Blog · Published · Updated
Claude and GDPR: what the deployment team must verify
Short answer
Claude can be rolled out in line with the GDPR if you use a business plan or the API with Anthropic's data processing agreement, choose the place of processing on purpose and limit the data to what is needed. The direct Anthropic API processes requests in the US or globally. Processing in Europe comes with Claude through Amazon Bedrock or Google Vertex AI with a European region.
- net for implementation for a team of up to 10 people, paid once
- from €1,150
- from start to work of the entire team
- 2 weeks
- after this time, we measure the effect on the same tasks
- 30 days
- conversation with an engineer and a written plan within 2 business days
- €0
We belong to the OpenAI and Anthropic partner programmes and learn through their official courses. What this means ↓
Author: Syntalith · 3 min read
Statistics
AI and personal data: statistics 2026
1.1×
the rate is what you pay in the Claude API for processing in the US only (inference_geo). A European region comes with Claude through Bedrock or Vertex AI.
48.8%
According to Eurostat (2025), 48.8% of EU enterprises that considered AI and did not use it named concerns about data protection and privacy.
52.5%
According to Eurostat (2025), 52.5% of EU enterprises that considered AI and did not use it named a lack of clarity about the legal consequences.
40%
According to Menlo Ventures (2025), Anthropic holds 40% of large companies' spending on language model APIs and OpenAI 27%, based on a survey of about 500 US decision makers.
Source: Menlo Ventures, State of Generative AI in the Enterprise (2025) ↗
84%
According to the European Commission (2025), 84% of Europeans think AI requires careful management to protect privacy and ensure transparency in the workplace.
Source: European Commission, Special Eurobarometer 554 (2025) ↗
Figures checked: 22 October 2026
First the account and the roles of the parties
Write down whether an employee uses the company Claude, the direct API or a model offered by a cloud operator. An employee's personal account has different terms and settings. Anthropic describes the roles of the parties in its information for commercial customers and publishes a data processing addendum. The documentation was checked on 11 October 2026.
Where Claude processes data
| Route of access | Place of processing | Notes |
|---|---|---|
| Claude API from Anthropic | Globally or in the US only | The inference_geo parameter; US-only mode costs 1.1 times the rate, data at rest in the US |
| Amazon Bedrock | A chosen region, Europe included | The region comes from the endpoint or the request routing profile |
| Google Vertex AI | A chosen region, Europe included | The region comes from the endpoint, Google Cloud pricing |
| Microsoft Foundry | US, Europe announced | Anthropic marks Europe as "coming soon" |
Sources: Claude API data residency and regional compliance. Do not give Anthropic the same role on every route of access: AWS explains that in Bedrock model providers have no access to customer data.
The team works in the chat, data with no special requirements
Claude Team with a DPA
from $20 per person
An integration, data may be processed in the US
Claude API
API rates
Data must stay in Europe
Claude through Bedrock or Vertex AI
the cloud's pricing
Data may not leave the company
a local model
priced after a call
Training and feedback
The rules for commercial products say inputs and outputs are not used for training by default. They provide for exceptions, including giving feedback or reporting a bug. The team should know whether it may send feedback that contains a customer document. No training does not mean no storage.
Retention covers more than the conversation
The retention documentation separates the API from products that save conversations, and lists exceptions for safety and legal requirements. On the company side there are also several places where data stays.
- The source document and its copies
- The request to the model and the response
- App logs and temporary files
- Exports and backups
- For each place: the purpose, access, the deletion date and how deletion is confirmed
Connectors and outside tools
Claude connects with Google Workspace, Microsoft 365, Slack or GitHub. Each connection is another route for data: the model can read the documents the account has access to and carry fragments of them into an answer. Before you switch a connector on, check whose permissions it uses, and start with read access to one resource. Also add to the data flow map the email, the chat tool and the search engine the team uses together with Claude.
An assessment card for a Claude rollout under GDPR
- 01Process and purposeWhich result should be produced and why personal data is needed.
- 02Data and sourcesWhich records are needed and which can be removed before the model is called.
- 03Parties and contractsWho answers for each stage and on what basis.
- 04Place and transferThe route of access, the region and the basis for transfers outside the EEA.
- 05RetentionDeletion dates at the vendor and in the company.
- 06AccessNamed accounts, roles, removing access, response to an incident.
How to start
The plan, the accounts and the rules for working with data are covered by the Claude rollout from €1,150 net for a team of up to 10 people. The company buys licences directly from Anthropic. An AI audit for the AI Act and the GDPR costs from €700 net at Syntalith and ends with a register of AI tools, a list of settings to change and a training plan for the team. Your data protection officer or lawyer approves the legal assessment. A comparison with other tools is in the articles ChatGPT and company data and Copilot and GDPR.
„I already use AI.”
Your people too. Just no rules.
From our conversations with companies
5 na 10 employees paste sensitive data into private AI accounts: contracts, invoices, customer data.
In ESET survey (2026)
1 na 10 admits this in the survey.
Customer data pasted into a private AI account without an data processing agreement is a violation of the GDPR.
Don't worry, we won't tell anyone :)
What do we see in companies that "already use"
- Only ChatGPT or Claude accounts, without plugins, skills, integrations and MCP servers with company tools.
- Company programs are not connected to AI. People still click through systems and Excel, and enter chat data manually.
