Last reviewed: 13 November 2026. Companies can use Claude in line with the GDPR if they choose a business plan and configure it properly. Claude GDPR compliance therefore starts with the contract, not the model. For Claude Team, Enterprise and the API, the data processing agreement is already part of Anthropic’s contract terms. Anthropic also does not train on your inputs. Two points remain open. When you use Claude directly, Anthropic stores your data in the US. In addition, Anthropic is not certified under the EU-US Data Privacy Framework. Processing inside the EU is therefore only possible through specific access routes.
This guide compares six routes by contract partner, data location, training and retention. A seven-step rollout checklist follows. We wrote it for companies in Germany and the EU. Works councils and data protection authorities there add requirements that most US guides skip. We checked every statement against primary sources from Anthropic, Microsoft, AWS and Google, plus the official DPF list.
Is Claude GDPR compliant? The short answer
Claude is neither GDPR compliant nor non-compliant per se: the plan, the access route and the configuration decide. Anthropic draws a strict line between consumers and business customers. Free, Pro, Max and Ultra fall under the Consumer Terms, which explicitly exclude business use. No data processing agreement is available for these plans.
Businesses should therefore only use Claude Team, Claude Enterprise or the API. Alternatively, you can use Claude through Amazon Bedrock, Google Cloud, Microsoft Foundry or Microsoft 365 Copilot. There, the cloud provider’s contracts apply. Your own GDPR obligations remain on every route. These include a legal basis under Article 6, technical and organisational measures and, where needed, a DPIA.
Claude DPA, contract partner and international transfers
If your company is based in the European Economic Area, your contract partner is Anthropic Ireland, Limited. The Anthropic Commercial Terms set this out. These terms automatically incorporate the Data Processing Addendum (DPA). Anthropic acts as your processor under Article 28 GDPR, and your company remains the controller.
For transfers to the US, the DPA includes the EU standard contractual clauses, modules two and three. However, Anthropic holds no certification under the EU-US Data Privacy Framework. When we searched the official DPF list on 13 November 2026, Anthropic was not listed. You therefore need a documented transfer impact assessment.
Anthropic’s subprocessor list contains 22 entries. They include Google Cloud, Amazon Web Services and Microsoft Azure as infrastructure used worldwide. Anthropic gives notice of new subprocessors in advance. You can object within 15 days; otherwise the change counts as accepted. Subscribe to the Trust Center notifications for this reason. After the contract ends, Anthropic deletes or returns your data within 30 days. Anthropic holds ISO 27001 and ISO/IEC 42001 certifications and provides SOC 2 reports on request.
What the DPA does not cover
The DPA only covers processing by Anthropic, not your own obligations. You still decide which data employees may enter. You also record the processing in your record of processing activities under Article 30 GDPR. Connectors such as Google Drive or Slack process data under their own rules. Assess these services separately.
Does Anthropic train on your company data?
No, Anthropic does not train on inputs and outputs from its commercial products. This is stated in the Commercial Terms and in Anthropic’s privacy help centre. There are, however, two exceptions. If a user rates an answer with thumbs up or down, Anthropic may use it. Anthropic then stores it for up to five years, separated from user and customer IDs.
Owners of Team and Enterprise organisations can switch off this feedback feature centrally. The second exception is a deliberate opt-in, for example the Development Partner Program for Claude Code. Consumer plans work differently. There, Anthropic trains on the data as long as the model improvement setting is on. This explicitly includes Claude Code used with a Pro or Max account. Development teams often use such accounts with company code unnoticed.
Claude data retention: how long does Anthropic keep data?
Anthropic deletes API data within 30 days by default, while claude.ai chats are kept until they are deleted. Anthropic publishes the periods in a dedicated help article. Exceptions apply to feedback, usage policy violations and Enterprise organisations without a custom period. These values matter for your Claude GDPR deletion concept:
| Data | Retention on commercial plans |
|---|---|
| API inputs and outputs | Deleted within 30 days; files in the Files API kept until deleted |
| Chats in Claude Team | Kept until users delete them; then removed from the back end within 30 days |
| Chats in Claude Enterprise | Indefinite without a setting; custom period from 30 days possible |
| Thumbs-up/down feedback | Up to 5 years, separated from user and customer IDs |
| Usage policy violations | Content up to 2 years, classifier scores up to 7 years |
Pay particular attention to Enterprise: without a custom setting, Anthropic keeps chats indefinitely. Set the period before rollout, in line with your deletion concept. Claude Cowork also stores sessions locally on users’ computers. Admins cannot delete this history centrally.
