Is Claude GDPR compliant? A guide for EU business

Before a European business switches Claude on for its staff, someone in legal or technology has to answer one question, "is Claude GDPR compliant", and the honest answer has two halves. Anthropic's contract already holds the supplier terms the GDPR asks for, while the duties of deciding what goes into Claude, and why, stay with your business. Nothing below is legal advice.

Every fact comes from a primary source checked on 13 October 2026, from Anthropic's own terms to the GDPR text and the European Data Protection Board.

---

Is Claude GDPR compliant? The short answer

Claude fits a GDPR compliant setup on Claude Team, Claude Enterprise and the API, which this guide calls a business plan, as long as your business does its half of the work. A personal Free, Pro or Max account does not fit, because it leaves your business without the supplier contract the GDPR asks for.

No software product is GDPR compliant on its own, because the regulation binds the businesses that process personal data and not the tools they buy. Article 24 tells the controller, meaning the business that decides why and how personal data is processed, to put measures in place and be able to prove its processing complies.¹ A tool can only add documents to that proof or leave holes in it.

Business plans add the first document, since Anthropic then acts as your processor, meaning a supplier that handles personal data only on your documented instructions.²³ Personal accounts add none, because the consumer terms put Anthropic Ireland in the controller's seat for that user's data and leave your business with no processor contract at all.⁴⁵ Claude GDPR compliance therefore rests on the plan you buy and on the eight checks further down.

Who is the controller when your team uses Claude?

Claude Team, Claude Enterprise and the API

Customers in the European Economic Area, Switzerland and the UK sign the Commercial Terms with Anthropic Ireland, Limited, and those terms make a Data Processing Addendum part of the contract.⁶ The addendum, called the DPA, is the processor contract Article 28 asks for, and accepting the terms means accepting it.²⁵

Guidelines from the European Data Protection Board explain a duty in Article 28(1) that outlasts the signature, since the controller must assess whether the processor's guarantees are sufficient and keep checking them.⁷ The same guidelines name terms of service, security policies, audit reports and security certificates as the evidence a controller can ask for.⁷ Anthropic lists an ISO 27001 certificate, meaning an outside auditor has checked how it runs information security, and customers request copies of its certificates and audit reports through its Trust Portal.⁸ Save the files with a date and recheck them yearly, since the Board expects controllers to verify those guarantees at appropriate intervals.⁷

Claude Free, Pro and Max

Personal plans run on Anthropic's consumer terms, where Anthropic Ireland is the controller for users in the European Economic Area and its privacy policy, not a DPA, governs the data.⁴ Chats on those plans can train Anthropic's models when the user allows it under the Model Improvement setting in Privacy Settings, so the choice sits with each employee rather than with you.⁴⁹ Even with the setting off, Anthropic still uses chats flagged for safety review and chats the user reports as feedback to improve its models.⁴ Close those accounts for work before anything else.

What does Anthropic already cover?

The table sums up what Anthropic's terms and help pages say on the points a data protection officer asks about first.

Feedback is the row staff trip over, since a thumbs up or down sends that chat to Anthropic, which may keep it up to five years and train on it.¹⁰ Owners of a Claude Team or Claude Enterprise plan can switch member feedback off with the Rate chats setting under Organization settings > Data and Privacy.¹⁰

Transfers rest on Standard Contractual Clauses, or SCCs, meaning the Commission's model contract for sending personal data out of the EU, which Article 46 accepts as a safeguard.¹² Our Anthropic DPA explainer shows which module of the clauses fits your setup, and what the choice of Irish law and Irish courts means for you.

Claude data privacy settings in Claude Enterprise

Of the controls Claude Enterprise adds over Claude Team in Anthropic's plan comparison, two matter most for the GDPR: audit logs, meaning a record of who did what, and custom data retention.¹² An Owner sets the retention period under Organization settings > Data and Privacy, where 30 days is the minimum and older chats are queued for permanent deletion on save.¹³ Pick 90 days unless someone names a reason to keep chats longer, because a deleted chat cannot leak and never has to be handed over when a customer asks for their data. The setting covers chats and projects only, so Claude Design, Claude Managed Agents and features built on Claude Code on the web fall outside it.¹³

On Claude Team the same choice is manual, so tell staff to delete chats holding personal data once the task is done.

Where does Claude process and store EU data?

Anthropic's privacy centre says data from commercial products such as Claude Enterprise and the API is stored in the US, even though customer traffic may by default be routed to select countries on four continents, Europe and Asia among them.¹⁴ Claude Enterprise on usage-based billing can switch on US-only inference, meaning the model processes every request on servers in the US.¹⁵

The API parameter inference_geo, which picks where a request is processed, accepts only global and us, and the only storage location a workspace can pick is also us.¹⁶ Anthropic offers no EU-only processing of its own today.

