Anthropic DPA explained: what EU businesses sign
Procurement teams usually meet the Anthropic DPA, meaning the data processing addendum that governs what Anthropic may do with your personal data, after an admin has accepted it with a click. The DPA came bundled with the Commercial Terms, so it was in force before anyone in legal opened it.
Legal readers need four answers from the contract: who the parties are, which law applies, how data may leave Europe and what Anthropic must tell you when its suppliers change. The sections below take them in order, while whether Claude is GDPR compliant has its own guide with the full checklist. This guide is not legal advice.
What is the Anthropic DPA, and when does it apply?
Article 28 of the GDPR says that a company handing personal data to a processor, meaning a supplier that handles the data on its behalf, needs a written contract with set contents.1 Anthropic's Commercial Terms incorporate the DPA by reference in Section C, and the DPA itself says it also forms part of any other agreement with Anthropic that references it.23
Under that contract your business is the controller, meaning the party that decides why and how personal data is processed, and Anthropic is your processor.34 The DPA covers products under the Commercial Terms, such as the Claude API and Claude for Work, which means the Team and Enterprise plans.54
Claude Pro and Max on a personal card
Claude Pro and Max are consumer plans under Anthropic's Consumer Terms, so a Pro subscription that an employee expenses on a personal card carries no DPA at all.46 Search three months of expense claims for Anthropic and move each account to Claude for Work, at €22 a month excluding VAT per Standard seat through satori-claude.
Claude on Amazon Bedrock and Google Cloud: whose terms apply
Amazon Web Services states that Anthropic sells Claude on Bedrock itself, so beside Amazon's own terms you accept Anthropic's Bedrock terms of 18 August 2025, which incorporate the same DPA.7 Bedrock runs Claude in a model deployment account, meaning an account Amazon operates for one model provider per region, and Amazon states that Anthropic cannot see prompts or completions.8
Google says Anthropic models are not a Google product and puts them under its Separate Offerings terms plus the terms on each model's own page, so read both for that route.9 Where each route processes the data is covered in our Claude EU data residency guide.
Who you sign with: Anthropic Ireland and Irish law
Customers in the European Economic Area, Switzerland and the UK sign with Anthropic Ireland, Limited, under both the Commercial Terms and Anthropic's Bedrock terms, while everyone else signs with Anthropic, PBC.27 The Commercial Terms choose the laws of Ireland, and a German buyer's contract dispute goes to a sole arbitrator in Dublin if 45 days of informal talks fail.2 Anything outside arbitration goes to the Irish courts.2
Signing with an Irish company does not keep the data in Ireland, because Anthropic's privacy centre says commercial data, such as Claude Enterprise and the API, is stored in the US, even when traffic routes through Europe.10 The DPA therefore carries Standard Contractual Clauses (SCCs), meaning the Commission's model contract for exporting personal data, to the extent data protection law requires them.311 Article 46 accepts those clauses as a safeguard, and the DPA ranks them above its own text and the main agreement if the documents conflict.13
The SCCs in the DPA choose Irish law in Clause 17 and the courts of Ireland in Clause 18.3 Clause 18 still lets the person the data is about sue where they live, so an employee in Lyon can sue in France rather than Ireland.11 Under the DPA, the competent authority for the SCCs is the national data protection authority where your business is established.3
The DPA names the Anthropic company you signed with as the data importer, meaning the party that receives your personal data under the SCCs.3 For a customer in the European Economic Area that is Anthropic Ireland, so the step to the US is its own onward transfer.310
The European Data Protection Board counts a transfer only when the importer sits in a country outside the European Economic Area, which makes that onward step the one to examine.12 Your transfer impact assessment (TIA), meaning a written check that US law does not undercut the SCCs, should therefore cover it.11
Which SCC modules does the Anthropic DPA use?
Commission Implementing Decision (EU) 2021/914 sets out the clauses in four modules, one for each pairing of controller and processor, and the Anthropic DPA uses only two of them.113
- Module Two, controller to processor, fits a business that uses Claude for its own staff or customers, where you are the controller and Anthropic is your processor.
- A software company building on the Claude API for clients needs Module Three, processor to processor, because it is their processor and Anthropic becomes its subprocessor, meaning a processor it brings in.
Any reseller or software vendor that passes your data to Anthropic should be able to show which module covers its own account, because that answer tells you who is processor for whom. Ask for it in writing.
Clause 14 makes both parties warrant that they have no reason to believe the law in the destination country stops Anthropic from keeping its promises, and agree to write that assessment down.11 Section I.4 of the DPA commits Anthropic to reasonable support with transfer rules and, on request, the information reasonably necessary for your TIA, which leaves the assessment itself with you.3 Our guide to GDPR and American AI tools covers the TIA itself and the safeguards that sit around it.
