Anthropic compliance: GDPR, AI Act, DPA, training, transfers

TL;DR. Commercial products (API, Team, Enterprise): contractually no training by default. Anthropic deletes API inputs and outputs within 30 days of receipt or generation, which is the same default window OpenAI runs. Consumer products (Claude Free, Pro and Max): since Anthropic's consumer-terms update of 28 August 2025, each user chooses whether their chats and coding sessions are used to train models, and existing users had until 8 October 2025 to decide. Where a user allows it, Anthropic keeps the data for up to five years; otherwise the 30-day retention period continues. Anthropic became a Microsoft 365 Copilot subprocessor on 2026-01-07 and is explicitly out of EU Data Boundary scope for that route.

DPO action: map staff use of consumer Claude accounts, where each user's own setting decides whether chats are used for training; decide whether to allow Anthropic models in Copilot tenants; apply for ZDR if data sensitivity warrants; sign a BAA before any PHI (API or Enterprise; covered models use 30-day retention, not ZDR).

Primary-source evidence. For the Claude Team plan specifically, the Claude Team Data Protection File records what Anthropic's own Commercial Terms, DPA, Service Specific Terms and privacy-centre articles say - every answer a dated verbatim quote, with the documented gaps flagged. This profile is the analysis; that File is the receipts.

What the tool does

Anthropic runs Claude - both the consumer-facing chat product (claude.ai) and the API behind it. Buyers will be looking at one of three things: the API (for embedded apps), Claude Team / Enterprise (for staff use), or claude.ai consumer plans. As with OpenAI, the terms, training defaults and retention defaults differ between commercial and consumer products, so each has to be assessed on its own terms.

Data processed

• Text input from users / apps
• Documents you upload for analysis
• Image content (Claude vision)
• Tool-use / function-call results
• Embeddings (Anthropic's first-party embeddings story has shifted through 2025-2026 via the Voyage AI acquisition; if your use case relies on embeddings, confirm the current API surface and terms)

Special-category likelihood: High for the same reasons as OpenAI - if staff or end users can type freely, sensitive content gets in. DPIA needed for any public-facing or HR-adjacent deployment.

Default geographic processing: inference runs in the "global" geography by default. Anthropic describes that setting as "Inference may run in any available geography for optimal performance and availability." You can restrict inference to the United States per request, at 1.1 times the standard price. Data at rest is stored in the US: "Currently, "us" is the only available workspace geo." (Anthropic data residency documentation, checked 4 October 2026.)

DPA availability

Anthropic publishes its DPA at anthropic.com/legal/data-processing-addendum, and the Privacy Center article below links to it. The DPA is headed Effective February 24, 2025 and is automatically incorporated into the Commercial Terms of Service - when a customer accepts the Commercial Terms, they accept the DPA without a separate signature flow.

• Pointer (Help Center): https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa - short article that links the actual DPA document
• The DPA itself covers SCCs Module 2 / Module 3 for international transfers, the UK International Data Transfer Addendum, and a Swiss addendum
• Establishes the customer as data controller, Anthropic as processor
• For customers in the EEA, Switzerland and the UK, the Commercial Terms are governed by Irish law, and disputes go to "a sole arbitrator in Dublin, Ireland pursuant the UNCITRAL Arbitration Rules". The SCCs are governed by Irish law with the Irish courts as forum, and the Swiss addendum applies Swiss law to transfers governed by Swiss data protection law. Customers elsewhere contract with Anthropic, PBC under California law.
• Effective date on the document: 2025-02-24

This auto-incorporation model is buyer-friendly compared to OpenAI's account-gated DPA flow, but the implication is the same: read the terms before signing the commercial contract. Note that the SCC modules, UK Addendum, and Irish governing-law provisions are stated in the DPA document itself, not in the Help Center pointer article.