Claude in EU regions on Amazon Bedrock or Google Cloud

EU processing therefore runs through a cloud platform, and on Amazon Bedrock that means an EU inference profile, meaning a setting that keeps every request inside the EU geography Amazon defines.¹⁷ Frankfurt needs care, because Amazon offers Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 there only through that EU profile or a worldwide one, never pinned to Frankfurt alone.¹⁸

Google Cloud lists an EU multi-region endpoint, meaning processing kept inside EU member states, for Claude Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1.¹⁹ Older guides call Google's AI platform Vertex AI, because Google has since renamed it Gemini Enterprise Agent Platform.²⁰

On Amazon Bedrock you also accept Anthropic's own Bedrock terms with Anthropic Ireland, which bring in the same DPA, so file that DPA next to Amazon's terms.²¹ Google says Claude is not a Google product and puts it under Google's terms for partner models plus the terms on each model's page.²² Both routes are API products for developers rather than a chat window for staff, and our Claude EU data residency guide compares them model by model.

Claude data transfers to the US

Storage in the US makes every prompt holding personal data a transfer under Article 44 of the GDPR, and Anthropic's DPA covers transfers out of the EU with SCCs.¹² The Data Privacy Framework, an EU-US scheme that US companies join one at a time, listed no Anthropic entry on 13 October 2026.²³

SCCs come with a duty to write a transfer impact assessment, meaning a written check of whether the law in the destination country undercuts the clauses, as the Board's recommendations describe.²⁴ Our guide to GDPR and American AI tools covers that assessment step by step.

The Claude GDPR checklist: eight checks your business runs

Each of the eight checks below ends in a document you can show your data protection authority, meaning the national regulator that enforces the GDPR. Together they cover the controller half for a business that uses Claude for drafting, analysis and code.

The Irish Data Protection Commission tells organisations that use AI products to know what personal data goes in and whether the provider keeps or reuses it, and the checks below answer both.²⁵

1. Move every work account to a business plan, because only the Commercial Terms behind Claude Team, Claude Enterprise and the API bring the DPA and the no-training default with them.⁵¹⁰ Pick Claude Team unless you need the Enterprise controls above, at a list price of US$25, about €22, per Standard seat per month billed monthly.¹²
2. Save dated copies of the Commercial Terms and the DPA, and watch for Anthropic's notices of new subprocessors, because you get 15 days to object.²
3. Name the legal basis for each use case under Article 6, and where it is legitimate interest, write down the test that weighs your interest against the rights of the people involved.¹
4. Add a line for Claude to your record of processing, meaning the Article 30 list of what personal data you handle, why and with whom.¹ The exemption for firms under 250 staff falls away once that processing is regular rather than occasional.¹
5. Screen each use case for a data protection impact assessment, a DPIA, which Article 35 requires before processing that is likely to carry a high risk to people.¹ Guidelines endorsed by the Board say that processing meeting two of their nine criteria usually needs a DPIA, and the use of new technology is one of the nine.²⁶²⁷ Linking Claude to a whole customer database often adds large-scale processing as a second criterion, while a team drafting emails in a chat window rarely adds one.
6. Write the transfer impact assessment that the SCC route asks for, then add the US storage and the other routing countries Anthropic lists to your privacy notice, as Article 13(1)(f) requires.¹¹⁴
7. Hand staff a prompt rule, meaning one page on what never goes into Claude, from health data and other sensitive data listed in Article 9 to names the task does not need.¹
8. Plan incidents around two clocks, since Anthropic must tell you within 48 hours and you must notify your data protection authority within 72 hours where the breach carries a risk.¹²

The EU AI Act's rules on AI literacy, meaning staff who understand what an AI tool does and where it goes wrong, have applied since 2 February 2025.²⁸ Article 4 now asks any business that uses an AI system to take measures that support AI literacy among its staff, without setting a level each employee must reach.²⁹ The Digital Omnibus, the amending law in force since 27 July 2026, brought in that wording, and our EU AI Act guide lists what else applies.³⁰

An example: moving a 40-person firm off personal accounts

Take an illustrative case rather than a client: a 40-person accounting firm in Rotterdam where 11 people use personal Claude Pro accounts and paste payslip lines into them. Before the change the firm has no processor contract and no line in its record of processing, while its chats can train a model unless 11 people each switch a setting off. After a move to 40 Claude Team seats, it holds one DPA, one line in its record of processing, a two-page DPIA screening note and a prompt rule that bans payslips outright. The office manager still walks every new hire through the prompt rule by hand, because the printed prompt rule does not stop a tired colleague at 6 pm.

How satori. sets this up

satori-claude covers the admin settings, a written note of the data transfer for your record of processing and the prompt rule, all before the first login. It costs €490 once, then €22 per user per month for a Standard licence and €14 per user per month for running it, all fixed and excluding VAT. Our Claude pricing page for Europe adds those lines up for a ten-person team, and training runs through satori-launch at €560 per user from 8 users. The attendance list from that training doubles as evidence of your AI literacy measures.

We do not give legal opinions, so the transfer impact assessment and any use touching health data or a whole customer database belong with your data protection officer or a lawyer. A free 30-minute call through our contact page is enough to see which of the eight checks you already have.

Write the Claude line for your record of processing now, as a first draft with five fields: purpose, kinds of people, kinds of data, recipients and transfer countries. Name Anthropic Ireland as the recipient, and under transfer countries list the US plus every other place outside the EU that Anthropic's server page names for routing.¹⁴ In under thirty minutes you have a draft entry for Article 30, and any field you cannot fill shows which of the eight checks comes first.