- Lack of company standards: everyone writes instructions in their own way, no one shares what works.
- No rules for personal data, GDPR and company secrets.
- No limits and no visibility: no one knows who uses AI, how much and for what.
62% Polish employees use AI at work · 27% companies have written rules for working with AI.
Source: ESET and DAGMA, Cyberportrait of Polish business 2026 (March 2026, 1,026 people) ↗
ChatGPT or Claude space review
Accounts, permissions, rules for working with data and 5 tasks set for the team. 1 day.
€450 net
Company accounts, rules of working with data and team training in 2 weeks, from €1,150 net.View implementation for the team →
„Is my data safe?”
Yes. You choose where they go: from your company account to the model on your server.
00Employee's private account
Customer and company data ends up in an account that the company cannot see or control. There is no data processing agreement, so it is a violation of the GDPR. When an employee leaves, the chat history goes with them.
01ChatGPT or Claude corporate account
The provider does not use your data to train models. A copy of the queries remains in his logs for up to 30 days.
02API with zero retention (ZDR)
The provider processes the request and does not save anything. It requires his consent, we prepare the application together.
03Processing in the EU
Queries are counted and stored in Europe: OpenAI in the EU region, Claude via clouds with the EU region.
04Model at your place
The open model runs on your server or in your cloud in the EU. The data does not go outside the company.
What we do with every implementation
- Confidentiality agreement and data processing agreement before we receive any data.
- You choose the cases for the prototype and we anonymize them upon request.
- The data stays in the EU and we delete it after the test.
- Corporate accounts with an administrator on your side.
When data cannot leave the company
The open model runs on your server or in your cloud in the EU. To choose from:
- White-tailed eagle
- Polish model, SpeakLeash and ACK Cyfronet AGH
- PLLUM
- Polish model, HIVE consortium commissioned by the Ministry of Digitization
- Qwen
- Alibaba
- GLM
- Zhipu AI
- DeepSeek
- DeepSeek
We select a model for the task and check it on your cases. We run it, tune it and maintain it.
Source: Bielik and PLLuM, ACK Cyfronet AGH ↗ · PLLuM, Ministry of Digitization ↗
Do you have a lot of your own data? We will fine-tune the small model.
- 1 Your examples
- 2 tuning
- 3 test on new cases
- 4 model at your place
When you have thousands of similar emails, documents or reports, we teach a small open model based on your examples. It works for you, responds quickly and costs less to maintain than a large model. We measure quality on issues that the model has not seen while learning.
Przemysław and Piotr did it in large programming and consulting companies. Artem did it before and does it today at Syntalith. It's about models on your own infrastructure, tuning and quality measurement.
You choose the protection level during the interview. We sign the data processing agreement before we see any data.Schedule a free analysis →
Price
Three packages. You know the price right away.
Team of up to 10 people
from €1,150
net, paid once · 2 weeks
Company, from 11 to 40 people
from €2,300
net, paid once · 3–4 weeks
Organization, over 40 people
from €4,600
net, paid once · 6–8 weeks
- The same packages once you have licenses. To start, an inspection of the space in 1 day is enough: €450 net.
- You buy Claude Team licenses directly from Anthropic, without our markup: USD 20 per person per month for annual payment or USD 25 for monthly payment, from 2 to 150 people.
From conversation to measurement
01 · 30 min
Free process review€0
An engineer picks 3 to 5 of your team's tasks with you. Written plan within 2 working days.
02 · 2 weeks
Rolloutfrom €1,150
Accounts and roles, rules for working with data, training on your team's tasks. You buy licences directly from the provider.
03 · after 30 days
Measurementincluded
We compare task times before and after. We name in writing the tasks worth handing to a system.
or call+48 888 78 48 78WhatsAppMon–Fri 9:00–17:00 CET
Worked example · Scenario
How we count the payback: a team in Claude
In the free analysis we also settle the route of access and where the data is processed.
€4,534
a month for finding agreements and handing over cases in a team of 10
Payback: 1 mo.
3 hours a week per person for finding agreements and handing over cases is our assumption. A 30% cut sits within the range of controlled studies (MIT: 40%, Harvard and BCG: 25%). €34.90 an hour is the EU average hourly labour cost for 2025 according to Eurostat, for companies with 10 or more employees. Licence: ChatGPT Business or Claude Team at 20 USD per person a month on annual billing, about €17.85 at the ECB rate of 1.1205 USD per euro on 22 October 2026. Rollout: from €1,150 for up to 10 people, from €2,300 for 11 to 40 people.
See the full calculation →Questions
Is Claude GDPR compliant?
It can be used in line with the GDPR on a business plan or through the API with Anthropic's data processing agreement, when the company sets the purpose, the categories of data, the place of processing, retention and permissions. The model name alone confirms no compliance.
Where does Claude process data?
The direct Anthropic API processes requests globally or in the US only, at 1.1 times the rate. Data at rest is in the US. Amazon Bedrock and Google Vertex AI let you choose a region, a European one included.
Does Anthropic train models on company data?
The rules for commercial products say inputs and outputs are not used for training by default, with exceptions, for example when a user gives feedback or reports a bug. The team should know whether it may send feedback that contains a customer document.
Where do I start a GDPR assessment of Claude?
By writing down whether an employee uses the company Claude, the direct API or a model through a cloud provider. Each route has different roles for the parties, a different place of processing and a different contract.