Zero data retention and newer models
With zero data retention (ZDR), Anthropic no longer stores API requests once the response is returned. This arrangement is only available for the API and only on request through Anthropic’s sales team. The Claude Team and Enterprise interfaces are not covered. Some features are not ZDR-eligible either, such as the Batch API, the Files API and the MCP connector. Since June 2026, the Claude Fable 5 and Claude Mythos 5 model families require 30-day retention. ZDR is available for these models only with Anthropic’s explicit approval.
Claude and GDPR: six access routes compared
The access route decides your contract partner and the processing location. When you use Claude directly, Anthropic stores the data in the US. Processing can take place in the US, Europe, Asia or Australia. Through the API, you can only restrict processing to the US; an EU option is not available yet. The comparison reflects the status on 13 November 2026:
| Access route | Contract partner and role | Processing in the EU | Training and retention |
|---|---|---|---|
| claude.ai Team / Enterprise | Anthropic Ireland as processor | No, data stored in the US | No training; chats kept until deleted or per Enterprise period |
| Claude API (Claude Platform) | Anthropic Ireland as processor | No, only global or US selectable | No training; deleted after 30 days, ZDR on request |
| Amazon Bedrock | AWS; prompts are not shared with Anthropic | Yes, with an EU inference profile | No training; ZDR mode available |
| Google Cloud (Google-managed) | Google; Claude as a partner model | Yes, with the “eu” endpoint | No training; logging only if enabled |
| Microsoft Foundry | Anthropic as seller and processor | No, global or US data zone | Anthropic DPA and Commercial Terms |
| Microsoft 365 Copilot | Microsoft, with Anthropic as subprocessor | Per Microsoft, from early December 2026 | No training; Microsoft DPA |
In Microsoft Foundry, Claude is not a Microsoft product but an Anthropic offering. According to Microsoft Learn, the Anthropic DPA and Anthropic’s terms apply there. There is no EU data zone for Claude in Foundry yet. Billing runs through Azure, however, which simplifies procurement.
Amazon Bedrock and Google Cloud: setting up EU processing correctly
On Amazon Bedrock, processing only stays in the EU with a geographic EU inference profile. According to AWS, requests to such a profile stay within that geography. Calls from Frankfurt are then routed through Frankfurt, Ireland, Paris, Stockholm, Milan or Spain. If you call the EU profile from Zurich or London, those regions can also be involved. Global profiles cost around ten per cent less but route requests worldwide. AWS does not share inputs and outputs with Anthropic.
On Google Cloud, choose the “eu” endpoint. According to Google, data then stays within EU member states. The global endpoint makes no such commitment. Note that Google Cloud also offers an Anthropic-managed variant. There, Anthropic is the processor, and no EU option is documented. For your own applications, see our Claude API integration service (in German).
Microsoft 365 Copilot: what changes in December 2026
In Microsoft 365 Copilot, Anthropic works as a Microsoft subprocessor. Your Microsoft DPA and the Product Terms therefore apply. Until early December 2026, however, processing takes place outside the EU Data Boundary. On 5 November 2026, Microsoft announced EU Data Boundary processing for Claude by the end of 2026.
According to Message Center notice MC1546438 of 10 November 2026, this affects admins directly. From 9 December 2026, Microsoft enables Claude for EU and EFTA tenants that have made no selection. The option “Copilot in Microsoft 365 apps only” is retired and switched to all users. Decide beforehand whether you want “No users” or specific groups. A separate setting controls models with data retention, such as Claude Fable 5. Anthropic’s terms apply to them instead of your Microsoft contract. Our guide to Microsoft 365 Copilot and GDPR explains the admin settings.
Claude GDPR checklist: seven steps to a compliant rollout
A compliant rollout follows a fixed order: data and route first, then contract, technology and co-determination. You classify your data and replace personal accounts first. Then you document the contracts, set the admin controls and check whether you need a DPIA. Finally, you involve the works council and train your employees:
- Step 1: Classify your data — Decide which data classes may be used with Claude. This determines the right access route.
- Step 2: Replace personal accounts — Provide a business plan and prohibit Pro and Max accounts for company data.
- Step 3: Document the contracts — File the DPA, the subprocessor list and your transfer impact assessment.
- Step 4: Set the admin controls — Review feedback, memory, web search, connectors, Claude in Chrome and retention periods.
- Step 5: Check the need for a DPIA — Assess under Article 35 GDPR whether a high risk exists.
