OpenAI launched data residency rights in Europe on Thursday, allowing European organizations to meet local data sovereignty requirements when using AI companies’ products.
Data residency refers to the physical location of the organization's data, as well as the local legal and policy requirements imposed on that data. Most tech giants and cloud providers offer European data residency programs that help customers comply with European local privacy and data protection laws such as GDPR, German federal data protection laws and UK data protection legislation.
In October, developer platform GitHub launched Cloud Data Residency in the EU for customers who subscribe to its GitHub Enterprise Plan. In the same month, Amazon’s cloud computing division AWS launched a “Sovereign Cloud” for Europe, allowing customers to retain all the metadata they created in the EU, and Google introduced data residency for its UK users of Gemini 1.5 Flash. machine learning to process AI models.
Starting Thursday, OpenAI customers using the company's API will have the option to process data for "qualified endpoints" in Europe, while new Chatgpt Enterprise and EDU customers will have the option to store customer content in Europe. Data "stagnant" refers to data that cannot be actively moved between networks or accessed.
OpenAI said that with the help of European data residency, API requests will be processed internally by OpenAI within the region, while data is retained at zero, meaning that AI model requests and responses will not be stored on corporate servers. When OpenAI's AI-driven chat platform, CHATGPT, includes conversations with ChatGpt, user prompts, images, upload files and custom bots (including conversations with CHATGPT), each OpenAI will be stored in the rest of the area .
OpenAI pointed out that as of now, European data residency rights can only be configured for new projects using the company's API. Existing projects cannot be updated to have European residency.
"We look forward to working with more organizations in Europe and around the world while maintaining the highest standards of security, privacy and compliance," the company wrote in a blog post published Thursday.
European data regulators have targeted Openai in the past as what they say may be breaches with local data laws. Spain and Germany and other countries have investigated Openai’s ChatGpt data processing practices, and in December, Italy’s data protection regulator (which briefly blocked Chatgpt a few years ago) fined the company 15 million euros ( $15.6 million), said to have violated European consumer data protection requirements. Where data is stored for AI services has always been a hot issue outside of Openai. DeepSeek is a virus AI startup that operates LLM and chatbots that processes relevant data from its home country, which has attracted the attention of regulators.
Earlier last year, the European Data Protection Commission's working group was a European body, which ensured that the EU always applied data protection rules and released a report in its investigation of ChatGpt to guide data protection authorities in member states. The report covers topics, including the legality of collecting training data for CHATGPT, transparency and data accuracy.