Claude (Anthropic) - GDPR & Data Privacy Overview for European Clients

Version: June 2026 - prepared by WAIMAKERS B.V.

1 Purpose

This overview explains how Claude tiers (Free, Pro, Max, Team, Enterprise, and API) handle data in relation to GDPR, with a focus on European customers (pricing in EUR where available).

2 Comparison of Claude Tiers (EU focus)

• Guide prices based on publicly available information as of June 2026. Final EUR amounts and VAT depend on billing country and tax status.

Notes for Europe

• Commercial vs Consumer: Anthropic's Commercial Terms state that Anthropic may not train models on Customer Content from Services. This applies to Claude for Work / Team (Standard and Premium), Enterprise, and API under those Commercial Terms. The Standard vs Premium distinction affects usage limits and features, not the no-training position. Consumer tiers (Free/Pro/Max): As of Oct 8, 2025, consumer plans default to opt-in for training. Data may be retained for up to 5 years for training unless opted out. Toggle at claude.ai/settings/data-privacy-controls. Incognito mode offers chats that are not saved to your history and are not used for training (still subject to ~30-day retention).
• EU data residency - critical distinction: The direct Anthropic API offers only "us" and "global" inference geographies - there is no dedicated EU-only option yet. For an EU-residency deployment path, use Claude through properly configured AWS Bedrock EU inference profiles or Google Cloud Vertex AI EU regional endpoints (see Section 2a below).
• Retention: API inputs/outputs default to deletion within 30 days, with exceptions for longer-retention features, usage-policy enforcement, legal requirements, or separate agreements such as ZDR. Enterprise admins can set custom data retention controls (org-level). Consumer tiers with training enabled: 5-year retention; with training off: 30-day retention.
• Pricing in EUR: Team Standard at $25/user/month; Team Premium at $125/user/month; Enterprise custom pricing. Pro commonly appears as €18 + VAT in the Netherlands. Max consumer plan available at $100-$200/month (~5×/20× Pro limits).
• ISO 27001 + ISO 42001: Anthropic holds both ISO 27001:2022 (Information Security) and ISO 42001 (AI Management System) certifications, plus SOC 2 Type I & II.
• DPA: Anthropic states its DPA with SCCs is automatically incorporated into the Commercial Terms; customers should review the current DPA and platform-specific terms before deployment.
• Consumer opt-in-by-default for training (Oct 8, 2025): Per Anthropic's updated consumer terms, consumer plans (Free/Pro/Max) default to opt-in for model training. Users should actively verify their training opt-out status in account settings.
• M365 Copilot integration: Anthropic/Claude is available as a Microsoft 365 Copilot subprocessor for supported Excel and PowerPoint Copilot experiences (Word support is scheduled for summer 2026). Microsoft says the app-level setting is on by default for EU/EFTA/UK tenants created after March 25, 2026; processing occurs outside the EU Data Boundary and must be explicitly governed if enabled.
• Claude Code: Anthropic’s developer CLI is governed by Commercial Terms for Team/Enterprise/API users. When used through Bedrock or Vertex AI, your existing commercial agreement applies. Claude Code is eligible for ZDR via Commercial API keys or Claude Enterprise; per Anthropic's Claude Code legal docs, an existing BAA automatically extends to cover Claude Code once the customer has executed a BAA and has Zero Data Retention (ZDR) activated (ZDR is enabled per organization).

2a EU Data Residency via Cloud Providers (NEW)

This is the most significant development for EU customers. Claude is available through both AWS Bedrock and Google Cloud Vertex AI, where EU regional configuration can support an EU-residency deployment path.

AWS Bedrock - EU Cross-Region Inference

Claude models are available via EU inference profiles designed to keep processing within the configured EU regions:

When using EU inference profiles, AWS’s DPA applies - not Anthropic’s consumer terms. Anthropic does not retain prompts/outputs for training when accessed via Bedrock.

Note: The AWS European Sovereign Cloud (eusc-de-east-1) launched Jan 2026, but Claude models are not yet available there.