Subprocessor list

Anthropic publishes its subprocessor list at trust.anthropic.com/subprocessors, which held 20 entries when checked on 4 October 2026. Google Cloud Platform, Amazon Web Services and Microsoft Azure each appear as cloud infrastructure, worldwide, for all products, and the list does not designate any of them as the primary provider. The other entries include Cloudflare, Stripe, WorkOS, Intercom, Twilio, Sentry and ElevenLabs.

Because all three clouds can process data for all products, a buyer should not assume that one cloud's regional commitments apply. Under the DPA, Anthropic gives "reasonable notice" of a new subprocessor, and a customer may object on reasonable data privacy or security grounds "within fifteen (15) days of the date of such notice, or Customer is deemed to consent to the new Subprocessor." The DPA provides for the parties to work together in good faith on an objection and gives no express right to terminate.

Training-on-customer-data position

Commercial products (API, Team, Enterprise): not used for model training by default, and contractually restricted. The Commercial Terms state that "Anthropic may not train models on Customer Content from Services." Commercial data can still be used for training in two cases. Feedback that a user reports explicitly may be used to train models, according to the Privacy Center. A customer that enables the permissive data setting of the Development Partner Program allows Anthropic to use its data "including to train models" (Service Specific Terms, effective 31 August 2026).

Consumer products (Claude Free, Pro and Max): each user chooses. On 28 August 2025 Anthropic announced updates to its Consumer Terms and Privacy Policy that give users of Claude Free, Pro and Max "the choice to allow their data to be used to improve Claude", including when they use Claude Code from accounts on those plans. New users make the choice at sign-up. Existing users had "until October 8, 2025 to accept the updated Consumer Terms and make your decision", and after that date they have to make a selection to continue using Claude. The choice applies only to new or resumed chats and coding sessions, and it can be changed at any time in Privacy Settings. Where a user allows training, Anthropic's privacy centre states that it "may retain your data in a de-identified format for up to 5 years in our model training pipelines"; where the user does not, the existing 30-day retention period continues. Feedback a user submits, such as a thumbs up or down, is kept for five years, and Incognito chats are not used for training. The update does not apply to "services under our Commercial Terms, including Claude for Work, Claude for Government, Claude for Education, or API use, including via third parties such as Amazon Bedrock and Google Cloud's Vertex AI", and the FAQ on the same page states that Claude for Work includes the Team and Enterprise plans. Staff who use personal Claude accounts for work are therefore governed by the setting each person chose, not by the organisation's commercial terms.

API log retention: Anthropic's privacy centre, in an article dated 1 July 2026, states that for API users it automatically deletes inputs and outputs on its backend within 30 days of receipt or generation. It lists four exceptions: services with longer retention under the customer's control such as the Files API, a separate agreement such as zero data retention, retention needed to enforce the Usage Policy, and retention required by law. Anthropic's developer documentation describes the default differently, stating that conversation content "is not retained by default; the exception is Covered Models, which require 30-day retention." Because the two documents differ, a retention schedule should record the 30-day window from the Privacy Center. Where a chat or session is flagged by Anthropic's trust and safety systems, inputs and outputs may be kept for up to 2 years, and this applies even under zero data retention. Zero Data Retention (ZDR) is subject to Anthropic's approval, is requested through the sales team and is enabled per organisation. Under ZDR Anthropic "does not store customer prompts or responses at rest after the API response is returned", although it still retains safety classifier results, and features such as the Batch API, the Files API and code execution are outside it.

Covered Models. Anthropic designates Claude Mythos 5.1, Claude Fable 5.1, Claude Mythos 5 and Claude Fable 5 as Covered Models. Their prompts and completions are retained for at least 30 days, the policy applies "wherever Covered Models are offered, including third-party cloud platforms", and the Service Specific Terms state that Anthropic's right to retain and review that data "supersedes any modified retention commitments (e.g., ZDR)". Anthropic has offered eligible customers time-limited ZDR for Fable 5 and Fable 5.1 as a transition to its Enterprise Frontier Safeguards programme.

