This isn't legal advice, just the operator's perspective I use to check AI tools for my own business and real client data. Whether you can use Grok at work in line with the GDPR depends above all on which of four routes you use: the Grok apps, Grok Business, the xAI API or Grok Bot. For the API, xAI writes that it does not train on your inputs and outputs without your explicit permission, but stores them for 30 days by default; with Zero Data Retention for the whole team, that stops. xAI documents a guaranteed processing location only for the US, at a 10% surcharge, and only for two models without tools and files; the regions page names no EU endpoint. On the Grok Imagine page, however, xAI advertises "EU data residency options" without saying how or for whom. Ask about it before you rely on it. According to xAI, Grok Bot runs on computers in Cursor's cloud in the US. For a data processing agreement, xAI's developer docs point to a Data Processing Addendum on its legal pages. I could not open those pages when I retrieved them, so I don't know what it says or which products it covers. Get that confirmed in writing before the first client record goes in. On top of that there are three proceedings against X, the company behind the platform, that concern Grok: two by the Irish Data Protection Commission (DPC) and one by the European Commission under the Digital Services Act. None has found an infringement so far, as of October 26, 2026. Below you'll find a ten-step checklist and a comparison with Claude Team and local models.
In my business, company data runs through Claude Team, because training exclusion and a data processing addendum come with it; how I got to that decision is in Claude Enterprise or Team: Cost and GDPR. I did not test Grok for this article. Everything here comes from xAI's and Cursor's documentation and from the authorities' announcements, retrieved on October 26, 2026. Everything I collect about AI in daily work is on the AI hub.
Four routes to Grok, four sets of data rules
For the apps, one point is easy to miss and important: xAI describes grok.com and the apps as its "consumer-facing" offering. If your team works with private Grok accounts, each person decides for themselves whether the toggle is on. You can only control that centrally with Grok Business: according to xAI, an organization with an enterprise license can disable personal workspaces.
For the API, Zero Data Retention is the strongest lever. xAI itself advises most customers against it, though, because features that need stored data go away: the stateful Responses API, files and collections, the Batch API and stored images and videos. Zero Data Retention always applies to the whole team, not to individual keys. To its own FAQ question of whether xAI is GDPR and SOC 2 compliant, the docs answer only with the SOC 2 Type 2 certification and point to a trust center open to customers with a signed NDA. For the enterprise terms and the Data Processing Addendum, the docs point to the legal pages at x.ai/legal. I could not open those pages, including the privacy policy, when I retrieved them; what they say is therefore not assessed in this article.
With Grok Bot, the weight shifts to Cursor. The computers keep files, browser sessions and anything saved in the browser on a durable disk; according to xAI there is no per-organization retention policy. Cursor chooses the models, including third-party models from Cursor's sub-processor list. If your contract limits which sub-processors may see your data, xAI says to contact your account team before rolling it out.
The ongoing proceedings, in the authorities' own words
All three are directed at X, or rather the Irish X Internet Unlimited Company, not at you as a user. None has found an infringement so far; they are investigations.
On its proceedings the European Commission writes explicitly: "The opening of formal proceedings does not prejudge its outcome." Its page shows a last update of May 26, 2026. In the older December 2023 proceedings that the Commission extended at the same time, it found an infringement on other points (deceptive design, advertising transparency, data access for researchers) on December 5, 2025 and fined X €120 million; that did not concern Grok. The DPC's list of press releases shows no decision in either X inquiry to date.
What the proceedings mean for your company, and what they don't
This is my reading, not legal information.
The proceedings examine what X did as a platform: whether public posts could be used for training and whether X assessed the risks of the image features beforehand. They say nothing about whether your own use of the API or of Grok Bot is lawful; that depends on your contract, your data and your purpose. They still count for your assessment, for two reasons. First, choosing a provider includes how it handles data, and ongoing investigations by the competent authority are a point you should document in your assessment. Second, an outcome can change the picture, so the status of the proceedings belongs on your review list.
Checklist: Grok at work in ten steps
- Pick the route. App, Grok Business, API or Grok Bot? Each has different data rules, see the table above. Best rule out private Grok accounts for company data in writing.
- Classify the data. What should go in: public information, internal texts, personal client data, special categories such as health data? For the first group an internal rule is often enough, for the others it isn't.
- Settle data processing. If the provider processes personal data on your behalf, you need a contract under Article 28 GDPR. Ask which contract applies to your route: xAI points to a Data Processing Addendum at x.ai/legal, and for Grok Bot xAI names Cursor's Data Processing Agreement.
- Check location and transfers. The default API endpoint guarantees no location. The US endpoint guarantees the US for request handling, inference, moderation and retained request data, but only for grok-4.7 and grok-4.6 and not for files, collections or tools such as web search; xAI itself says this is not a comprehensive data residency guarantee. Grok Bot runs in the US. Ask explicitly about the "EU data residency options" the Imagine page advertises: for which products, where, at what price. Transfers to third countries fall under Articles 44 ff. GDPR; ask for the legal basis, such as participation in the EU-U.S. Data Privacy Framework or standard contractual clauses.
- Rule out training. API: no training without permission, so don't grant it; in Grok Build, decline the data retention prompt and turn off code data retention under
/privacy. Grok Bot: turn on Privacy Mode in the Cursor team. Apps: check the "improve the model" toggle in data controls.
- Set retention. API: 30 days by default or Zero Data Retention, with the feature losses mentioned. Grok Bot: files and logins may remain on the computer even if you delete a Bot.
- Read the sub-processors. With Grok Bot, Cursor chooses the models, including third-party ones; the list is in Cursor's trust center. According to xAI, your Cursor team's model allowlist does not govern Grok Bot.
- Limit access. With Grok Bot, all of a user's Bots share one computer including logins; xAI writes that separate Bots are not a security boundary. Set approval rules such as "Ask first" before any external email.
- Document it. Add the processing to your records under Article 30 GDPR and check whether a data protection impact assessment under Article 35 GDPR is needed. That very obligation is part of the DPC's inquiry into X.
- Set a review date. Check the status of the three proceedings, the prices and the data rules every three months; with Grok, plans and products have changed several times in 2026 alone.
My advice: if you can't get steps 3 and 4 answered in writing, no personal client data goes in. How I separate what the AI gets to see before every input is in AI and Privacy: What the AI Gets to See.
Comparison: Grok, Claude Team and a local model
The Claude rows come from Anthropic's documents as of October 26, 2026. What exactly applies to Claude is in Claude Privacy and GDPR: What Applies.
A local model is the only route where the data does not leave the building for the computation. Grok has open weights too: xAI published Grok 1 (March 2024, Apache 2.0) and Grok 2 (August 2025) on Hugging Face, both older generations. How to work locally and what it costs is in Local AI and Privacy: Cloud or Server?, Your Own AI Server: Hardware and Cost and Open Source AI Models Compared. Which open model comes with which license is in Open-Weight Licenses.
Frequently asked questions
Is Grok GDPR compliant?
That can't be answered across the board, and this isn't legal advice. What is documented: xAI does not train on API data without permission, stores it for 30 days by default, names no EU endpoint in its developer docs, points to legal pages for its data processing agreement that I could not open, and Grok Bot runs on computers in the US. Whether that is enough for your case is something to settle with your data protection officer.
What is Grok Zero Data Retention?
A setting for the xAI API under which inputs and outputs are not stored. It applies to the whole team, and an admin turns it on in the console. In return, features that need stored data go away, such as the Batch API, files and collections.
Is there an EU investigation into Grok?
There are three proceedings against X that concern Grok: two by the Irish Data Protection Commission (April 11, 2025 on training with X posts, February 17, 2026 on sexualised images) and one by the European Commission under the Digital Services Act (January 26, 2026). No infringement has been found so far (as of October 26, 2026).
Can I put client data into Grok Bot?
Only once you have settled data processing and the transfer to the US, because according to xAI that is where the computers run, and all of a user's Bots share one computer. Without that, I would only put in public or internal, non-personal data.
How do I delete my Grok account?
Through the account page at accounts.x.ai. According to xAI you also lose API access if you use the same account; you can restore the account within 30 days by logging in again.
Where to go from here
Go through the checklist for the one route you actually want to use and write down the answer and source for each point. Whatever stays open is your list for the conversation with the provider and with your data protection officer. How Grok and Claude differ beyond privacy is in Grok vs Claude 2026: Compared for Work. How I build my AI employees so it is clear which data they see is what I show in my German-speaking community Claude Practitioners.
