GDPR-Compliant AI Assistants: 6 Checks Your DPO Will Run

Image: Unsplash.

Every AI assistant vendor now calls itself "GDPR compliant", and every one in this comparison will sign a data processing agreement. That isn't where approvals stall. They stall when your DPO finds the plan you bought isn't the plan the privacy page describes, when "EU residency" turns out to mean storage but not processing, or when one model inside the product sits outside the vendor's EU promise.

We checked five assistants against the six things DPOs ask for, using each vendor's own DPA, help center and trust center on October 15, 2026. Cohere was in an earlier version; we dropped it because we couldn't confirm its EU and training terms from its public pages.

The six checks, in plain terms

• A DPA under Article 28. GDPR Article 28(3) requires a contract that makes the vendor process personal data "only on documented instructions from the controller". No DPA, no lawful use for personal data.
• No training on your data. On the plan you actually pay for, by default.
• EU residency. Where data rests, and separately, where it's processed.
• Sub-processor control. Article 28(2) bars new sub-processors without your authorisation, so look for how you hear about them and how long you have to object.
• A security report. SOC 2 Type II or ISO 27001. Not a GDPR requirement, but it's what your DPO will ask for.
• Self-hosting. Running the model on your own infrastructure, for teams that can't send data to a vendor at all.

Comparison table

Image: Unsplash.

Tool by tool

Claude Team and Enterprise (Anthropic). Anthropic's DPA is part of its Commercial Terms, so it applies without a separate signature. It includes the Standard Contractual Clauses, a 48-hour breach notice and fifteen days to object to a new subprocessor. Commercial plans aren't used for training by default. Chats are kept so users can continue them; a deleted chat leaves Anthropic's back-end storage within 30 days, and Enterprise admins can set a custom retention period with a 30-day minimum. Zero data retention exists, but it covers eligible APIs and Claude Code on Enterprise, not Claude chat. The gap is residency: Anthropic's data residency docs list the US as the only storage geo, and we found no EU option for Team or Enterprise.

ChatGPT Enterprise (OpenAI). OpenAI signs a DPA for Enterprise and Business, doesn't train on their content by default, and both plans have completed a SOC 2 Type 2 audit. Admins set retention, and deleted conversations leave OpenAI's systems within 30 days. New Enterprise and Edu workspaces can store content at rest in Europe, and since January 16, 2026 eligible ones can also run inference in Europe. ChatGPT Business is the cheaper plan: its residency is still rolling out, and its abuse-monitoring logs stay in the United States whatever region you pick.

Gemini in Google Workspace. Gemini runs under the Workspace agreement and its Cloud Data Processing Addendum. Google's Gemini privacy hub says your content isn't used for model training outside your domain without permission, and lists prompt retention at 90 days to indefinite, set by your admins. Data regions let you store covered data in Europe on Business Standard and higher editions, and Gemini prompts and responses are covered. Processing in your chosen region is a separate checkbox, available only on Frontline Plus, Enterprise Plus and Enterprise Essentials Plus. Gemini Notebook isn't covered by data regions at all.

Mistral Vibe (formerly Le Chat). Mistral hosts data in the EU by default, and its Trust Center lists SOC 2 Type II, ISO 27001 and ISO 27701. Enterprise customers can run Vibe on-premises or in a private cloud, the only self-hosting option in this comparison. The catch is the plan: Mistral's help center says Vibe input and output train its models by default unless you opt out, and only Enterprise is opted out by default. A team on the Team plan needs an admin to switch that off before anyone pastes personal data in.

Screenshot: Do you use my user data to train your artificial intelligence models?, Mistral Help Center.

Microsoft 365 Copilot. Copilot sits under Microsoft's Product Terms and Data Protection Addendum, and Microsoft says prompts, responses and Graph data aren't used to train foundation LLMs. Admins set Copilot retention through Microsoft Purview. For EU users, Copilot traffic stays inside the EU Data Boundary, which covers the EU and EFTA countries, with one exception that matters: models provided by Anthropic as a subprocessor are currently excluded.

