In short
None of the countries in this article bans ChatGPT or Claude for business use. What they regulate is the transfer: an API call that contains a customer's name, phone number or order history sends personal data to a provider whose servers sit in the United States. Each country asks the same three questions in its own way:
- On what legal basis does the data leave the country?
- Who processes it, and under what contract?
- Where does the master copy of the data live?
The answers differ a lot. In the EU and Moldova it is mostly paperwork. Turkey wants a fixed-text contract filed with the regulator within five business days. Georgia and Armenia fall back on consent or a regulator's permit. Kazakhstan wants the database at home and consent for the transfer. Below is how each regime works and the setup we use so a support agent or an internal assistant stays on the right side of it. Everything here reflects the state of the law on 29 October 2026; have a local lawyer sign off on the final design.
Pick the right ChatGPT or Claude first
The legal question only makes sense once the product tier is fixed, because the tier decides training and retention.
| Product | Trained on your data by default | Notes |
|---|---|---|
| ChatGPT Free, Plus, Pro | Yes, unless the user turns off "Improve the model for everyone" | Personal accounts, no company control |
| ChatGPT Business, Enterprise, OpenAI API | No | API abuse logs kept up to 30 days; zero retention on approval |
| Claude Free, Pro, Max | The user chooses | Personal accounts |
| Claude for Work, Claude API | No | Commercial terms and DPA apply |
The OpenAI side is documented in OpenAI's API data controls and its consumer help article. The practical rule follows directly: customer data never goes into an employee's personal account, whatever the local law tolerates.
Location matters too. OpenAI offers European data residency for new API projects. Anthropic's first-party API processes requests globally or in the US, and has no EU option (Claude data residency docs); Claude in an EU region is available through AWS and Google Cloud. For countries that treat the EU as a safe destination and the US as not, that choice alone settles much of the question.
The EU: processor contract and SCCs
Under GDPR the business is the controller; the model provider and any integrator are processors. You need an Article 28 data processing agreement with each. A transfer to a country without an adequacy decision runs on the Commission's standard contractual clauses (Decision 2021/914). Anthropic builds Modules 2 and 3 into its DPA; OpenAI has its own DPA. An integrator outside the EU who can see production data is itself a third-country recipient and signs SCCs too.
Neither OpenAI nor Anthropic appeared on the official EU-US Data Privacy Framework participant list when we checked on 29 October 2026, so the SCCs are what carry the transfer. If the client insists that data never leaves the EU, use an OpenAI project with European residency or Claude through an EU cloud region.
EU customers bring a second law with them: from 2 August 2026 a chatbot must tell people they are talking to AI. We cover that in EU AI Act Article 50 for chatbots.
Moldova: GDPR, transposed
Law No. 195/2024 on personal data protection took effect on 23 August 2026 (National Center for Personal Data Protection). It follows GDPR closely: processor contracts, records of processing, breach notification. Transfers to countries without adequate protection need a standard contract, and the regulator has drafted one modelled on the EU SCCs; we could not confirm by the end of October whether it has been adopted. Treat a Moldovan project like an EU one and keep the data in an EU region.
Turkey: a fixed contract and a five-day filing
Since the 2024 amendments, Article 9 of KVKK Law No. 6698 sets a ladder for transfers abroad (official text):
- An adequacy decision for the destination country.
- Appropriate safeguards, in practice the KVKK standard contract, which cannot be edited and must be notified to the Authority within five business days of signing.
- Occasional transfers under listed exceptions, including explicit consent after the person is told about the risks.
The third step is for one-off cases. A support agent that streams every conversation to an API is a regular flow and needs the standard contract. Whether OpenAI or Anthropic will sign the Turkish text depends on your contract with them. Until that is settled, we send the model text with names, phone numbers and TCKN numbers masked, and keep the database with the client in Turkey.
Israel: an onward-transfer undertaking
Amendment 13 to the Privacy Protection Law took effect on 14 August 2025. It widened the definition of personal data and gave the Privacy Protection Authority power to fine without going to court. Transfers abroad fall under the 2001 transfer regulations: a country without equivalent protection is allowed, among other routes, when the recipient contractually undertakes to meet Israeli conditions. In April 2026 the Authority spelled out what that undertaking must contain: use only for the original purpose, the data subject's right to see and correct the data, confidentiality, and security under the 2017 data security regulations or ISO/IEC 27001 (PPA position on gov.il, in Hebrew).
The Authority's 2025 draft guidance on AI also expects a bot to say it is a bot. We have not seen a final version, but we build the disclosure into Israeli projects from day one, in Hebrew and Russian alike.
Georgia: consent with a warning, or a permit
Georgia's Law on Personal Data Protection, in force since 1 March 2024, is close to GDPR (matsne.gov.ge). Transfers go freely to countries on the Auditor General's adequacy list (Article 38). By our reading, the 2024 list covered the EEA but not the US; a new order replaced it in April 2026 and we could not confirm whether the US was added. For other destinations, Article 37 offers two practical routes: written consent after the person is told about the missing safeguards, or a contract plus a permit from the supervisory authority, which has been the State Audit Office since March 2026. If collecting consent in the chat is awkward, processing in an EU region avoids the problem.
Armenia: consent, a country list, and a grey zone
Article 27 of Armenia's 2015 data protection law allows transfers with the person's consent or where the transfer follows from the purpose of processing. Countries on the Agency's list need no permit; for the rest, the Agency must approve the safeguards, with a 30-day review (arlis.am). The text does not settle whether consent alone covers a country off the list. We mask data before it reaches the model and leave the consent-versus-permit call to Armenian counsel.