Anthropic's commercial defaults match OpenAI's on retention, since both delete API inputs and outputs within 30 days and gate anything shorter behind ZDR approval. On consumer plans, whether chats are used for training depends on each user's own setting, so staff use of personal Claude accounts raises the same shadow-use question as personal ChatGPT accounts. - My read

EU / UK transfer position

Anthropic relies on Standard Contractual Clauses (SCCs) (Module Two and Module Three) for EU transfers, incorporated through the DPA. The DPA explicitly adapts the SCCs for the UK International Data Transfer Addendum (the addendum laid before UK Parliament on 2 February 2022) and includes an addendum for transfers subject to Swiss data protection law. The SCCs are governed by Irish law, with the Irish courts as forum, and Anthropic undertakes to provide the information reasonably necessary for a customer to complete a transfer impact assessment.

Anthropic holds no Data Privacy Framework certification. The participant registry at dataprivacyframework.gov was searched again on 4 October 2026, active and inactive, with a control query that returned Microsoft, and returned nothing for Anthropic (317 active and 341 inactive organisations file under A, and it is not among them). Neither the DPA nor the privacy policy now in force, effective 10 September 2026, mentions the framework, and OpenAI is in the same position. The SCCs and the Swiss and UK addenda in the DPA carry the transfer on their own, so a transfer impact assessment is required.

EU data residency. Anthropic's own API offers no EU option. Inference geography can be "global" or "us", and the US is the only location for data at rest. Anthropic lists European processing as included for Claude on Amazon Bedrock and on Google Cloud, and as coming soon on Microsoft Foundry.

On Bedrock the position depends on the model. Claude Opus 5 and Sonnet 5 can run in-Region in Ireland (eu-west-1) and Stockholm (eu-north-1), and Sonnet 5 also in London (eu-west-2). Claude Fable 5, Fable 5.1 and Mythos 5.1 are available in every EU Region through global routing only, which AWS describes as having no geographic restrictions (AWS model and Region compatibility table, checked 4 October 2026). If your processing must stay in Europe, choose the model with this in mind.

Significant warning: when Anthropic models are accessed via Microsoft 365 Copilot, Anthropic processing is out of scope for the Microsoft EU Data Boundary. Microsoft has enabled Anthropic models by default for most commercial tenants since 2026-01-07, but not in the EU, EFTA or UK, where the Anthropic subprocessor setting is off by default. A separate setting that makes Anthropic the default model for Copilot in Word, Excel and PowerPoint is on by default for EU, EFTA and UK tenants created after 25 March 2026. EU and UK buyers should check both settings and record the decision.

Security documentation

Anthropic's trust center at trust.anthropic.com lists:

• SOC 2 Type 2 (the 2025 report, with a bridge letter dated August 2026)
• ISO 27001:2022
• ISO/IEC 42001:2023
• CSA STAR, through the combined SOC 2 and CSA STAR Level 2 report
• HIPAA Business Associate Agreement (BAA): available for qualifying healthcare customers

HIPAA & BAA position

Anthropic will sign a HIPAA Business Associate Agreement (BAA) for what it calls its HIPAA-ready services. Its privacy-centre article on BAAs for commercial customers (updated 14 October 2026) gives as examples "use of our first-party API, Claude in Microsoft Foundry, or Enterprise plans". The Team plan is not listed among the HIPAA-ready services or in the article's coverage tables.

