OpenAI Zero Data Retention: What It Means for Your Business

On August 19, 2026, OpenAI said it will keep offering zero data retention to eligible API customers — and previewed a way to run safety checks without keeping or reading your data. If your business runs AI tools that touch customer, financial, or employee data, this matters: it's the closest thing to a data-handling promise you can actually check. Under ZDR, OpenAI does not retain your prompts or model responses after a request is processed, personnel can't review the content, and enterprise data is not used for training unless you opt in, per OpenAI's announcement.

Zero data retention, in plain English

ZDR is OpenAI's strongest data-handling commitment for its API: no retention, no personnel review, no training without opt-in. Today it is offered to eligible or approved enterprise customers — not every account, as The Stack notes. Data stays on infrastructure the customer controls — or, in an option OpenAI is developing, on OpenAI infrastructure encrypted with keys the customer holds, so personnel hold no copies. Consumer ChatGPT plans (Free, Plus, Go, Pro) are not part of this, per Axios.

Private Safety Processing: safety checks that don't read your data

The tension has always been: how do you monitor for abuse without storing the data that would reveal it? Private Safety Processing is OpenAI's answer. It is an automated workflow that detects misuse patterns across related interactions without giving personnel access to the underlying content. When a risk is flagged, OpenAI receives only a narrowly defined signal — the type of activity — never the content itself. It's being tested with early customers including Glean, Databricks, Abridge, and Microsoft; a broader rollout and a technical white paper are planned for September, per Best AI Tools. The safety-check layer is coming, but it isn't fully live yet.

What changed for agencies — and what hasn't

What agencies can now promise clients about data handling is more concrete. If a client's account runs on ZDR-eligible models, the vendor can state — backed by OpenAI's own announcement — that prompts and responses are not retained, are not reviewed by personnel, and are not used for training without opt-in. That's a compliance talking point with teeth. What hasn't changed: ZDR eligibility criteria are not fully public; the September rollout is not live; and flagged CSAM images are still retained for review even under ZDR, per MediaNama. So "zero data retention" is now a real question to ask a vendor — not a marketing phrase to assume.

What to ask before you trust a data promise

• Is the account actually ZDR-eligible? Eligibility is limited to approved customers — confirm it in writing, not in a sales call.
• Where does the data live? On infrastructure you control, or on vendor infrastructure encrypted with keys you hold?
• Who can review anything, and when? Personnel should not see content; flagged signals are narrow activity types.
• Is the retention promise in your contract? The same contract terms that govern deliverables should govern data handling.

These are the same questions you'd run through a proper agency security vetting — and why our agency-selection guide tells you to ask, "What's your zero-data-retention policy?" If a vendor or agency can't answer, that's an answer in itself.

If this feels like a lot to track, that's what an AI agency is for: holding vendor relationships, negotiating data terms, and auditing what actually runs on your behalf. Start with an AI agency for your business that treats data handling as a first-class requirement.

Frequently asked questions