Is Anthropic Claude GDPR compliant?

Claude API is GDPR compliant for commercial API customers who have executed Anthropic's Data Processing Agreement. Anthropic does not use API customer data to train Claude models by default. Claude.ai (the consumer and Team products) has separate terms, Claude.ai Team includes GDPR-compliant DPA terms, while Claude.ai free and Pro plans use consumer terms without a DPA and should not be used for work data containing personal information.

Does Anthropic train Claude on your API prompts?

Anthropic does not use Claude API customer inputs and outputs to train Claude models by default. This is stated in Anthropic's usage policies and API terms. Claude.ai Team customers also have training opt-out as part of their plan. Free and Pro Claude.ai users are subject to consumer terms where data handling differs. Always check Anthropic's current privacy documentation for the definitive position.

What is Anthropic's Data Processing Agreement?

Anthropic offers a Data Processing Addendum (DPA) for API customers and Claude.ai Team customers. The DPA covers Anthropic's processing of personal data on your behalf, includes Standard Contractual Clauses for EU data transfers, and specifies the security measures Anthropic applies. API customers should review the current DPA available in Anthropic's console or legal documentation.

What SOC 2 controls apply when using Claude API in our product?

If you build Claude into your product, SOC 2 requirements include: CC9.1 (Anthropic as a vendor in your inventory), CC6 (access controls on Claude API usage, who can call it, with what data), CC2 and CC3 (risk assessment of AI use in your product), and specific controls around PII handling before API calls (you must strip PII before sending to Claude if your prompts may contain personal data). Your auditor will ask how you prevent sensitive customer data from flowing to third-party AI providers.

Where does Anthropic process data?

Anthropic processes Claude API data in the United States. Anthropic's DPA includes Standard Contractual Clauses for transfers of EU personal data to the US. If EU data localization is a strict requirement, evaluate whether SCCs are sufficient for your specific regulatory context, as US-based processing may be acceptable under SCCs for most commercial use cases.

Anthropic Claude GDPR and SOC 2 compliance: API and Claude.ai guide

Anthropic's Claude is widely used both as an API embedded in SaaS products and as Claude.ai for individual or team productivity. The compliance requirements differ significantly depending on which product you use and how you use it.

Claude AI processes 3 data categories that require a DPA for SOC 2

The products and their compliance posture

Claude API: Direct API access for developers building AI into their products. Commercial API accounts with an Anthropic DPA in place have strong GDPR and SOC 2 posture. Anthropic does not use API data to train models by default.

Claude.ai Team: The enterprise-grade version of Claude.ai, designed for company use. Includes GDPR-compliant DPA terms and training opt-out. This is the appropriate tier for companies using Claude.ai for work.

Claude.ai Pro: Individual paid subscription. Consumer terms. Does not include a GDPR DPA. Not appropriate for processing work data containing personal information.

Claude.ai Free: Consumer terms. No DPA. Not appropriate for work data.

The threshold for GDPR compliance: Claude API with DPA, or Claude.ai Team. If employees are using Claude.ai Pro or Free with work data, that usage is not covered by a GDPR-compliant processing agreement.

GDPR requirements

Data Processing Agreement

Anthropic's Data Processing Addendum is available for API customers via the Anthropic console and for Claude.ai Team customers as part of the plan. The DPA covers:

Anthropic's role as a data processor for your personal data
The specific security measures Anthropic applies
Standard Contractual Clauses for transfers of EU personal data to US infrastructure
Sub-processor disclosure and notification obligations

To execute the DPA, review the current process in your Anthropic console or contact Anthropic's sales team for Team and enterprise plans.

Training data commitment

Anthropic's API terms state that inputs and outputs from API usage are not used to train Claude models. This commitment is a core part of the commercial API terms. For Claude.ai Team, the same commitment applies.

Verify the current state by reviewing Anthropic's usage policy at anthropic.com, this is the authoritative source, as the specific terms have been updated as the product has matured.

Data residency

Anthropic processes Claude API data in the United States. Anthropic does not currently offer EU data residency for Claude API. The DPA includes SCCs (Standard Contractual Clauses) for transfers of EU personal data to the US, which provides the legal mechanism for international transfers under GDPR.

For organizations where EU data residency is an absolute contractual requirement (rather than a preference), this means evaluating whether SCC-based transfers to US infrastructure are acceptable. For most commercial B2B contexts, SCCs are the standard mechanism and are GDPR-compliant.

PII in prompts

GDPR's data minimization principle applies to what you send to Claude. Even with a DPA in place, you should design your Claude API usage to minimize personal data in prompts. For compliance automation specifically, strip or hash identifiers before sending evidence to Claude, send "User count: 47, MFA enabled: 43" rather than names and email addresses.

SOC 2 requirements

Building Claude into your product

If you are building Claude API into your SaaS product, your auditor will examine:

CC9.1, Vendor management: Anthropic must be in your vendor inventory. Document what data flows to the API, the DPA status, and Anthropic's security certifications (SOC 2 Type 2 report, available via Anthropic's trust center).

PII stripping before API calls: This is the most important control. Your architecture should strip or hash personal identifiers before any prompt reaches the Claude API. Sending raw customer names, emails, or IDs to a third-party AI provider is both a GDPR issue and a SOC 2 finding. This is non-negotiable.

Token cap enforcement: Implement per-customer daily token caps to prevent runaway AI costs and ensure that a single customer cannot cause disproportionate API usage. Document this control for auditors.

Audit logging: Log every Claude API call with: tenant ID, model used, token count, timestamp, and classification result, never raw prompt content. This gives auditors the evidence they need without exposing sensitive data in your logs.

Prompt injection defenses: If customer data flows into your prompts (e.g., you are summarizing customer-uploaded documents), implement prompt injection defenses to prevent malicious content from manipulating Claude's behavior.

Using Claude.ai Team for internal use

For teams using Claude.ai as a productivity tool:

CC9.1: Add Anthropic/Claude.ai Team to your vendor inventory. Note: AI assistant tool, data processed includes employee prompts which may contain internal business information.

CC6: Document who has Claude.ai Team accounts, how accounts are provisioned, and your offboarding process for departing employees.

CC1: Your acceptable use policy should address Claude.ai specifically, what data classifications are appropriate for Claude.ai prompts, and whether customer personal data should be shared with Claude.ai.

What compliance teams using Claude should know

Xorabyte's AI gateway follows these exact principles when using Claude for evidence classification:

PII is stripped before every Claude API call via the stripPII() function
Claude receives only: control ID, evidence type, counts, booleans, and configuration states, never raw names, emails, or IDs
Every Claude call is logged to the audit log with model, token count, tenant ID, and result, never raw prompt content
Per-customer daily token caps are enforced before every API call
Claude is scoped to a single question per call: "Does this evidence satisfy Control X, pass, fail, or partial?"

This architecture satisfies both GDPR data minimization and SOC 2 AI vendor controls simultaneously.

Getting the Claude API audit-ready comes down to mapping its data flows to your SOC 2 and GDPR controls, confirming Anthropic's DPA and sub-processors, and keeping that evidence current as the service changes. If you would rather a security leader owned that work than track it in a spreadsheet, book a call.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.