- Step 6: Involve the works council — AI tools usually fall under section 87(1) no. 6 of the German Works Constitution Act. A works agreement for AI tools (in German) creates clarity.
- Step 7: Train your employees — Since February 2025, the EU AI Act (in German) has required sufficient AI literacy.
Step 4 is the one companies underestimate most. Claude in Chrome and Cowork are enabled by default in Team organisations. Neither supports zero data retention. In addition, new organisations have started with memory switched on since late October 2026.
Benefits of a governed Claude rollout for mid-sized companies
A governed rollout makes Claude usable for business teams and auditable for data protection. Instead of bans and shadow AI, there are clear rules that employees understand. In addition, your data protection officer and works council approve the use once, with documentation, instead of case by case. The main benefits in practice:
- Less shadow AI: An official offering replaces personal accounts holding company data.
- Auditable records: The DPA, transfer assessment and retention periods are fully documented.
- Faster approvals: Data protection and the works council decide on the basis of clear facts.
- The right data location: Sensitive applications run in EU regions, simple text work on claude.ai.
- Less dependency: For particularly sensitive data, local or private AI (in German) also remains an option.
Common Claude data protection mistakes
The most common mistake is assuming that a business plan solves every data protection question. However, the DPA does not settle the data location, your admin settings or the use of personal accounts. Above all, companies assume EU storage, which does not exist when Claude is used directly. These mistakes are typical:
- Assuming EU storage: With Team, Enterprise and the direct API, Anthropic stores data in the US.
- Using global profiles: On Bedrock and Google Cloud, processing leaves the EU without an EU profile.
- Forgetting the Enterprise period: Without a custom setting, Anthropic keeps chats indefinitely.
- Missing the Copilot date: Microsoft enables Claude from 9 December 2026 in tenants without a selection.
- Overlooking Claude Code: With Pro or Max accounts, consumer terms apply, including to company code.
How AURUM helps with Claude and GDPR
AURUM GmbH is an Anthropic (Claude) Partner, as a Registered Partner in the Claude Partner Network. We are also a Microsoft Solutions Partner based in Nuremberg, Germany. We therefore know both sides: Anthropic’s contracts and the Microsoft 365 and Azure settings. Together we choose the access route that fits your data and your Claude GDPR requirements. We then set up Claude and configure the admin controls.
For your data protection officer, we document data flows, retention periods and subprocessors in a clear format. We do not provide legal advice; the legal assessment stays with your data protection officer or law firm. Our AI data protection and EU AI Act service (in German) covers this in detail. Do you have detailed questions about Claude and the GDPR? Contact our team, and we will answer them personally.
Frequently asked questions about Claude and GDPR
Claude can be used in line with the GDPR if you choose a business plan and configure it properly. For Claude Team, Enterprise and the API, Anthropic’s data processing agreement is part of the Commercial Terms. Anthropic does not train on this data. You still need a legal basis, a transfer impact assessment and, depending on the use case, a DPIA.
We advise against it. Free, Pro, Max and Ultra run under Anthropic’s Consumer Terms, which exclude business use. There is no data processing agreement for these plans. This also applies to Claude Code when developers sign in with a personal Pro or Max account.
Not when you use Claude directly from Anthropic. Anthropic stores data in the US, and processing can take place worldwide. EU processing is possible on Amazon Bedrock with an EU inference profile. On Google Cloud, use the “eu” endpoint. For Microsoft 365 Copilot, Microsoft has announced EU Data Boundary processing by the end of 2026.
More questions about Claude, the DPA and data transfers
No. Anthropic was not listed on the official Data Privacy Framework list when we checked on 13 November 2026. Anthropic bases transfers to the US on the EU standard contractual clauses in its data processing agreement. You should therefore document a transfer impact assessment for this transfer.
That depends on the use case, not the tool. Article 35 GDPR requires a data protection impact assessment where processing is likely to result in a high risk. If you use Claude to assess job applications, performance data or health data, a DPIA is likely. For plain text work without personal data, a documented threshold assessment is often enough. Your data protection officer makes the final call.
Bottom line: Claude GDPR compliance is a configuration question
You can use Claude in line with the GDPR if you choose the plan, access route and settings deliberately. The DPA is included in every business plan, and Anthropic does not train on your data. The open points are data location, international transfers and retention periods. If you need EU processing, use Bedrock or Google Cloud with an EU endpoint. For an overview of everything we offer, see our English services overview.