OpenAI Data Residency in Europe: What You Need to Know
OpenAI Launches European Data Residency
OpenAI initiated data residency within Europe on Thursday, providing organizations operating within the region with the capability to adhere to local data sovereignty regulations while utilizing the company’s artificial intelligence products.
Understanding Data Residency
Data residency pertains to the geographical location where an organization’s data is physically stored, alongside the applicable local legal and policy stipulations governing that data. A majority of major technology companies and cloud service providers currently offer European data residency programs.
These programs are designed to assist customers in complying with European privacy and data protection legislation, including regulations such as the GDPR, Germany’s Federal Data Protection Act, and the U.K.’s data protection laws.
Recent Developments in Data Residency
In October, the developer platform GitHub introduced cloud data residency within the EU for customers subscribing to its GitHub Enterprise plan. Similarly, AWS, Amazon’s cloud computing division, launched a “sovereign cloud” for Europe, enabling customers to maintain all EU-created metadata within the region.
Google also implemented data residency for machine learning processing, specifically for U.K.-based users of its Gemini 1.5 Flash AI model.
OpenAI’s New Offering
Effective Thursday, OpenAI customers leveraging the company’s API can now select to process data within Europe for designated “eligible endpoints”. Furthermore, new subscribers to ChatGPT Enterprise and Edu can opt to store their customer content at rest within Europe.
Data “at rest” signifies information that is not currently being transferred across networks or actively accessed.
Data Handling and Storage
With European data residency activated, OpenAI confirms that API requests will be processed within the region, with no data retention occurring. This means that AI model requests and their corresponding responses will not be stored on the company’s servers.
For ChatGPT, enabling this feature ensures that customer information – including conversations, user prompts, images, uploaded files, and custom bots – will be stored at rest within the designated European region.
Implementation Details
Currently, European data residency can only be configured for new projects utilizing the OpenAI API. Existing projects cannot be retroactively updated to incorporate European residency settings.
Future Outlook
“We anticipate collaborating with an increasing number of organizations throughout Europe and globally on their AI endeavors, all while upholding the most stringent standards of security, privacy, and regulatory compliance,” stated the company in a blog post released on Thursday.
Regulatory Scrutiny
European data regulators have previously addressed OpenAI regarding alleged potential non-compliance with local data protection laws. Countries including Spain and Germany have initiated investigations into ChatGPT’s data processing practices.
In December, Italy’s data protection authority imposed a €15 million ($15.6 million) fine on the company for purported violations of European consumer data protection requirements.
The location of data storage for AI services remains a significant concern, extending beyond OpenAI. DeepSeek, a rapidly growing AI startup, processes data from its base in China, attracting attention from regulatory bodies.
European Data Protection Board Report
Last year, a task force from the European Data Protection Board, responsible for ensuring consistent data protection rule application across the EU, published a report. This report aimed to guide member countries’ data protection authorities during investigations into ChatGPT.
The report covered topics such as the legality of collecting training data, transparency, and data accuracy.
Stay informed with TechCrunch’s AI newsletter! Subscribe here to receive it in your inbox every Wednesday.
