAI signs a DPA for Business, Enterprise and the API. It's one document, so the terms that matter under GDPR don't change when you upgrade: breach notice without undue delay, and 30 days from notice to object to a new sub-processor. Earlier versions of this guide said Enterprise got a longer notice period and Business got none. That was wrong.
Training. OpenAI's Business FAQ says Business is governed by its business terms and enterprise privacy commitments, and that it doesn't train on workspace data. Enterprise has the same default.
Security evidence. Both plans have completed a SOC 2 Type 2 audit, and both reports sit in OpenAI's trust portal. If a client asks for your AI vendor's SOC 2, a Business workspace can answer it.
Retention, mostly. OpenAI's privacy FAQ says admins on both plans control how long data is kept, and deleted conversations leave OpenAI's systems within 30 days. The pricing page, though, lists "custom data retention policies" only under Enterprise. We couldn't tell from the public pages how short a Business admin can go, so check the admin console before you write a retention period into your policy.
How to answer each question
SCIM. Business has SAML SSO, so with SSO enforced a leaver can't log in once you disable their identity account. Without SCIM, their seat and workspace membership stay until someone removes them by hand. In a team where one person sees every leaver, that's a checklist item. Once leavers go through several managers, people get missed.
The Compliance API. Enterprise exports conversation and audit logs to your own tools; Business doesn't. This is the row that matters if you deploy ChatGPT in something the EU AI Act treats as high-risk, such as screening job applicants. Article 26(6) requires deployers of high-risk systems to keep the logs under their control for at least six months. You can't keep logs you can't export.
Data residency. Enterprise supports residency in ten regions, and new Enterprise workspaces can store content at rest in Europe. Business residency is rolling out gradually, and even when you get it, abuse-monitoring logs stay in the United States. If your DPO wants EU storage now, Enterprise is the plan that has it.
HIPAA. OpenAI's HIPAA eligibility page lists ChatGPT for Healthcare, ChatGPT for Enterprise with Regulated Workspace, and the API with modified retention. Business isn't on the list, and the Business overview says BAAs are a sales-led option. An earlier version of this guide said no ChatGPT plan could get a BAA; that's no longer true for Enterprise.
Screenshot: HIPAA eligible products and functionality, OpenAI Help Center.
For a developer team that only needs PHI in an application, the API is the lighter route: OpenAI's BAA article says an Enterprise agreement isn't required for an API BAA, though self-serve enrollment needs a history of API usage.
Size. Business caps a subscription at 200 paid seats, and OpenAI points anyone larger to Enterprise. There's also a two-seat minimum.
What this checklist doesn't cover
The EU AI Act
Your obligations come from the use case, not the subscription. A chatbot that talks to customers has to make clear people are dealing with an AI system unless that's obvious (Article 50(1)). Screening job applicants is high-risk under Annex III, with human oversight and log-keeping duties for you as the deployer. The plan only changes whether you have the tools to meet them, which is why the Compliance API row matters more than the price row for HR and lending teams.
Image: Pexels, used under the Pexels License.
Personal accounts
None of this covers personal accounts. Free, Go, Plus and Pro are consumer plans with no DPA, and a Business workspace doesn't stop staff using them. In an r/gdpr thread about staff putting client data into free ChatGPT, a consultant who audits small French companies' software, u/Patient_Surround7705, put it bluntly: "This scenario is more widespread than most leadership teams realize." We think that's the real argument for a paid plan: give people an approved tool, then rule out the rest.
Our shadow AI policy guide covers how to find and close that gap, and an AI tool register is where you record which plan is approved for what.
Correction (October 15, 2026): an earlier version said no ChatGPT plan offered a HIPAA BAA, that Business lacked domain verification, that Enterprise gave 30 days' advance notice of new sub-processors while Business got no contractual notice, and that Enterprise typically needs about 150 seats. OpenAI's current pages say otherwise or don't say it at all; the table above reflects them.
