Is ChatGPT confidential? What happens to client data on each plan
It depends on which plan your team uses, what your clients expect and what your own rules say. Here's what OpenAI says about each plan, and what to check.
Last updated October 2026
Consumer plans and business plans work differently
OpenAI describes its retention practices plan by plan. For ChatGPT Free, Plus and Pro, a deleted chat is removed from your account and scheduled for permanent deletion within 30 days, unless OpenAI must keep it for legal or security reasons. For Team, each user controls whether conversations are kept. For Enterprise and Edu, workspace admins control retention. Its enterprise privacy page also says it doesn't train on business data by default. Staff using personal accounts at work are on consumer terms.
Deleted doesn't always mean gone: the court-ordered retention case
In 2025, as part of a lawsuit brought by The New York Times, a court order required OpenAI to preserve consumer ChatGPT and API content, including chats users had deleted. OpenAI says the order didn't cover ChatGPT Enterprise, ChatGPT Edu or API customers using zero data retention, that its obligations under the order ended on September 26, 2025, and that it still stores limited historical user data from April to September 2025 under a legal hold. The lesson for any hosted tool: retention can be changed by litigation, not just by the provider's policy.
Ask five questions of any AI tool
- Is our data used to train models, and can we turn that off?
- How long are prompts and files kept, and who decides?
- Who at the provider can see our conversations, and when?
- Could a court order or subpoena reach what we've entered?
- What do our client agreements and professional rules say about sharing client information with a service provider?
Your obligations travel with the data
A provider's privacy promises don't replace your own duties to clients. Lawyers, for example, have ABA Formal Opinion 512 on generative AI, and a 2026 federal ruling on AI and privilege. Other professions have their own rules; check with your advisor.
Give staff one approved option
The riskiest setup is no policy at all, where staff paste client files into whatever tool they like. Pick an approved tool, write down what may go into it, and tell people. For documents you'd rather never leave your office, private AI on hardware you own is one option.