AI and privacy
Claude, Microsoft Copilot, Gemini and Mistral Vibe alongside ChatGPT Business: training, agreements, data location and administration. October 2026.
That depends on where your data may be held and which office software you already use. If you work in Microsoft 365, Copilot is an obvious choice; in Google Workspace, that is Gemini. If you want storage in the EU by default, Mistral Vibe is the option. Claude Team is the alternative most similar to ChatGPT Business.
People looking for a ChatGPT alternative are rarely looking for a better model. Usually, the question is which assistant they are allowed to use at work. This article therefore does not compare the quality of answers. It compares five business subscriptions on four questions that matter for the GDPR: training on input, the data processing agreement, data location and administration.
Everything below reflects October 2026, based on the providers' own documentation read on 13 October 2026. Terms change several times a year. Where the documentation provides no answer, the text says “check”. We leave out prices. This is an explanation, not legal advice; the overview of chatbots and the GDPR is on ChatGPT, Claude, Mistral Vibe and the GDPR.
An overview of European providers, including Lumo and DeepL, is in European AI: alternatives to ChatGPT compared. DeepSeek and the GDPR covers an assistant from China.
Personal subscriptions, whether free or paid, are also excluded. There the employee is the customer rather than the organisation, and there is no data processing agreement. This is explained for each subscription in ChatGPT Free, Plus, Business or Enterprise: which subscription may you use for business?.
Is what you type and upload used to improve the model? On business subscriptions, the answer is usually “not by default”. Watch for exceptions: feedback you submit yourself, and switches an administrator can change.
Article 28 of the GDPR requires an agreement with every party processing personal data on your behalf. Does it apply automatically or must you request it, and for which subscriptions? What to look for in the wording is explained in A data processing agreement with OpenAI, Anthropic, Microsoft or Mistral: what should you check?.
Where are conversations and files stored, and where does the model run? Those are two questions. If data is held or processed outside the EEA, Chapter V of the GDPR applies: the transfer must rest on an adequacy decision (Article 45) or appropriate safeguards such as standard contractual clauses (Article 46), and you document it in your record of processing activities.
Can the organisation issue and revoke accounts, set retention periods and see what happens? Without administration, you do not know what is held when a request for access or erasure arrives.
As of October 2026, based on the pages linked in the sections below. “Check” means the documentation does not give an unambiguous answer: ask the provider or read the agreement.
| Provider | Business subscription | Training on input | Data processing agreement | Data location |
|---|---|---|---|---|
| ChatGPT (OpenAI) | Business; Enterprise | Not by default, unless you choose to share | Yes, on request through a form | Business: no choice. Enterprise: regional choice, including Europe; not everything is covered |
| Claude (Anthropic) | Team; Enterprise | No, unless you opt in; submitted feedback may be used | Yes, automatically part of the business terms | Storage in the United States; processing may span several regions |
| Microsoft Copilot | Licence alongside Microsoft 365 | Not for training foundation models | Yes, the Microsoft 365 agreement applies | Within the EU Data Boundary for EU customers; Anthropic models fall outside it and are disabled by default in the EU |
| Gemini in Google Workspace | Workspace edition with Gemini; check which edition | Not without the customer's permission or instruction | Yes, the Workspace data processing agreement applies | Regional choice (US or Europe) for storage; processing within the region only on the highest editions |
| Mistral Vibe (Mistral) | Team; Enterprise | Enterprise: not by default. Team: the administrator can disable it; check the default setting | Yes, part of the agreement; check which subscriptions | In the EU by default; temporarily outside it for some features |
Anthropic says of its business products, including Team and Enterprise, that conversations are not used to train models, unless the customer opts in. The page mentions two exceptions: a developer programme you sign up for, and material you report yourself, for example through a thumbs up or down.
You do not need to request the data processing agreement. According to Anthropic, it is automatically included in the business terms, along with standard contractual clauses.
The page on server locations says data is stored in the United States. Traffic may be routed through several continents. There is therefore a transfer you need to justify and document.
According to Claude's pricing page, Team offers SSO sign-in, central administration and connection management. Audit logs and custom retention periods are listed under Enterprise. The details for each subscription are in Claude AI and the GDPR: is Claude safe for business use?.
Copilot is a layer over your Microsoft 365 environment. Microsoft says prompts, responses and data from your environment are not used to train foundation models. They are processed and stored under the agreements that already apply to your other content in Microsoft 365. Microsoft's existing product terms and data processing agreement apply.
For EU customers, the same page describes Copilot as a service within the EU Data Boundary: traffic from the EU stays within that boundary. Administrators can set retention periods for Copilot conversations and search stored conversations.
Google says in its privacy hub for generative AI in Workspace that prompts count as customer data under the Workspace data processing agreement, and that Workspace does not use customer data to train models without the customer's prior permission or instruction. According to the page, content is not reviewed by people. This applies only to an edition Google designates for that purpose.
Workspace offers a regional choice: the United States, the European Union or no preference. The overview of data covered by data regions lists Gemini prompts and responses. Storage in the selected region is available on more editions, including Business Standard and Business Plus. Processing within the region is available only on the highest editions or with an add-on. Logs and temporary copies are excluded.