Google Cloud Vertex AI - EU Regional Endpoints

Claude availability on Vertex AI is regional and model-dependent. Google Cloud currently lists EU regional endpoints including:

Using regional endpoints is the EU-residency path for Vertex AI deployments, subject to the selected model and region being supported. Google Cloud’s DPA applies. Regional endpoints carry a 10% premium over global endpoints.

Direct Anthropic API - No EU Guarantee

The direct API offers an inference_geo parameter, but only "us" and "global" are available. With "global", inference may run in Europe, but this is not guaranteed. Workspace data storage is US only. Additional regions are planned but no timeline is given.

Bottom line: For GDPR-compliant EU deployment, route through AWS Bedrock EU profiles or Vertex AI EU regional endpoints.

3 Recommendations (GDPR-first)

• For business processing of personal data, prefer Claude Team or Enterprise deployed through AWS Bedrock (EU profiles) or Google Vertex AI (EU regional endpoints) when EU residency is required.
• For API usage, the direct Anthropic API does not guarantee EU-only processing. Use Bedrock or Vertex AI instead, and enable Zero Data Retention if required.
• For consumer plans (Free/Pro/Max), immediately verify your opt-out status at claude.ai/settings/data-privacy-controls (Oct 2025 policy change defaults to opt-in for training with 5-year retention). Use Incognito mode for ephemeral chats. Do not process personal data on consumer plans.
• For regulated data (special categories), complete a DPIA, sign the DPA, configure enterprise retention, SSO, and consider ZDR.
• For Claude Code (developer CLI), route through Bedrock or Vertex AI for EU compliance, and enable ZDR for confidentiality. For PHI workflows requiring a BAA, note Claude Code is covered only when you have executed a BAA and enabled Zero Data Retention (ZDR) on the organization; activate both (and confirm the supported deployment path with Anthropic) before processing PHI in Claude Code.

4 Disclaimer

This analysis is for information only (not legal advice). Verify current terms directly with Anthropic before deployment.

---

References

• https://www.anthropic.com/privacy - Anthropic Privacy Policy
• https://privacy.anthropic.com/en/articles/9858051-privacy-policy-and-terms-of-service-updates-august-28-2025 - Privacy Policy Updates (August 28, 2025)
• https://www.anthropic.com/news/anthropic-privacy-commitment - Anthropic Privacy Commitment
• https://www.anthropic.com/legal/commercial-terms - Anthropic Commercial Terms (effective June 17, 2025)
• https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data - Anthropic commercial data retention policy
• https://platform.claude.com/docs/en/manage-claude/api-and-data-retention - Anthropic API retention and ZDR scope
• https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa - Anthropic DPA availability
• https://support.claude.com/en/articles/9267385-does-anthropic-act-as-a-data-processor-or-controller - Claude for Work processor/controller explanation
• https://platform.claude.com/docs/en/build-with-claude/data-residency - Anthropic Data Residency Documentation
• https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html - AWS Bedrock EU Cross-Region Inference Profiles
• https://docs.cloud.google.com/vertex-ai/generative-ai/docs/learn/locations - Vertex AI EU Locations for Claude
• https://trust.anthropic.com - Anthropic Trust Center (ISO 27001, ISO 42001, SOC 2)
• https://code.claude.com/docs/en/legal-and-compliance - Claude Code Legal and Compliance
• https://learn.microsoft.com/en-us/microsoft-365/copilot/copilot-anthropic-apps - Anthropic models in Microsoft 365 Copilot apps

---

Disclaimer

This overview is intended solely as an informative tool. We strongly advise customers to thoroughly review all Data Processing Agreements (DPAs) and privacy documentation before deploying Claude in production environments - especially when personal data or proprietary business information are processed. WAIMAKERS applies this same principle internally; all tools we use have been thoroughly assessed and included in our own privacy and security documentation. Customers should always carefully evaluate the official documentation, terms, and DPAs of each AI provider they use. WAIMAKERS cannot be held legally liable for any mistakes, errors, inaccuracies, or for the accuracy, currency, or completeness of the information in this document; the ultimate responsibility for GDPR compliance rests with the customer.

Prepared and issued by WAIMAKERS B.V. - June 2026.