---

Sources

Footnotes

1. European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4, 6, 9, 13, 24, 28, 30, 33, 35, 44 and 46. EUR-Lex. https://eur-lex.europa.eu/eli/reg/2016/679/oj ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

2. Anthropic (2025). Data Processing Addendum, effective 24 February 2025. https://www.anthropic.com/legal/data-processing-addendum ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

3. Anthropic (2026). Does Anthropic act as a data processor or controller? Anthropic Privacy Center. https://privacy.claude.com/en/articles/9267385-does-anthropic-act-as-a-data-processor-or-controller ↩

4. Anthropic (2026). Privacy Policy, effective 10 September 2026. https://www.anthropic.com/legal/privacy ↩ ↩² ↩³ ↩⁴

5. Anthropic (2026). How do I view and sign your Data Processing Addendum (DPA)? Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa ↩ ↩² ↩³

6. Anthropic (2025). Commercial Terms of Service, effective 17 June 2025. https://www.anthropic.com/legal/commercial-terms ↩

7. European Data Protection Board (2022). Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1. https://www.edpb.europa.eu/system/files/documents/2023-10/EDPB_guidelines_202007_controllerprocessor_final_en.pdf ↩ ↩² ↩³

8. Anthropic (2026). What certifications has Anthropic obtained? Anthropic Privacy Center. https://privacy.claude.com/en/articles/10015870-what-certifications-has-anthropic-obtained ↩

9. Anthropic (2026). Is my data used for model training? (consumer products). Anthropic Privacy Center. https://privacy.claude.com/en/articles/10023580-is-my-data-used-for-model-training ↩

10. Anthropic (2026). Is my data used for model training? (commercial products). Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training ↩ ↩² ↩³ ↩⁴ ↩⁵

11. Anthropic (2026). How long do you store my organization's data? Anthropic Privacy Center. https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data ↩ ↩² ↩³

12. Anthropic (2026). Plans and pricing. https://claude.com/pricing ↩ ↩²

13. Anthropic (2026). Configure custom data retention controls for Enterprise plans. Anthropic Privacy Center. https://privacy.claude.com/en/articles/10440198-configure-custom-data-retention-controls-for-enterprise-plans ↩ ↩²

14. Anthropic (2026). Where are your servers located? Do you host your models on EU servers? Anthropic Privacy Center, which names the US, Europe, Asia and Australia as default routing destinations. https://privacy.claude.com/en/articles/7996890-where-are-your-servers-located-do-you-host-your-models-on-eu-servers ↩ ↩² ↩³

15. Anthropic (2026). Enable US-only inference for your organization. Claude Help Center. https://support.claude.com/en/articles/15422948-enable-us-only-inference-for-your-organization ↩

16. Anthropic (2026). Data residency. Claude Platform documentation. https://platform.claude.com/docs/en/manage-claude/data-residency ↩

17. Amazon Web Services (2026). Route model inference requests across AWS Regions with cross-Region inference. https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html ↩

18. Amazon Web Services (2026). Regional availability of models in Amazon Bedrock. https://docs.aws.amazon.com/bedrock/latest/userguide/models-region-compatibility.html ↩

19. Google Cloud (2026). Data residency. Gemini Enterprise Agent Platform documentation. https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/data-residency ↩

20. Google Cloud (2026). Gemini Enterprise Agent Platform name changes. https://docs.cloud.google.com/gemini-enterprise-agent-platform/vertex-ai-name-changes ↩

21. Amazon Web Services (2025). Third-party model terms: Anthropic on Bedrock, Commercial Terms of Service, version 18 August 2025. https://aws.amazon.com/legal/bedrock/third-party-models/ ↩

22. Google Cloud (2026). Anthropic's Claude on Google Cloud models. Gemini Enterprise Agent Platform documentation. https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/partner-models/claude ↩

23. International Trade Administration, US Department of Commerce (2026). Data Privacy Framework List, searched 13 October 2026. https://www.dataprivacyframework.gov/list ↩

24. European Data Protection Board (2021). Recommendations 01/2020 on measures that supplement transfer tools, version 2.0. https://www.edpb.europa.eu/system/files/2021-06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf ↩

25. Data Protection Commission, Ireland (2024). AI, Large Language Models and Data Protection. https://www.dataprotection.ie/en/dpc-guidance/blogs/AI-LLMs-and-Data-Protection ↩

26. Article 29 Working Party (2017). Guidelines on Data Protection Impact Assessment (DPIA), WP248 rev.01. https://ec.europa.eu/newsroom/article29/items/611236/en ↩

27. European Data Protection Board (2018). Data protection impact assessments: high risk processing, endorsed WP29 guidelines. https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/data-protection-impact-assessments-high-risk-processing_en ↩

28. European Commission (2026). Timeline for the implementation of the EU AI Act. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act ↩

29. European Commission (2026). Article 4: AI literacy. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4 ↩

30. European Commission (2026). AI Omnibus enters into force. Shaping Europe's digital future. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force ↩