OpenAI Launches ChatGPT Library Auto‑Storage Feature, Raising Data Residency and Retention Concerns
What Happened — OpenAI has rolled out a new “Library” feature for ChatGPT that automatically stores any files or images users upload during chats in a dedicated cloud location. The feature is enabled by default for Plus, Pro, and Business subscribers worldwide, excluding the European Economic Area, Switzerland, and the United Kingdom. Files remain in the Library until the user manually deletes them, and deletions are purged from OpenAI’s servers up to 30 days later.
Why It Matters for TPRM —
- Introduces a persistent data‑at‑rest repository that may contain sensitive corporate documents, increasing exposure to data‑privacy and residency regulations.
- Retention lag of up to 30 days could conflict with contractual data‑deletion obligations or industry‑specific record‑keeping rules.
- Lack of availability in the EEA/UK signals potential compliance gaps for organizations bound by GDPR or UK‑GPA.
Who Is Affected — SaaS‑dependent enterprises across all sectors (technology, finance, healthcare, manufacturing, etc.) that integrate ChatGPT into workflows, as well as third‑party vendors that rely on OpenAI’s API for document processing.
Recommended Actions —
- Review your organization’s data‑handling policies to determine if auto‑saved files constitute personal or regulated data.
- Verify that OpenAI’s data‑residency commitments align with your contractual and regulatory requirements; consider supplemental safeguards for non‑EEA users.
- Update vendor risk assessments to include the Library’s retention schedule and deletion process.
- Enable strict access controls and monitor Library activity via audit logs where available.
Technical Notes — The Library automatically captures uploaded files (documents, spreadsheets, presentations, images) and stores them in a secure OpenAI‑managed location. Deleting a chat does not remove the file from the Library; manual deletion is required, after which OpenAI retains the file for up to 30 days before permanent removal. The feature is not offered to users in the EEA, Switzerland, or the UK, likely due to differing data‑privacy regimes. Source: BleepingComputer