OpenAI Data Residency in Asia

OpenAI has launched data residency options in Japan, India, Singapore, and South Korea for ChatGPT Enterprise, ChatGPT Edu, and the API Platform. This update allows organizations to meet local data sovereignty requirements while utilizing OpenAI's AI services.

Data Residency Availability and Implementation

Eligible customers can now choose to have their customer content stored at rest in supported Asian countries. The implementation differs by product:

ChatGPT Enterprise and Edu

New ChatGPT workspaces can be configured with data residency, ensuring that customer content—including user prompts, uploaded files, and content across text, vision, and image modalities—is stored at rest within the region. This includes conversations with ChatGPT and custom GPTs within the Enterprise or Edu workspace.

API Platform

Eligible API customers can enable data residency by creating a new Project in the API Platform dashboard and selecting the relevant country. Currently, data storage for the API platform is stored in the selected region.

Enterprise-Grade Privacy and Security Standards

Data residency is an extension of OpenAI's existing security and compliance framework. The following protections apply to all business products:

  • Encryption: OpenAI uses AES-256 for data at rest and TLS 1.2+ for data in transit between customers, OpenAI, and service providers.
  • No Training on Customer Data: By default, OpenAI does not train its models using data from the API or ChatGPT business plans unless the customer explicitly opts in.
  • Compliance Standards: Data protection practices are designed to support compliance with GDPR, CCPA, and other privacy laws, and adhere to SOC 2 Type 2 and CSA STAR standards.
  • Data Processing Addendum (DPA): OpenAI provides a DPA to clarify roles and responsibilities under privacy regulations such as GDPR.

Data Ownership and Control

For the API Platform and ChatGPT business products, OpenAI maintains that data remains confidential, secure, and entirely owned by the customer. The introduction of data residency in Japan, India, Singapore, and South Korea provides these organizations with additional control over where their data is stored at rest.

Sources