Since ChatGPT launched, European data protection authorities have opened investigations, issued bans and threatened fines against AI companies. Yet in October 2026 the only large GDPR fine against a generative-AI model maker, €15 million against OpenAI, no longer exists: the Court of Rome annulled it in March. For companies this does not mean the GDPR stops at AI. It means the obligations sit with you, the controller who puts customer and employee data into Claude, ChatGPT, Mistral or Manus. This guide shows what regulators have actually done, how long the four providers keep your data, and what to check before a roll-out.
What regulators have actually done
The GDPR applies to AI the same way it applies to any processing of personal data: when a model is trained on personal data, when employees paste customer data into a chatbot, and when a chatbot answers questions about real people. Enforcement so far falls into three groups.
- Facial recognition. Clearview AI, which scraped billions of photos from the web, collected the largest AI-related GDPR fines: €20 million each in Italy, Greece and France in 2022, and €30.5 million in the Netherlands in 2024.
- Generative AI chatbots. Italy's Garante temporarily blocked ChatGPT in 2023 and fined OpenAI €15 million in November 2024 over the legal basis for training, transparency, a late-reported data breach and missing age verification. It fined Luka Inc., maker of the Replika companion chatbot, €5 million in 2025, and Character.AI €158,000 in July 2026 over age checks and the protection of minors.
- Bans and orders without fines. The Garante ordered DeepSeek blocked in Italy in January 2025. In June 2025 the Berlin data protection commissioner reported the DeepSeek app to Apple and Google as unlawful content, because user data was transferred to China without adequate safeguards.
Sources: decisions of the Dutch, Italian, Greek and French authorities on Clearview AI; Garante decisions on OpenAI (n. 755 of 2 November 2024), Luka Inc. (2025) and Character Technologies (July 2026, as reported); Court of Rome judgment R.G. 4785/2025 of 18 March 2026. Bans without fines (DeepSeek) are not shown.
Why the OpenAI fine fell: the one-stop-shop
The Court of Rome did not decide whether OpenAI broke the GDPR. It decided who may judge that. Under the one-stop-shop mechanism, a company with an EU main establishment is supervised by the authority of that country. OpenAI opened its Irish establishment in February 2024, before the Garante's decision, so the court held that the Irish Data Protection Commission had become lead authority and the Garante lacked competence. The underlying questions (can a model be trained on scraped personal data under legitimate interest, how do you correct a false statement about a person) remain open and now sit in Dublin.
Anthropic, OpenAI and Microsoft are among the AI providers with Irish establishments; Mistral is supervised by the French CNIL. For EU companies this has a practical consequence: Europe-wide decisions on how frontier models were trained will be slow, but national authorities remain fully competent for your use of these tools, because you are the controller of the data your employees enter.
Source: DLA Piper GDPR Fines and Data Breach Survey, January 2026 (data to 10 January 2026). Total about €7.1 billion; Ireland €4.04 bn, France €1.1 bn, Luxembourg €746.56 M. "All other countries" is the remainder of the total.
How long do Claude, ChatGPT, Mistral and Manus keep your data?
Retention is the question data protection officers ask first. The providers' own documentation gives the following answers in October 2026:
- Anthropic. API inputs and outputs are deleted from the back end within 30 days. Zero data retention (ZDR) is available for approved API customers, but stateful features such as the Batch API, Files API and code execution are not covered. Content flagged by the safety systems may be kept for up to 2 years and classification scores for up to 7 years. In consumer Claude, chats are used for training only if the user switches the setting on; then they may stay in the training pipeline for up to 5 years.
- OpenAI. API abuse monitoring logs are kept for up to 30 days. ZDR and modified abuse monitoring require OpenAI's approval. API and business data (ChatGPT Business, Enterprise, Edu) is not used for training by default; consumer ChatGPT is, unless the user turns off "Improve the model for everyone".
- Mistral. API inputs and outputs are kept for 30 rolling days for abuse monitoring, and ZDR is available for the API. Team, Enterprise and API data is not used for training by default; the free Vibe (formerly Le Chat) tier uses conversations unless the user opts out. Mistral is a French company hosting in the EU.
- Manus. The help centre says Manus uses aggregated or de-identified data to improve its services, and users can opt out in their settings. We found no published retention period for conversation data, so ask for one in your data processing agreement.
Sources: Anthropic privacy centre (commercial and consumer retention articles) and API data retention documentation; OpenAI "Your data" API documentation; Mistral API terms. Maximum periods stated by the providers, October 2026. Zero data retention arrangements (0 days for eligible API features) are not shown. Legal holds can extend any period.
