Which ChatGPT Plan Does My Company Need?

If your staff are using ChatGPT — or thinking about it — you need to know which plan is safe for your business. The answer depends mostly on one question: will anyone use ChatGPT with customer or employee data?

The table below shows where each plan stands on the three questions that matter for most companies.

What this means in practice

If your team only uses ChatGPT for general productivity — writing, brainstorming, summarising public information, learning new topics — a consumer plan (Go, Plus or Pro) is fine, as long as staff are trained not to paste in confidential or personal data.

If your team uses ChatGPT for anything involving customer data, employee data, financial records, or internal documents with personal information — you need a plan on the commercial side of the table. Consumer plans are not legally suitable for this, even if you turn off the training toggle.

Quick guidance by company size

• Small companies (1–20 employees): ChatGPT Business ($25/user/month annually, $30 monthly) is usually the simplest fit. You get the no-training contract, the data protection addendum, and shared workspaces in one subscription. Note that Business does not include single sign-on, audit logs, or data-residency controls — if your customer or employee data must stay inside the EU, you need ChatGPT Enterprise or the API, not Business.
• Medium-sized companies (20–250 employees): Business if your governance needs are light; Enterprise if you need SSO, role-based access, audit logs, or EU data residency.
• Large companies and regulated sectors: Enterprise or a direct API arrangement. Enterprise allows EU data residency, supports advanced governance features, and Zero Data Retention (ZDR) is available on request for eligible API endpoints.
• Educational institutions: ChatGPT Edu is the equivalent commercial plan for schools and universities. It includes the DPA and the no-training contract.
• Developers using Codex (OpenAI's coding agent): Codex inherits the terms of whichever sign-in method is used. Signing in with a ChatGPT account routes through that workspace's plan terms. Signing in with an API key routes through the API organisation's commercial terms. The tool is the same; the legal regime is not.

Footnotes

1. Training. On Free, Go, Plus and Pro plans, a toggle called "Improve the model for everyone" controls whether OpenAI can use conversations for model training. It is turned on by default. Users must actively turn it off (Settings → Data Controls). On commercial plans (Business, Enterprise, Edu, API) training on customer data is contractually prohibited — it is not a setting that anyone can change.
2. Data protection contract. Under EU and Icelandic data protection law, any company that lets a third party handle personal data on its behalf must have a written data protection contract with that third party (known as a Data Processing Addendum, or DPA). OpenAI provides this for Business, Enterprise, Edu and API customers; it includes EU Standard Contractual Clauses with OpenAI Ireland Limited as the contracting party for European customers. It is not available on consumer plans.
3. Safe for customer or employee data. Without the data protection contract, your company cannot show regulators or auditors that it has the required paperwork in place. This matters regardless of whether training is switched off — the legal question is about having the contract, not just about what OpenAI does in practice.
4. EU data residency. OpenAI introduced European data residency for ChatGPT in February 2025, with general availability for business customers expanded throughout 2025–2026. EU residency stores customer content at rest in the EEA + Switzerland region and is available at no extra cost for ChatGPT Enterprise, ChatGPT Edu, and the API Platform. It is not available for ChatGPT Business, nor for any consumer plan (Free, Go, Plus, Pro). Other supported residency regions include the UK, US, Canada, Japan, South Korea, Singapore, India, Australia and the UAE. New workspaces must be configured with the desired residency at creation — it cannot be changed later. Note that residency covers stored content (conversations, files, custom GPTs); some processing may still occur outside the chosen region depending on feature.