Image: Unsplash.
Most small teams pick between Claude and ChatGPT on features and price, then ask about compliance afterwards. The good news is that on the paid team plans, Claude Team and ChatGPT Business, the answer is "both are usable": each comes with a Data Processing Addendum and neither trains on your chats by default.
The differences are narrower and more practical. We checked both vendors' DPAs, pricing pages and help centers on October 15, 2026. Three rows decide most cases: how fast you hear about a breach, whether your data can stay in the EU, and what you have to buy before health data is allowed in.
| What you need | Claude Team (Anthropic) | ChatGPT Business (OpenAI) | Checked |
|---|---|---|---|
| DPA | Built into the Commercial Terms | Offered for Business, Enterprise and API | Oct 15, 2026 |
| Training on your chats | No by default; thumbs-up feedback can be used | No by default | Oct 15, 2026 |
| Breach notice to you | Within 48 hours | Without undue delay, no hour count | Oct 15, 2026 |
| Objecting to a new sub-processor | 15 days from notice | 30 days from notice | Oct 15, 2026 |
| Deleted chats gone from backend | Within 30 days | Within 30 days | Oct 15, 2026 |
| Custom retention period | Enterprise only, 30-day minimum | Admin controls; custom policies listed for Enterprise | Oct 15, 2026 |
| EU data storage | Not offered (API storage is US only) | Enterprise yes; Business rolling out | Oct 15, 2026 |
| SSO and domain verification | Yes | Yes | Oct 15, 2026 |
| SCIM, audit logs, Compliance API | Enterprise only | Enterprise only | Oct 15, 2026 |
| HIPAA BAA | Enterprise (HIPAA-ready) or API | Enterprise (Regulated Workspace) or API | Oct 15, 2026 |
| Seats | 2 to 150 | 2 to 200 | Oct 15, 2026 |
| Standard seat price | $20 billed annually, $25 monthly | Same | Oct 15, 2026 |
Screenshot: Claude pricing, Team & Enterprise tab, Anthropic.
The Shared Security Podcast episode above, from January 2025, walks through the consumer privacy policies of ChatGPT, Gemini and Claude. Anthropic has changed its consumer terms since, so treat the Claude part as history. It's about personal accounts, not team plans, which is exactly the gap the last section of this guide is about.
The contract: closer than you'd think
Anthropic's DPA, with standard contractual clauses, is built into its Commercial Terms: accept the terms for Claude Team, Enterprise or the API and you've accepted the DPA. OpenAI offers its DPA for ChatGPT Business, Enterprise and the API.
The wording differs in two places. Anthropic's DPA promises breach notice "without undue delay, but in any event within 48 hours". OpenAI's DPA says "without undue delay" and gives no number. GDPR Article 33 gives you, the controller, 72 hours to tell your regulator, so a fixed 48 hours from the vendor is worth having in writing.
On sub-processors it runs the other way. OpenAI gives you 30 days from notice to object to a new one; Anthropic gives you 15. If nobody reads vendor notices weekly, OpenAI's window is the more forgiving one.
Training and retention
Neither vendor trains on team-plan chats by default. Anthropic adds one catch worth knowing: if a user clicks thumbs up or down, the whole conversation is kept for up to five years and may be used for training. Team and Enterprise owners can switch that button off, and we'd do it on day one.
On retention, Claude keeps chats until someone deletes them, then removes them from backend storage within 30 days. Chats flagged for usage-policy violations can be kept for up to two years. A custom retention period, with a 30-day floor, is an Enterprise feature.
Screenshot: Configure custom data retention controls for Enterprise plans, Anthropic Privacy Center.
Note the project rule in that screenshot: chats inside a project follow the project's retention, and projects are kept indefinitely by default. If your retention policy names a period, check projects separately.
Retention is also set once for the whole organization. In an r/gdpr thread about Claude Enterprise, u/Powerful-Leather-802 pointed out that "Claude does not offer role based retention", which leaves HR and engineering on the same clock. Anthropic's article describes setting periods "for your organization", and we found no per-group option.
OpenAI says ChatGPT Business admins control how long data is kept and that deleted chats leave its systems within 30 days. Its pricing page lists "custom data retention policies" under Enterprise only, so test the Business admin console before you promise a period in your own policy.
Where the data sits
This is the clearest split. Anthropic's only documented storage location is the US: its data residency page lists "us" as the only workspace geography for the API, and we found no EU storage option for Claude Team or Enterprise. Transfers rely on the standard contractual clauses in the DPA, which is lawful, but it's a transfer assessment you have to write.
That assessment is doable. Asked in r/gdpr about one of Anthropic's support sub-processors, u/Noscituur, who said they had vetted Anthropic professionally, wrote that it had "demonstrated (to me in my due diligence of them in my professional capacity) they have a TIA in place for transfers, where required." Ask for the same before you sign, and keep the answer on file.
OpenAI lets new ChatGPT Enterprise workspaces store content at rest in Europe and other regions. For Business, residency is rolling out gradually, and abuse-monitoring logs stay in the US either way. If a client contract or your DPO insists on EU storage, ChatGPT Enterprise is the only one of the four plans that offers it today.
Image: Unsplash.
Health data: both can, neither team plan does
Earlier versions of this guide said Anthropic offered no HIPAA agreement at all. That's wrong. Anthropic signs a BAA for its first-party API and for HIPAA-ready Claude Enterprise plans, once the organization's primary owner turns on HIPAA in settings and accepts it. Beta features and some surfaces, such as the Console, stay outside it.
Screenshot: Business Associate Agreements (BAA) for commercial customers, Anthropic Privacy Center.
OpenAI's HIPAA list covers ChatGPT for Healthcare, ChatGPT Enterprise with Regulated Workspace and the API with modified retention. Business self-serve doesn't offer BAAs. So for patient data the choice is Enterprise or the API on either side; Claude Enterprise's self-serve tier starts at 20 seats.
The accounts you don't control
Everything above applies only to the team and enterprise plans. Claude Free, Pro and Max users now choose whether their chats train Anthropic's models, with five-year retention if they say yes. ChatGPT's consumer plans train on chats unless the user turns off "Improve the model for everyone". Neither consumer side comes with your DPA.
Verdict by vendor
Claude Team: the stronger breach clause, no EU storage. Pick it if a written 48-hour breach notice matters to your clients or insurer, and if your transfer assessment can live with US storage under SCCs. Turn off the feedback button.
ChatGPT Business: the longer objection window, and a path to EU storage. Pick it if EU residency is coming up in client questionnaires, since Enterprise has it today and Business is getting it. Keep an eye on the breach clause, which has no hour count.
Whichever you choose, write the plan name into your AI acceptable use policy, not just "Claude" or "ChatGPT", and record it in your AI tool register.
Correction (October 15, 2026): an earlier version said Anthropic offered no HIPAA BAA, that OpenAI's BAA covered ChatGPT Enterprise only and not the API, that Claude Enterprise offered EU data residency, and that OpenAI kept data longer than Anthropic by default. Anthropic signs BAAs for its API and HIPAA-ready Enterprise, OpenAI's API is HIPAA eligible with modified retention, Anthropic documents no EU storage, and both API defaults are 30 days.