Anthropic and the Data Privacy Framework
The EU-US Data Privacy Framework is a scheme that US companies join by self-certifying with the US Department of Commerce, which publishes the list of participants.13 A transfer to a certified company needs no SCCs, because Article 45 lets it rest on the Commission's finding that the framework protects data adequately.1
On 13 October 2026 a search for Anthropic in the official participant list returned no results, while the same search for Microsoft returned an active entry.13 Rely on the SCCs and on what Anthropic tells you under Section I.4 about its onward transfer, then repeat the search before filing the DPA.
What the Anthropic subprocessors list means for you
Section C of the DPA gives Anthropic general authorisation to use the subprocessors on its published list, which Article 28(2) allows as long as you can object to changes.31 On 13 October 2026 the list held 20 entries, from Google Cloud, Amazon Web Services and Microsoft Azure as worldwide cloud infrastructure to support desks in the US, South Africa and Canada.14 Anthropic must give reasonable notice before a new subprocessor gets access, and you then have 15 days to object on reasonable privacy or security grounds, or you are deemed to consent.3
An objection opens a negotiation, because Section C.3 only promises that both sides will work in good faith towards a resolution and names no exit of its own.3 Your 15 days run from the date of the notice, so a notice that lands in an unread admin inbox can expire before anyone in legal sees it. Anthropic's privacy centre points to a Trust Center news feed for updates on where its subprocessors operate.10
Picture a 25-person software company in Ghent, a made-up example, that builds a client portal on the Claude API, relies on Module Three and routes every Anthropic notice to an unwatched inbox. After a 20-minute change, a shared privacy mailbox receives the feed and each notice gets a calendar entry 10 days out, which leaves 5 days to write an objection. Someone still has to read each new name by hand and decide whether it touches client files.
Breaches, audits, deletion and training
Four other DPA sections set duties your team must act on, and each maps to a point in Article 28(3).31
| DPA section | What Anthropic promises | What you do with it |
|---|---|---|
| G.1, security breaches | Written notice without undue delay and within 48 hours at the latest | Route it to your incident lead, since Article 33 gives you 72 hours to tell your regulator |
| F.1 and F.2, audits | Annual external audits, the latest audit report on written request, and your own audit at your expense, normally once in 12 months at most | File the latest report with the DPA before go-live |
| H.1, end of contract | Within 30 days, a copy of your data if you ask for it within that period, and deletion of all copies, unless the law, a dispute between the parties or the need to combat harmful use of the Services requires retention | Export what you need to keep before the last day |
| B.6, assistance | Reasonable help with your data protection impact assessment, meaning the written risk review Article 35 requires before high-risk processing | Ask for that input in writing while you draft it |
On training, the Commercial Terms say Anthropic may not train models on Customer Content, and the privacy centre lists the exceptions as data you choose to share.215 Those are a thumbs up or down, a bug report, or an opt-in such as Anthropic's Development Partner Program.154 A thumbs rating keeps the whole conversation for up to 5 years, and an Owner can switch the thumbs button off with the Rate chats setting.15
How do you sign the Anthropic DPA?
You do not sign the Anthropic DPA separately, since the privacy centre states that accepting the Commercial Terms also accepts the DPA with its SCCs.5 The European Data Protection Board accepts provider-drafted terms, but paragraph 110 of its guidelines says a controller that accepts them and uses the service takes full responsibility for GDPR compliance.16 Five steps put the DPA on file:
- Confirm the account type in the admin console, because a Pro or Max account falls under the Consumer Terms, while Claude for Work, the API and Anthropic's Bedrock terms carry the DPA.657
- Save two dated copies of the Commercial Terms, effective 17 June 2025, and the DPA, effective 24 February 2025, as PDFs with a name such as anthropic-dpa-2026-10-13.pdf.23
- Record the transfer basis in your GDPR processing register as Section I of the DPA, SCCs Module Two or Three to the extent required, plus Anthropic's onward transfer to the US.3 Ask Anthropic in writing under Section I.4 how that onward transfer is covered, and file the answer next to it.
- Draft the TIA that Clause 14 asks for and keep it in the same folder as the DPA, where a regulator can ask to see it.11
- Name one owner for notices, subscribe a shared mailbox to the Trust Center feed and give that person the 15-day objection window and the 48-hour breach notice.
Where satori. fits
satori-claude costs €490 once to set up, then €22 per user a month for a Standard licence and €14 per user a month for support and a quarterly report. The reseller question from the module section applies to us as much as to anyone, so ask it before you sign. All satori. prices are fixed and exclude VAT.
We do not give legal opinions, so a business that sends health or financial data should have its data protection officer or a lawyer sign off the TIA. To compare the all-in numbers first, read Claude pricing in Europe or ask for a free 30-minute call through our contact page.