• Enterprise: coverage is not automatic. The article states that "Standard Claude Enterprise plans do not include BAA coverage without action from a Primary Owner". The Primary Owner must activate HIPAA compliance in the organisation settings under "Data and privacy" and accept Anthropic's BAA there, and the BAA covers only the single organisation that accepted it. Covered features are chat, projects and artifacts in chat, file creation and code execution (excluding network access and external websites), voice, web search and Research. Skills, MCP connectors, Enterprise Search and Claude in Chrome can be used, but the BAA does not cover them (for the last three, data sent to third parties), and some features of Claude for Microsoft 365 are in beta and not covered. The BAA excludes features in beta, which the article lists as including Claude in Office, Claude Design, Claude Slides and Claude Docs. The article marks this Enterprise coverage as applying under "versions of the BAA accepted after 12/2/25".
• Cowork and Claude Code on Enterprise: coverage depends on where the session runs. Cowork in Claude Desktop, and Claude Code in the terminal or in the Code tab of Claude Desktop, run on the member's own computer ("local mode") and are covered when the Primary Owner also applies a separate HIPAA configuration to those products. Under that configuration, Claude Code is covered only when members sign in with their Enterprise account and connect directly to Anthropic. Without that configuration Cowork is not covered, and Claude Code is covered only through zero data retention for Claude Code, which is available for qualified accounts only. Cowork in the cloud is not covered and is not available once the HIPAA configuration is applied, and the same applies to Dispatch, Claude Code on the web and the other cloud and remote features. Claude Code used through Amazon Bedrock, Google Cloud's Gemini Enterprise Agent Platform (formerly Vertex AI), Microsoft Foundry, an LLM gateway or the VS Code and JetBrains extensions is not covered, and Claude Code with a Claude Console API key is covered only where the Console organisation has zero data retention.
• API: the article lists the Messages API (with prompt caching, structured outputs, memory, web search, the bash tool and the text editor tool) and the Token Counting, Models, Org Management and Compliance APIs as covered, the Messages API features under "versions of the BAA accepted after 4/1/26". The Batch API, Files API, Skills API, code execution, computer use and web fetch are not covered and are not accessible to HIPAA-ready API organisations, data sent to third parties through external MCP is not covered, and the BAA excludes the Claude Console.
• Anthropic's own sources disagree on two points. On how the API BAA is enabled, the privacy-centre BAA article (updated 14 October 2026) states: "To use the 1P API with PHI, your organization's Primary Owner will need to sign a BAA and then reach out to your Anthropic contact or our Sales team to get this turned on". The API and data retention page of Anthropic's developer documentation (undated, read 15 October 2026) states instead: "Most organizations can enable it directly in the Claude Console with Anthropic's standard BAA; organizations that require a negotiated BAA should work with their account team." On Microsoft Foundry, the BAA article lists Claude in Microsoft Foundry among the HIPAA-ready services and marks "Claude API through Microsoft Foundry (Anthropic-hosted or Microsoft-hosted)" as eligible under the BAA, while the developer documentation states: "Claude Platform on AWS and Microsoft Foundry: HIPAA readiness is not available on these platforms." A buyer should obtain Anthropic's written confirmation of both points before relying on either source.
• HIPAA readiness is an alternative to ZDR. Anthropic's documentation describes HIPAA readiness as applying "a broader set of privacy and security safeguards than ZDR (encryption, access controls, and audit logging that protect PHI throughout its lifecycle) rather than requiring immediate deletion", and states that an organisation handling PHI does not also need ZDR. Once enabled, the configuration is permanent and is enforced at organisation level, so an organisation that needs both HIPAA-ready and general-purpose access should use separate organisations.
• Not covered by HIPAA readiness on the API, according to the developer documentation (read 15 October 2026): consumer plans, processing PHI through the Claude Console (enabling HIPAA readiness from the Console is supported), Amazon Bedrock and Gemini Enterprise Agent Platform (which have their own compliance documentation), Claude Platform on AWS and Microsoft Foundry (where the documentation says it is not available, which the BAA article contradicts for Foundry), third-party integrations, Claude Code, and beta features unless listed as eligible. That page covers the API only; Claude Code on an Enterprise plan is covered only in the cases the BAA article describes, set out above.

The BAA is the contractual piece. HIPAA's Security Rule (risk analysis, minimum-necessary, workforce training, audit controls, breach notification) stays on the covered entity. See HIPAA for AI tools for the full walkthrough across vendors.

