Is Claude GDPR Compliant? (2026)

Is Claude GDPR compliant? Yes, when configured properly. Anthropic includes a data processing agreement with standard contractual clauses in its commercial terms, and data from the API and from business plans is not used to train models by default. The real decision lies elsewhere: data residency follows the access route you buy, and only one route guarantees processing inside the EU. As of August 2026. This is not legal advice.

What happens to data you enter into Claude

The most common worry is model training, so start there. Data sent through the Anthropic API and through business plans is not used to train models by default. There is nothing to switch on and nobody to ask: that is how the default setting behaves.

Free consumer accounts are a different matter and follow their own data settings. That is why the company answer to any Claude question starts with the account: a business plan or the API on a company-owned account. An employee's private account, opened on a Friday afternoon, provides neither a contract nor control. The same logic applies to every model vendor, and we work through it in detail in our piece on whether ChatGPT is safe for company data.

The second conclusion is just as plain. Verify the training setting in the terms of the plan you actually buy, then record it in your documentation. A salesperson's assurance is not evidence; the plan terms are.

The data processing agreement with Anthropic

If a model vendor processes personal data on your behalf, you need a data processing agreement with it. Anthropic builds one into its commercial terms together with standard contractual clauses (SCCs), and the operative version of the DPA has applied since 24 February 2025.

Two details matter for a European buyer. The EU contracting entity is Anthropic Ireland, Limited, based in Dublin, so the agreement is signed with an entity inside the Union. The standard contractual clauses cover transfers outside the European Economic Area, which genuinely occur with this vendor, as the next section shows.

That settles the contractual layer. It does not settle the technical layer, meaning the place where your requests are actually computed.

Where Claude processes data

This is where vendors genuinely differ, and where most guides get it wrong. Claude is available through four routes, and each answers the residency question differently.

Anthropic remains the data processor in all four variants. Choosing a cloud changes the processing location and the commercial terms. The model vendor's role in your record of processing activities stays exactly the same.

If your policy requires processing inside the Union, the decision is short:

Does personal data leave the company and reach the model?
  no   -> any access route, describe it in your record of processing
  yes  -> does policy require EU residency?
            no  -> direct API or Vertex, transfers under SCCs
            yes -> AWS Bedrock, EU inference profile (6 regions)

An honest word on the CLOUD Act: Anthropic is a United States vendor and falls under the US CLOUD Act regardless of where requests are physically computed. That does not void compliance and is no reason to drop the model. It is a line item in your risk assessment, sitting next to the other US vendors you already use. For special categories of data the item weighs more than it does for commercial correspondence, and you are the one who has to weigh it. This is not legal advice.

The AI Act and Claude: what applies in August 2026

The AI Act does not stamp models with a compliance mark you can buy alongside a licence. The duties sit with you as the deployer of the system, and two of them already bite.

Article 4, AI literacy. Applies since 2 February 2025. It requires measures to build AI literacy among the people who operate such systems on your behalf. A training programme and an attendance list can support the documentation of those measures.

Article 50, transparency. Applies since 2 August 2026, so it is already in force. If your system talks to a person, that person has to know they are interacting with an AI system unless it is obvious from context. In practice that is one sentence in the reply footer, in chat widgets and in automated email.

One more thing sits outside the statute: the trail. Every model call inside a production process should leave a record of who triggered it, on which data, and what the model returned. How to build that gate in front of the model is the subject of our piece on the AI Act register and the gate before the model.

Seven questions before you deploy Claude

This list closes the documentation layer. Write the answers on a single page before anyone wires a model into a process.

1. Who is the controller and who is the processor in this specific process.
2. Which access route you are buying: direct API, Bedrock, Vertex or Foundry.
3. Where processing happens and whether your policy allows transfers outside the EEA under SCCs.
4. What about special categories: which classes of data never reach the model.
5. What retention applies: how long you keep prompts and responses on your side.
6. Whether your record of processing covers the model's use and its vendor.
7. How you tell the user they are interacting with an AI system, per Article 50.

