7 Steps: Zero Data Retention in OpenAI API for SMEs

On August 19, OpenAI announced the Zero Data Retention (ZDR) mode for select API customers. An API is a way for programs to communicate with each other. For SMEs, it’s a straightforward answer to the concern: 'Will customer data be used to train models?' Here are 7 no-code steps, plus metrics and ready messages.

What is Zero Data Retention and Does it Apply to You?

Zero Data Retention (ZDR) is a mode where the provider does not store your data after processing a request and does not use it for training models. Think of it like a conversation that no one records.

ZDR applies to using OpenAI through an API (an interface for communication between programs) and is available for eligible customers and selected top-tier models. Check your account panel and the DPA (Data Processing Addendum) or contact support.

Conclusion: ZDR significantly reduces risk, but it doesn’t replace common sense. Only send AI what is truly necessary.

7 No-Code Steps: From ZDR to 'Almost ZDR'

Below is a checklist for implementation within a week. Use the OpenAI panel and no-code tools: Zapier, Make, or n8n (applications for connecting services into automations without programming).

• 1) Define the scope and minimum data. Map out flows: which processes go through OpenAI, what fields are sent. The principle of minimization: if a field is not needed for the response, remove it.
• 2) Enable ZDR in OpenAI. Check the option in the panel or contact support to activate ZDR for specified projects and models. Request written confirmation and update the DPA/data processing register.
• 3) Mask data (pseudonymization). Replace names, emails, ID numbers, or phone numbers with placeholders, e.g., '[U1]', before sending content to OpenAI. In Zapier/Make/n8n, use actions like Replace/Formatter. Keep the map
• '[U1] → John Doe' solely in your CRM, not in automation logs.
• 4) Separate and rotate API keys. An API key is a password for a service. Use a separate key for each process/team/environment. Store it in a secrets manager and rotate it every 30-90 days. In Zapier/Make, add separate 'z
• accounts' instead of one shared key for the entire company.

Metrics: Is Cost Decreasing and GDPR Risk Lowering?

ZDR itself does not change pricing, but better data hygiene usually reduces repeated requests and errors. Therefore, measure cost not 'per call,' but per successful task (a result accepted by the user or passed a test).

Record the 'before' state, enable ZDR and masking, and compare results after a week. A simple scoreboard will suffice.

• Cost/successful task (currency). Goal: decrease or stabilize with the same SLA.
• Percentage of requests containing personal data. Goal: clear decrease after masking.
• Log retention in each tool (days). Goal: 0-7 days, according to policy.
• Number of people with access to logs. Goal: only 'need-to-know' roles.
• Incidents and privacy requests (monthly). Goal: 0.

Ready Messages for the Team and Providers

Copy and adapt. Simple, without jargon. This way, everyone knows what to do.

• To the team (email/Slack): Starting today, integrations with OpenAI will operate in Zero Data Retention mode (data is not stored or used for training). What we are changing: 1) we mask names, emails, and phone numbers as
• placeholders, 2) we do not input full data in prompts (prompt = command to AI), 3) we use new, separate API keys. Where to ask: #ai-zdr. Deadline: by Friday.
• To the no-code tool provider: Please confirm: 1) whether the connector to OpenAI supports Zero Data Retention, 2) where and how long request/response logs are stored, 3) who has access to them, 4) whether you have data-m
• asking options before sending to OpenAI, 5) how to report an incident and what SLA applies. Please respond by [date].

ZDR is a quick way to reduce risk without slowing down work. Start by enabling the mode in OpenAI, then add masking, separate keys, and log control. If you’d like, we can walk through this with your team in a 90-minute consultation—no slides, just your real workflows.