AI Act role + risk classification

• Role: Anthropic is a provider of general-purpose AI models. GPAI obligations under Articles 51-55 apply to Anthropic.
• Your role as a buyer: deployer when your staff use Claude under your authority, with separate obligations. If you build your own AI system on the API and place it on the market or put it into service under your own name, you are the provider of that system (Article 3(3)) and a downstream provider of a system that integrates Anthropic's model (Article 3(68)).
• Risk tier: the tier depends on the use, as for OpenAI. A use outside Article 5 and the high-risk categories is limited or minimal risk. An Annex III use brings the deployer obligations in Article 26 from 2 December 2027, whichever model you use, unless the Article 6(3) exception applies (an Annex III system that profiles natural persons is always high-risk). A buyer that puts Claude, which is not classified as high-risk, to an Annex III use should assess whether it has become the provider of a high-risk system under Article 25(1)(c).

Anthropic publishes a Responsible Scaling Policy (version 3.4, effective 8 July 2026), which ties its safeguards to capability thresholds and, since version 3.0, involves publishing Frontier Safety Roadmaps and Risk Reports (the latest redacted Risk Report is dated August 2026). It can be filed as evidence of the provider's own governance.

DPIA prompts (for your use case)

1. Are you using the API/Team/Enterprise tier or claude.ai consumer? On consumer plans each user decides whether chats and coding sessions are used for training (existing users had until 8 October 2025 to decide), so chats from a staff member's personal account may be used for training if that person allowed it.
2. Are you accessing Claude via Microsoft 365 Copilot? If yes, processing falls outside the EU Data Boundary. In EU, EFTA and UK tenants the Anthropic subprocessor setting stays off unless an admin opts in, but Copilot in Word, Excel and PowerPoint uses Anthropic by default in tenants there created after 25 March 2026 unless an admin changes that setting.
3. Special-category data: same Article 9 question as OpenAI. Staff can paste anything; UI controls and training matter.
4. AI Act Annex III applicability: if your use case is in recruitment, credit, education, law enforcement, migration, or justice, the high-risk deployer obligations apply from 2 December 2027 unless the Article 6(3) exception applies, and you should assess whether the use has made you the provider under Article 25(1)(c).
5. API log retention: record the 30-day window from the Privacy Center in your retention schedule, together with the two-year period that applies to flagged content. If you need shorter retention, ZDR is approval-gated and requested through Anthropic's sales team, and it is not available for Covered Models except under the time-limited arrangement described above.

Unresolved questions / red flags

• Consumer-tier training depends on each user's setting. Since the consumer-terms update of 28 August 2025, users of Claude Free, Pro and Max decide whether their chats and coding sessions are used to train models, with up to five years' retention where they allow it. An organisation that lets staff use personal Claude accounts for work cannot rely on Anthropic's commercial no-training terms for that use.
• Microsoft 365 Copilot integration moves Anthropic processing out of the EU Data Boundary wherever Copilot uses Anthropic models. In the EU, EFTA and UK the Anthropic subprocessor setting is off by default, but the Word, Excel and PowerPoint setting is on by default for tenants there created after 25 March 2026.
• Anthropic's own API has no EU residency option. European processing depends on the cloud platform and on the model, and the newest models run on global routing only on Bedrock.
• Buyer records frequently name the wrong transfer mechanism. Anthropic is regularly recorded as DPF-certified in records of processing. It is not on the participant list. The SCCs and the UK Addendum in the DPA are what the transfer runs on, and they require a transfer impact assessment.
• Embeddings story has shifted through the Voyage acquisition. If your stack relies on Anthropic embeddings, confirm the current product / term shape.