Gemini Notebook, until recently NotebookLM, does not follow the regional choice. The privacy hub explicitly says sharing and regional settings do not apply there, because the notebook makes its own copy of your files. More is explained in NotebookLM and the GDPR: may you put business documents in it?, and about Gemini itself in Google Gemini and the GDPR: is Gemini safe for business use?.
For anyone wanting storage in the EU by default, Mistral Vibe is the clearest answer. Mistral says data is hosted in the European Union by default. The same page sets out the limits: depending on the feature, data may temporarily leave the EU for sub-processors listed in Mistral's Trust Center, and only Enterprise customers can disable some of those features.
The page on opting out of training says Enterprise customers are opted out by default. With Team, the administrator can disable training for the whole organisation. The page does not say what Team's default setting is. Open the administration screen and check the switch under privacy.
Mistral's data processing agreement forms part of the customer agreement. The text does not name subscriptions: check your own terms to see whether it applies to your subscription. The rest is in Mistral Vibe and the GDPR: is a European chatbot automatically safe?.
On its Enterprise privacy page, OpenAI says data from ChatGPT Business and Enterprise is not used to train models by default, and that it can enter into a data processing agreement. You request it through a form. Administrators of a Business workspace can view, export and delete users' conversations.
Business offers no regional choice. The page on data residency for ChatGPT lists new Enterprise and Edu customers and certain API customers. Europe is one of the regions, while account data, metadata and anything sent to third parties through connections are excluded.
As of October 2026. Administration varies considerably by edition.
| Provider | What the documentation says about administration | What to ask about |
|---|---|---|
| ChatGPT Business | Workspace with administrators who can view, export and delete conversations | SSO sign-in and custom retention periods: check |
| Claude Team | SSO, central administration, connection management | Audit logs and custom retention periods belong to Enterprise |
| Microsoft Copilot | Administration in the Microsoft 365 admin centre, retention policies and conversation search | Whether your SharePoint permissions are in order |
| Gemini in Google Workspace | Administrators determine whether conversations are retained and for how long; notebook enabled or disabled per group | Which edition you have and what it covers |
| Mistral Vibe Team | Administration screen with a switch for training | SSO, logs and retention periods: check |
Tell employees beforehand what administrators can see.
Changing providers means changing your contracting party. Everything else comes with you.
PrivaSearch is not an AI assistant and therefore not an alternative to any of the five. It addresses the point that remains with every provider: what is entered. Instead of uploading a client file, you let an assistant search passages from which personal data has already been removed.
Documents are analysed within PrivaSearch, without an external AI provider. Detected data is replaced with pseudonyms that stay consistent within a project. A colleague checks the result alongside the original and approves it; until then, a document is not searchable. See How PrivaSearch works.
You can then search in PrivaSearch itself or through a connected assistant. The connection uses the open MCP standard and works with Claude, ChatGPT Business and Mistral Vibe. The assistant receives only released, pseudonymised passages with a short source reference, and no files. What it receives becomes part of the conversation at that assistant's provider, and anything you type yourself goes there directly. A business subscription with a data processing agreement therefore remains necessary, whichever of the three you choose.
If you do not want an external assistant, you can search in PrivaSearch itself. The sub-processor overview sets out which parties are involved at each stage; the principles are on Hosting in the EU.
Pseudonymisation is not anonymisation: for your own organisation, it remains personal data. Choosing the provider, maintaining the record and carrying out the DPIA therefore remain your work. To see how this works alongside your current assistant, book a demo.
There is no single answer. Searching for “ChatGPT alternative” brings up four serious options: Claude Team, Microsoft Copilot, Gemini in Google Workspace and Mistral Vibe. Which fits depends on your office software and where your data may be held. Copilot and Gemini are covered by the agreement you already have, Mistral Vibe hosts in the EU by default, and Claude Team is most similar to ChatGPT Business.
According to its own documentation, Mistral Vibe hosts in the EU by default, with exceptions per feature. Microsoft Copilot falls within the EU Data Boundary for EU customers, except for Anthropic models. Gemini in Google Workspace offers a regional choice, with processing within the region applying only to the highest editions. Claude stores data in the United States. This reflects October 2026.
Not by default on a business subscription, according to the providers themselves. OpenAI, Anthropic, Microsoft and Google say business input is not used for model training unless the customer opts in. At Mistral, Enterprise is opted out by default and the Team administrator can disable it. Personal subscriptions are different: input may be used for training there.
There is no one-word answer. Copilot falls under the agreement your organisation already has with Microsoft and processes EU customers' data within the EU Data Boundary. On the other hand, Copilot can show everything an employee may open, including content shared too widely. The risk therefore shifts from the provider to your own permissions management.
For work without personal data, you may, if your own policy allows it. For client or employee data, no. A free or personal account has no data processing agreement, the organisation has no administration and input may be used for training. This applies to every provider, including European ones.
No, not automatically. A provider hosting in the EU reduces the transfer question. Lawful basis, data processing agreement, data minimisation, retention period and documentation in your record of processing activities remain the same. No product arranges that for you. Assessing your own situation remains your responsibility and your data protection officer's, with a lawyer if needed.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
How schools use AI, why pupil data receives extra protection, which applications are prohibited or high risk, and what a school needs to arrange.
What ChatGPT stores, who can access it, how to turn off training, and what temporary chats, memory and shared links do. Includes a practical checklist.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →