Field note
ChatGPT Delete vs Archive: Retention at Work
Archiving a ChatGPT chat only hides it, deleting it starts a retention clock, and neither one removes saved memories, project files or records created in connected apps.
Archiving a ChatGPT chat only hides it, deleting it starts a retention clock, and neither one removes saved memories, project files or records created in connected apps.
What archive and delete actually do
Archive is a tidy-up control. The chat disappears from the sidebar and moves to an archived list in settings. Nothing is deleted. You can restore it, and anyone with access to the account can still open it.
Delete is a lifecycle action. The chat leaves your history straight away. At the time of writing, OpenAI states that deleted conversations are scheduled for permanent removal from its systems within 30 days, unless it must keep them for legal or safety reasons. The current wording lives in the OpenAI Help Centre article on chat and file retention, and it changes, so check it rather than relying on a screenshot from last year.
Two more points catch people out. Temporary Chats are not saved to history, but OpenAI may keep a copy for a limited period for safety review. And on Business and Enterprise workspaces the admin can set retention rules that override what a single user sees.
Why this matters for a UK small business
Picture a six-person accountancy practice. A junior pastes a client's payroll export into ChatGPT to draft a query, gets the answer, and archives the chat because "it's done". Six months later the client sends an erasure request. The practice manager searches shared drives and email, confirms deletion, and signs the response. The payroll data is still sitting in an archived chat on a personal ChatGPT account.
That is a storage-limitation problem under UK GDPR before it is an AI problem. The ICO expects you to know where personal data lives, to keep it no longer than needed, and to be able to erase it when you no longer have a reason to hold it. "We archived it" does not meet that bar.
The five stores you have to check separately
- Chats. Active and archived conversations. Deleting one chat does not touch the others, and "delete all" is a separate action.
- Memory. ChatGPT can save facts it learns about you across chats. Deleting the chat where a fact was learned does not delete the memory. Memories are managed on their own settings page.
- Files. Uploads attached to a chat go with the chat. Files added to a Project stay with the Project until it is deleted. Files ChatGPT generated and you downloaded are now on your device or in OneDrive, outside ChatGPT's retention entirely.
- Connected apps. If a chat used a connector or app to create a calendar entry, a document, an email draft or a ticket, that record lives in the other system. Deleting the chat does nothing to it.
- Workspace copies. On Business and Enterprise plans the admin console, audit logs and any compliance export may hold data after the user has deleted it. Ask your admin what the workspace retention setting is and write the answer down.
Controls that work in practice
Move business use onto a Business or Enterprise workspace. Personal Plus accounts give you no admin view, no retention setting and no way to remove data when someone leaves.
Decide which data classes may go into ChatGPT at all. If payroll, health data or client financials are excluded, the retention question becomes much smaller. Where sensitive one-off work is unavoidable, use a Temporary Chat and turn memory off for that role.
Put a short cleanup step into offboarding. Before a leaver's seat is removed, the owner checks Projects and shared chats for anything the team still needs, then deletes the rest. Do the same review quarterly for live accounts.
If you are already reviewing what ChatGPT remembers about staff and clients, the ChatGPT memory privacy review covers the memory side in more depth. An AI governance review can fold these retention rules into the wider control set.
What to write into policy
Keep it to a page. The lines that matter are:
- which data classes are never entered into ChatGPT, on any plan;
- that business work happens on the company workspace, not personal accounts;
- that archive is not deletion, and which action staff use when a matter closes;
- that memory is switched off, or reviewed monthly, for roles handling client data;
- who owns the workspace retention setting and where its value is recorded;
- what the leaver checklist says about Projects, chats and connected apps; and
- how an erasure request is handled when ChatGPT may hold the data.
Record the OpenAI retention wording you relied on and the date you checked it. That single line is what turns a reasonable practice into evidence you can show a client or the ICO.