Related profiles

• OpenAI - same general-purpose LLM category, different defaults
• Microsoft 365 Copilot - embeds Anthropic models out of EU Data Boundary scope
• Perplexity - routes to Anthropic models, applying Anthropic's terms transitively

Sources checked

• https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa - corroborated 2026-04-29
• https://trust.anthropic.com/ and https://trust.anthropic.com/subprocessors - certifications, documents and the 20-entry subprocessor list - checked 2026-10-04
• https://www.anthropic.com/legal/data-processing-addendum (effective 24 February 2025), https://www.anthropic.com/legal/commercial-terms (effective 17 June 2025) and https://www.anthropic.com/legal/service-specific-terms (effective 31 August 2026) - checked 2026-10-04
• https://platform.claude.com/docs/en/manage-claude/data-residency and https://platform.claude.com/docs/en/manage-claude/api-and-data-retention - inference geography, workspace geography, ZDR and HIPAA readiness - checked 2026-10-04; the HIPAA readiness section of the second page re-checked 2026-10-15
• https://privacy.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers (updated 2026-10-14) - BAA activation by the Primary Owner and coverage by product, feature and surface - checked 2026-10-15
• https://support.claude.com/en/articles/15425695-covered-models (dated 1 September 2026) and https://claude.com/regional-compliance - checked 2026-10-04
• https://docs.aws.amazon.com/bedrock/latest/userguide/models-region-compatibility.html - in-Region, geographic and global availability of Claude models in EU Regions - checked 2026-10-04
• dataprivacyframework.gov participant registry, active and inactive, with a control query - checked 2026-10-04
• Regulation (EU) 2024/1689 (the AI Act), Articles 3, 6, 25 and 26 and Annex III, and Regulation (EU) 2026/1744 (the Digital Omnibus on AI), amending Article 25(2) and (4) and setting 2 December 2027 for Annex III high-risk systems in Article 113, both from the Publications Office (https://publications.europa.eu/resource/celex/32024R1689 and https://publications.europa.eu/resource/celex/32026R1744) - checked 2026-10-15
• https://privacy.claude.com/en/articles/7996866 ("How long do you store my organization's data?", article dated 2026-07-01) - the 30-day commercial deletion window and its exceptions - checked 2026-09-17
• Microsoft Foundry documentation on Anthropic as subprocessor and EU Data Boundary scope - 2026-04-29
• https://www.anthropic.com/news/updates-to-our-consumer-terms (28 August 2025) - the consumer training choice, the 8 October 2025 deadline for existing users, five-year retention where training is allowed and the exclusion of services under the Commercial Terms - checked 2026-10-15
• https://privacy.claude.com/en/articles/10023548-how-long-do-you-store-my-data (dated 1 July 2026) - consumer retention, including up to 5 years in training pipelines where training is allowed, feedback retention and Incognito chats - checked 2026-10-15
• Anthropic-in-Copilot default-enable announcement 2026-01-07
• https://www.anthropic.com/responsible-scaling-policy - Responsible Scaling Policy versions (3.4 effective 8 July 2026), Frontier Safety Roadmaps and Risk Reports - checked 2026-10-15

Related reading

• DPA for AI vendors - the eight clauses to check on any AI vendor DPA, with Anthropic's 30-day retention default put in context
• EU AI Act for AI buyers - deployer-side obligations for UK and EU buyers running Claude through the API or Enterprise tier
• HIPAA for AI tools - BAA gate and Security Rule checklist for US healthcare buyers using Claude
• OpenAI vs Anthropic DPA - head-to-head on the two most-asked-about API vendors
• Copilot 365 vs Google Workspace AI compliance - relevant because Anthropic became a Copilot subprocessor on 2026-01-07
• Practitioner how-to (Janus Compliance): Is the Claude API GDPR compliant? - configuring the GDPR-compliant path step by step (DPA, residency, DPIA, transfers)
• Templates (Janus Compliance, which publishes CompanyScope; £49): AI API GDPR Compliance Pack - editable Word templates for the provider contract review, DPIA, transfer assessment, privacy notice wording and records of processing, covering OpenAI, Anthropic and Google, with provider positions as published on 4 October 2026

For ongoing AI compliance support, work with Janus DPO-as-a-Service. For other vendors, browse the full index, or see real agent failures analysed legally in the AI Agent Incident Register.