Screenshot: Data, privacy, and security for Microsoft Copilot, Microsoft Learn.

Microsoft's own short explainer on where Microsoft 365 stores data at rest. It's worth three minutes before you file Copilot under "EU data stays in the EU".

What the table can't show you

The plan tier decides the answer. The training row above reads differently for Mistral Team and Mistral Enterprise, and for ChatGPT Business and ChatGPT Enterprise on residency. Write the exact plan name in your record of processing, not just the vendor.

Storage and processing are different promises. Google stores Gemini prompts in Europe on far more editions than it processes them there. ChatGPT Business keeps abuse logs in the US even with an EU storage region. Ask both questions.

Models inside the product can sit outside the promise. The Copilot exclusion for Anthropic models is the clearest case. In an r/gdpr thread on keeping Copilot documentation current, u/Comfortable-Fall1419 suggested tracking changes at the model level and said to "block Anthropic via the Admin panel if you have an EU tenant." Another reply in the same thread, from u/rahuliitk, named the underlying issue: "feature drift is the real problem."

We'd go with that advice. One baseline DPIA per assistant, plus a review whenever the vendor changes which models or regions handle your data, is something a small team can actually keep up.

Objection windows run from ten days to a month. Mistral gives you ten days after notice, Anthropic fifteen, OpenAI a month. Google gives at least 30 days' notice before a new subprocessor starts, but your only objection is to terminate within 90 days. Someone has to read those notices; put a name next to each vendor.

Before your DPO signs

1. Is the DPA in place for the plan you're buying, not just "available"?
2. Where is data stored, where is it processed, and which features or models are excluded?
3. Is training off by default on this plan, or does an admin need to switch it off?
4. Who reads sub-processor notices, and how many days do you have to object?
5. What's the retention setting, and who changes it?
6. Is there a current SOC 2 or ISO 27001 report on file?

Our GDPR Article 30 template for AI tools has a place for each answer, and the AI vendor evaluation checklist covers the contract side.

Verdict by tool

Mistral Vibe Enterprise: the default pick for EU-first teams. EU hosting by default, training off on Enterprise, and the only self-hosting route here. Don't buy the Team plan for personal data unless an admin turns training off first.

Gemini in Workspace: the easy choice if you're already on Workspace. Storage in Europe comes with most paid editions; processing in Europe needs Enterprise Plus or similar.

ChatGPT Enterprise: now a real EU option. OpenAI's own EU storage and in-region inference closed most of the gap. Business is the weaker plan for EU teams until its residency reaches you.

Microsoft 365 Copilot: strong boundary, one hole. The EU Data Boundary is the most complete promise here, minus Anthropic models. Decide whether to allow them.

Claude Team and Enterprise: fine on SCCs, not for EU-only rules. The contract terms are good and the breach clock is the tightest here, but there's no documented EU storage.

What we couldn't confirm: Microsoft's sub-processor notice period and breach-notice wording, which sit in a DPA download we didn't read this pass, and Mistral's default chat retention on Team and Enterprise.

Correction (October 15, 2026): an earlier version said Claude Enterprise offered EU residency on AWS EU regions and zero retention for chats, that ChatGPT Enterprise's EU residency ran through Azure, that Gemini kept activity for 18 months by default, and that Mistral's SOC 2 was in progress with 30 days' subprocessor notice. None of that matches the vendors' current documents; the table above does. We also added that Mistral's non-Enterprise plans train by default.

Related reading

• Anthropic vs OpenAI GDPR compliance compared
• AI vendor DPA tracker 2026
• Privacy-first AI APIs for GDPR and CCPA
• ChatGPT vs Claude vs Gemini enterprise compliance
• Microsoft Copilot data governance for small teams
• Notion AI vs Microsoft Copilot compliance
• OpenAI trust portal: GDPR Article 28 guide
• AI agent persistent memory and GDPR