Central Asia and Azerbaijan
Kazakhstan. Law No. 94-V requires personal data to be stored in a database located in Kazakhstan (Article 12(2)) and allows transfers to countries without adequate protection only with consent or in a few special cases (Article 16). Since 2022 the consent itself must say whether data goes abroad (text on adilet.zan.kz). In practice: CRM, conversation logs and agent memory sit on a server in Kazakhstan, consent names the foreign AI provider, and the model sees only the text it needs.
Uzbekistan. Law ZRU-1125 of March 2026 dropped general data localization: only biometric and genetic data and telecom subscriber records must stay in the country (lex.uz). Everything else may go abroad to a country on the government's list, under standard contractual clauses or binding corporate rules, or under an approved international standard. The list, Cabinet Resolution No. 415 of July 2026, names 49 countries including the whole EU; the US is included only for companies in the Data Privacy Framework (lex.uz). Since neither OpenAI nor Anthropic is on that list, a direct US API call does not qualify, while processing in an EU region does. Voice recordings may count as biometrics, so we hold off on call analytics through foreign APIs until local counsel has looked at it.
Kyrgyzstan. The Digital Code of 31 July 2025 replaced the 2008 data law on 5 February 2026. Its Article 89 allows transfers to countries without adequate protection with the person's consent, to perform a contract the person is party to, or under a processor contract on terms the regulator has yet to publish (text of the Code). Article 86 bars a processor from engaging a sub-processor without the owner's prior written permission, so an integrator needs that permission in writing before plugging in OpenAI or Anthropic.
Azerbaijan. The 2010 Law on Personal Data prohibits transfers to countries with weaker protection (Article 14.2.2) but allows them with the person's consent regardless (Article 14.3), and information systems holding personal data must be state-registered (Article 15) (e-qanun.az). Retail and services can work with consent plus registration; banks and insurers usually end up with a model inside their own perimeter.
Russia is a separate case: Federal Law 152-FZ requires Russian citizens' data to be stored in Russia, and OpenAI and Anthropic do not serve Russian users at all. Russian companies use domestic or self-hosted models.
How we set up a project
The country rules differ; the controls we put in place barely do.
- Disclosure and consent. The bot's first message and the website form say that answers are prepared by AI and that conversations are processed by a named provider abroad. We store when consent was given and which version of the text the person saw.
- Contracts. We sign a processor agreement with the client: purposes, data categories, retention, sub-processors, breach handling. API keys and the provider account belong to the client, so OpenAI or Anthropic contract with the client directly and we keep only technical access.
- Data location. CRM, conversation history, knowledge base and logs stay where the law points: in Kazakhstan for Kazakh clients, in an EU region for EU, Moldovan and Georgian clients, with the client in Turkey. The model gets a request, never the database.
- Masking. Names, phone numbers, emails, national ID numbers (IIN, PINFL, TCKN, Teudat Zehut), passport and card numbers are replaced with placeholders before the request leaves, and restored in the answer on your side. Health and financial data go to the model only after a separate review, and often not at all.
- Tests. The agent's eval set includes customers who paste a passport scan or a card number unprompted, and we check that masking caught it and that nothing leaked into logs. More on that in why AI projects need evals.
The same pattern sits under the Magnum knowledge base assistant: documents and access rights stay with the company, and the model sees only the passage it needs for an answer. If you want this built for your support channel or documents, see AI agents and the AI document assistant. For teams that already paste work into ChatGPT on their own, corporate AI training closes the most common leak.
FAQ
Into a personal account, no company should do it: you control neither training, nor retention, nor who sees the history. Through the API or ChatGPT Business it can be lawful, provided the country has a transfer basis you meet, the master data is stored where the law requires, and the model receives only the fields it needs.
Yes, when the request contains personal data and the provider processes it in another country. Text with names, phone numbers and ID numbers removed is not personal data in most of these regimes, which is why masking before the call does most of the compliance work.
Under GDPR, consent can justify an occasional transfer, not a continuous stream from a production chatbot. The normal route is a processor agreement plus standard contractual clauses, or keeping processing in an EU region.
Not by default. OpenAI does not train on API, Business or Enterprise data, but keeps API abuse-monitoring logs for up to 30 days unless zero data retention is approved. Anthropic's commercial products follow the same default on training.
Run an open-weight model on your own server or with a cloud provider in that country. It works for support and document search, at the cost of more engineering on quality and more hardware. It is the right answer for banks, the public sector and healthcare, not for every bot.
Sources
- Republic of Kazakhstan, Law No. 94-V on Personal Data and Their Protection, 2013 as amended in 2026: in-country storage, transfer abroad with consent, cross-border transfer named in the consent.
- Republic of Uzbekistan, Law ZRU-1125, 2026: localization limited to biometric, genetic and subscriber data; conditions for transfers abroad.
- Cabinet of Ministers of Uzbekistan, Resolution No. 415, 2026: list of 49 countries, US only for Data Privacy Framework participants.
- Republic of Türkiye, KVKK Law No. 6698, as amended in 2024: standard contract and notification within five business days.
- OpenAI, Data controls in the OpenAI platform, 2026: no training on API data by default, 30-day abuse logs, zero retention on approval.
- Anthropic, Data residency, 2026: first-party API processes globally or in the US, no EU region.