Which tiers train on your data
The most important line in any AI policy is the one between consumer and business products. All three large labs promise not to train on business-plan and API data by default. On consumer accounts, the default is training at OpenAI and Mistral, and an explicit choice at Anthropic. Employees using private accounts for work, the classic shadow AI scenario, therefore move company data into training pipelines.
Sources: privacy policies and help centres of Anthropic, OpenAI, Mistral and Manus, October 2026. "Your choice": Anthropic asks consumer users to switch training on or off. Manus documents use of de-identified data with an opt-out but does not separate tiers. Settings can change; check the current terms before signing.
The GDPR checklist for using generative AI
| Step | What to do | Why it matters |
|---|---|---|
| Business tier only | Block consumer accounts for work; buy Team, Enterprise or API access | No training by default, admin controls, a data processing agreement |
| Data processing agreement | Sign the provider's DPA; check sub-processors and the Standard Contractual Clauses | Art. 28 and transfers to the US under Chapter V |
| Legal basis and records | Document the purpose and legal basis per use case in your record of processing | Art. 6 and Art. 30; first thing an auditor asks for |
| DPIA | Run a data protection impact assessment for HR, customer data at scale or sensitive data | Art. 35; required for likely high-risk processing |
| Retention | Set chat retention in the admin console; request ZDR for sensitive API workloads | Storage limitation, Art. 5(1)(e) |
| Data minimisation | Strip or pseudonymise personal data before prompts where you can | Art. 5(1)(c); less data, less risk |
| Transparency | Tell customers and employees when AI processes their data or talks to them | Arts. 13–14 GDPR and Art. 50 of the AI Act |
| Automated decisions | Keep a human in the loop for decisions with legal or similar effects | Art. 22; applies to AI screening of applicants |
GDPR and the AI Act: two laws, one project
The EU AI Act does not replace the GDPR; it adds product rules on top. The transparency duties of Article 50 (telling people they are talking to a chatbot, marking synthetic content) overlap with the GDPR's information duties, and a high-risk system under the AI Act will almost always need a DPIA as well. Running both assessments in one project saves time. Our AI Act compliance guide covers the timeline after the Digital Omnibus, and our free Article 50 website scanner checks whether your chatbot discloses that it is an AI.
What this means for companies in Croatia and the DACH region
Croatian companies are supervised by AZOP, German companies by their state authority (and the BfDI for federal bodies), Austrian companies by the DSB. None of them needs a big-tech case to act on a breach at a local company. In practice three decisions cover most of the risk: give employees a business-tier tool so they stop using private accounts, keep prompts with personal data on providers that offer a DPA, short retention and EU or ZDR options, and write a one-page DPIA per use case. If data must not leave the EU at all, look at EU-hosted options and open-weight models, compared in our guide to sovereign AI and data residency.
Frequently asked questions
Is ChatGPT or Claude GDPR-compliant for business use?
Neither tool is compliant or non-compliant by itself; your use is. Business plans and the APIs of Anthropic, OpenAI and Mistral do not train on your data by default and come with a data processing agreement. You still need a legal basis, a record of processing, transparency towards data subjects and, for higher-risk uses, a DPIA.
How long do AI providers keep API prompts?
By default Anthropic, OpenAI and Mistral keep API inputs and outputs for up to 30 days, mainly for abuse monitoring. Zero data retention is available on approval. Content flagged for policy violations can be kept longer: Anthropic states up to 2 years.
What happened to the €15 million GDPR fine against OpenAI?
The Italian Garante fined OpenAI €15 million in November 2024. The Court of Rome annulled the decision on 18 March 2026 on jurisdiction: after OpenAI set up an Irish establishment, the Irish Data Protection Commission became lead authority. The court did not rule on the alleged infringements.
Do we need a DPIA before rolling out an AI assistant?
Often yes. A DPIA is required where processing is likely to result in a high risk, which regulators assume for new technology combined with employee monitoring, sensitive data, large-scale processing or automated decisions. Even when it is not mandatory, a short DPIA is the cheapest way to document your choices.
Rolling out AI without a GDPR headache?
We help companies in Croatia and the DACH region choose the right AI tier, set retention and access controls, and write the DPIA and AI policy before employees start pasting data. As a Claude Certified Architect from Zagreb, we combine the technical set-up with the documentation your DPO needs.
Talk to an AI consultant