Are ChatGPT, Copilot and Mistral GDPR compliant at work?

Learn more about AI implementation in Luxembourg, and for the general GDPR checklist that applies to every AI vendor, see our guide to GDPR-compliant AI for Luxembourg SMEs.

In most Luxembourg companies I visit, staff already use an AI chat assistant every day. The question is which one, on which account. Usually it is a mix: Microsoft 365 Copilot for some, a personal ChatGPT account for others, Mistral's Le Chat for the French speakers, Claude for whoever discovered it first. The data protection question is not "is this tool allowed?" but "is this plan, on this contract, with these settings, allowed?".

I set up and configure these assistants for Luxembourg SMEs at 20 More. This guide sticks to the employee-facing chat assistants, not the developer APIs, and to what an administrator has to check. If you are choosing between models on quality, our model comparison covers that; for API and cloud-region options, see AI as a service: what to check.

Which plans are business plans, and do they train on your data?

The line that matters is not the brand but the terms. Consumer plans are contracts with the individual employee. Business plans are contracts with your company, and that is what makes an Article 28 agreement possible. As documented by each vendor on 9 October 2026:

Two notes. Mistral renamed Le Chat to Vibe in 2026; accounts, conversations and plans carried over (Mistral Help). And on several services, feedback is the exception to "no training": Mistral's DPA lets it use a thumbs-up or thumbs-down with its input and output (Mistral DPA), and Anthropic says the same for explicit feedback (Anthropic Privacy Center). Tell staff not to rate conversations that contain personal data.

Where is the data stored and processed?

This is where the business plans differ most, and where the default is not always the EU. As documented by each vendor on 9 October 2026:

Non-EU processing is not automatically unlawful. Transfers to the United States can rely on the EU–US Data Privacy Framework, adopted on 10 July 2023 (European Commission) and upheld by the General Court on 3 September 2025 in Latombe (T-553/23, CJEU), or on standard contractual clauses under Chapter V of the GDPR (GDPR). An appeal is pending, so keep the clauses in the contract as a fallback. What you cannot do is ignore the question: the transfer has to be documented.

Mistral and GDPR: is the European option automatically compliant?

Mistral is the question I get most from German-speaking clients, and the answer is "the best starting point, not the finish line". Mistral AI is a French company, and Le Chat data is hosted in the EU by default (Mistral Help). That removes most of the transfer analysis. It does not remove the rest:

• Plan. Free and Pro train on inputs and outputs unless the user opts out (Mistral Help). Company data belongs on Team or Enterprise.
• Training toggle. On Team, the administrator can disable training for the whole organisation in the admin panel; Enterprise is opted out by default (Mistral Help). Check it rather than assume it.
• DPA. Mistral's DPA applies when it processes personal data for you under its commercial terms (Mistral Commercial Terms). Download it and file it with your records.
• Retention. Conversations are removed after manual deletion or account deletion, subject to a short grace period and legal retention (Mistral Help); zero data retention is not available for the chat product (Mistral Help). Decide how long staff should keep conversations, and tell them.
• Connectors. Connecting Le Chat to email, Drive or SharePoint widens what it can see; Mistral documents how to control and delete data from third-party tools (Mistral Help).

The Luxembourg data protection authority made the same point in its note on DeepSeek: prefer AI tools that follow the European framework (GDPR and AI Act), do not enter personal or confidential data into tools without adequate safeguards, and make staff aware of the risks (CNPD). Mistral fits the first recommendation. The other two are still your job.

The 8-point configuration checklist

This is the list I work through before an assistant goes live. It applies to all four.

On point 7: if management intends to review employees' prompts to check their work, that is a different purpose from running the tool, and Article L.261-1 of the Code du travail on workplace monitoring comes into play. Our guide to AI meeting note-takers and workplace monitoring explains that procedure.

On point 8: Article 4 of the AI Act has applied since 2 February 2025 to every deployer whose staff use AI (AI Act Service Desk). The Digital Omnibus changed its wording in 2026 but kept the duty; our Article 4 guide explains what is expected now.

What goes into a one-page AI usage policy?

Long policies do not get read. The version that works for the SMEs I work with fits on one page and answers six questions:

1. Which tools are approved? Name them and the plan: "Microsoft 365 Copilot and Mistral Team, with your company login". Everything else, including personal accounts of the same tools, is not approved for company data.
2. What may be pasted? Use three levels:

3. Who checks the output? The person who uses it. AI answers are drafts; anything sent to a client or used in a decision about a person is reviewed by a human first.
4. What about shadow AI? Browser extensions, meeting bots and "free trials" connected to a work account are not allowed without IT approval. Say why: they process company data under terms nobody signed.
5. What if something goes wrong? Someone pasted a client file into a personal account: report it to the DPO or manager the same day. A personal data breach may have to be notified to the CNPD within 72 hours (GDPR Art. 33, GDPR), so speed matters more than blame.
6. Who owns the policy? One named person, a review date, and a link to the short training.

This page doubles as the core of your staff information and of your AI literacy evidence.

Frequently asked questions

Is ChatGPT GDPR compliant for business use?

ChatGPT Business and Enterprise can be used in a GDPR-compliant way: OpenAI does not train on business data by default, offers a DPA, and lets admins control retention. EU data residency is available for ChatGPT Enterprise and Edu, while for ChatGPT Business it is rolling out and covers storage only. The Free and Plus plans run on consumer terms and should not be used for company or client data.

Is Mistral le chat GDPR compliant?

Mistral's Le Chat (now called Vibe) is hosted in the EU by default, which makes it one of the simplest assistants to document under the GDPR. Use the Team or Enterprise plan, confirm training is switched off for the organisation, and file Mistral's DPA. The Free and Pro plans train on conversations unless the user opts out.

Is Microsoft 365 Copilot GDPR compliant?

Microsoft 365 Copilot is covered by Microsoft's Data Protection Addendum and is an EU Data Boundary service, and prompts are not used to train foundation models. Check two settings: flex routing, which can move inference outside the EU at peak load and is on by default for eligible tenants created after 25 March 2026, and Anthropic models, which are excluded from the EU Data Boundary. Web search queries generated by Copilot are not covered by the DPA.

Is Claude suitable for a European business?

Claude Team and Enterprise run under Anthropic's commercial terms: no training on your data by default and a DPA with standard contractual clauses. Anthropic's own apps do not offer EU data residency, so data is stored in the US and transfers rest on those clauses. If you need Claude in an EU region, that is only possible through Amazon Bedrock or Google Cloud Vertex AI, not through the Claude app.

Mistral or Claude: which is better for a European company?

On data location, Mistral is simpler: EU hosting by default and a European provider. On output quality, Claude is our own first choice for careful drafting and document analysis, but the gap on your documents matters more than any ranking, so test both on real work. A sensible split is Mistral for work involving client personal data and Claude for internal drafting, with the usage policy deciding which data goes where.

If you want a second opinion on the plan and settings of the assistant your team already uses, tell us which one and how it is configured. Configuration and policy work often qualifies for Luxembourg co-funding: check in two minutes.