Open your Claude account settings, check whether the plan reads Team, Enterprise or Pro, and save today's Commercial Terms and DPA as two dated PDFs in your contract register. In under 30 minutes you hold the contract file a procurement review asks for first, with both effective dates written on it.
Sources
Footnotes
-
European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28, 33, 35, 45 and 46. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩ ↩2 ↩3 ↩4 ↩5
-
Anthropic (2025). Commercial Terms of Service, effective 17 June 2025. https://www.anthropic.com/legal/commercial-terms ↩ ↩2 ↩3 ↩4 ↩5 ↩6
-
Anthropic (2025). Data Processing Addendum, effective 24 February 2025. https://www.anthropic.com/legal/data-processing-addendum ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16
-
Anthropic (2026). Does Anthropic act as a data processor or controller? Anthropic Privacy Center. https://privacy.claude.com/en/articles/9267385-does-anthropic-act-as-a-data-processor-or-controller ↩ ↩2 ↩3 ↩4
-
Anthropic (2026). How do I view and sign your Data Processing Addendum (DPA)? Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa ↩ ↩2 ↩3
-
Anthropic (2025). Consumer Terms of Service, effective 8 October 2025. https://www.anthropic.com/legal/consumer-terms ↩ ↩2
-
Amazon Web Services (2025). Third-party model terms: Anthropic on Bedrock, Commercial Terms of Service, version 18 August 2025. https://aws.amazon.com/legal/bedrock/third-party-models/ ↩ ↩2 ↩3
-
Amazon Web Services (2026). Data protection in Amazon Bedrock. https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html ↩
-
Google Cloud (2026). Anthropic's Claude on Google Cloud models. https://docs.cloud.google.com/vertex-ai/generative-ai/docs/partner-models/claude ↩
-
Anthropic (2026). Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers ↩ ↩2 ↩3
-
European Commission (2021). Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries. EUR-Lex. https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj ↩ ↩2 ↩3 ↩4 ↩5 ↩6
-
European Data Protection Board (2023). Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR, version 2.0. https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf ↩
-
US Department of Commerce, International Trade Administration (2026). Data Privacy Framework List, searched 13 October 2026. https://www.dataprivacyframework.gov/list ↩ ↩2
-
Anthropic (2026). Subprocessors. Anthropic Trust Center, checked 13 October 2026. https://trust.anthropic.com/subprocessors ↩
-
Anthropic (2026). Is my data used for model training? Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training ↩ ↩2 ↩3
-
European Data Protection Board (2022). Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, paragraph 110. https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en ↩
Frequently asked questions
The Anthropic DPA, often searched for as the Claude DPA, is the Data Processing Addendum that governs the personal data your business sends through the Claude API or Claude for Work. It names your business as controller and Anthropic as processor, sets out the terms GDPR Article 28 requires and carries the Standard Contractual Clauses for transfers out of the EU.
You do not sign it separately. Anthropic's privacy centre states that the DPA, with its Standard Contractual Clauses, is incorporated into the Commercial Terms, so accepting those terms accepts the DPA as well. Save dated PDF copies of both documents in your contract register, because that pair is the record a procurement review asks for first.
Yes, to the extent data protection law requires them, Section I of the DPA incorporates the clauses from Commission Implementing Decision (EU) 2021/914, Module Two and Module Three. Module Two covers controller to processor and Module Three covers processor to processor, with Irish law in Clause 17 and the courts of Ireland in Clause 18. Clause 14 still asks you to document a transfer impact assessment, meaning a written check that the destination country's law does not undercut the clauses.
We found no listing. A search for Anthropic on the official participant list at dataprivacyframework.gov on 13 October 2026 returned no results, while the same search for Microsoft Corporation returned an active entry. Rely on the Standard Contractual Clauses in the DPA, ask Anthropic under Section I.4 how its onward transfer to the US is covered, then search again.
Customers in the European Economic Area, Switzerland and the UK contract with Anthropic Ireland, Limited, under Commercial Terms that choose Irish law and arbitration in Dublin for contract disputes. The Standard Contractual Clauses in the DPA use Irish law and Irish courts, while the person the data is about can still sue where they live.
Section G.1 of the DPA promises written notice without undue delay and in any event within 48 hours of Anthropic becoming aware of a security breach. Your own GDPR Article 33 deadline is 72 hours after you become aware, so route Anthropic's notices to your incident lead.
No, because Claude Pro and Max fall under Anthropic's Consumer Terms, while the DPA attaches to the Commercial Terms or another business agreement that references it. Staff who put business data into Claude should sit on Claude for Work or the API, where the DPA applies.
About the author
Joachim helps European companies understand and use AI in everyday work. As founder of satori., he trains teams, coaches leadership groups, and shows how tools like Claude become a natural part of work.