A filled-in skeleton entry looks like this:

Process:            ......................................
Data categories:    ......................................
Legal basis:        ......................................
Processor:          Anthropic (+ cloud vendor, if applicable)
Access route:       API / Bedrock EU / Vertex / Foundry
Processing location: .....................................
Retention on our side: ....... days
Article 50 notice: where, and in what wording

When NOT to wire Claude into a process

Honestly, there are situations where the correct answer is "not yet".

Your legal basis is unresolved. If you cannot say on what basis you process this data, or whether the model's use fits the original purpose, a model will not fix that. It will reproduce the problem at scale.

Policy demands the EU but the process has to run on the direct API. Then either you move to Bedrock with the EU profile, or you change the data in scope. Pretending that the "global" setting is close enough is a decision that surfaces at the first audit.

Special categories without an impact assessment. Health data, biometrics, criminal convictions. With those classes you start from a data protection impact assessment, and model selection comes afterwards.

The process is unstable. If the process itself changes every week, your compliance documentation goes stale faster than you can write it. Stabilise the process first, then automate it. What "deploying Claude" means at each level is laid out in our piece on deploying Claude in your company.

How to start

The decisions in this article can be closed in a few working days, and that is cheaper than unwinding them later.

1. Choose the account and the access route. For individual work a business plan is enough; the differences are laid out in our piece on Claude Team versus Enterprise.
2. Write down the seven answers above and add the process to your record of processing activities.
3. Close the technical layer together with the legal one. With us those decisions (access route, data boundaries, retention, audit trail, the Article 50 notice) land in an Implementation Specification from €1,200 net: five working days and a fixed build quote before any code is written. If you commission the system build from us, we credit the specification fee toward the build.

If you would rather first check whether the process is worth automating at all, book a free process scan: 30 minutes with an engineer and a written summary within two business days. If a subscription is all you need, we will say so.

Book a free process scan | AI agents | See pricing

FAQ

Is Claude GDPR compliant? Yes, when configured properly. Anthropic includes a data processing agreement with standard contractual clauses in its commercial terms (the DPA has applied since 24 February 2025), and the EU contracting entity is Anthropic Ireland, Limited in Dublin. Compliance then depends on your side of the line: legal basis, chosen access route, retention, your record of processing activities, and the notice you give users. As of August 2026. This is not legal advice.

Does Anthropic train models on company data? Data sent through the API and through business plans is not used to train models by default. Free consumer accounts follow their own data settings, which is why the company answer is a business account or the API on a company-owned account. Verify the setting in the terms of the plan you actually buy, because marketing pages prove nothing. As of August 2026.

Can Claude process data inside the European Union? Guaranteed EU residency comes today from Claude on AWS Bedrock with the EU inference profile: processing is restricted to six EU regions (Frankfurt, Ireland, Paris, Stockholm, Milan, Spain). Anthropic's direct API processes requests in the US or globally and has no EU option today. Google Vertex AI runs under a full data processing agreement but processes globally. Microsoft Foundry currently offers a US data zone only, with an EU zone announced for 2026.

Does Claude satisfy the AI Act? The AI Act does not certify models that way; the duties sit with you as the deployer of the system. The AI literacy duty under Article 4 has applied since 2 February 2025. The transparency duties under Article 50, meaning telling a person they are interacting with an AI system unless that is obvious from context, have applied since 2 August 2026 and are already in force. This is not legal advice.

Who remains the data processor when Claude runs in a cloud? Anthropic remains the data processor in every access route, including when the model runs through AWS Bedrock, Google Vertex AI or Microsoft Foundry. What changes is the processing location and the cloud terms; the model vendor's role in your record of processing stays the same. Separately, as a US vendor Anthropic falls under the CLOUD Act, which is a line item in your risk assessment rather than a blocker in itself.

Related articles

• Deploying Claude in your company: scope, costs and stages
• Claude Team vs Enterprise: pricing and features
• Is ChatGPT safe for company data?
• The AI Act register: a gate before the model
• AI agents