Claude (Anthropic) - GDPR & Data Privacy Overview for European Clients

Version: March 2026 - prepared by WAIMAKERS B.V.

1 Purpose

This overview explains how Claude tiers (Free, Pro, Max, Team, Enterprise, and API) handle data in relation to GDPR, with a focus on European customers (pricing in EUR where available).

2 Comparison of Claude Tiers (EU focus)

Tier	Intended use	GDPR posture	EU data-residency	Training use of your data	Retention	Guide price (EUR)*	Key notes / DPA quote
Free (web/app)	Individual, light use	⚠️ Consumer terms	❌ No (global)	Consumer policy; users can opt out of training; Incognito available for ephemeral chats	Reports indicate 30 days in logs; policy changes under review (see refs)	€0	Incognito mode for unsaved chats; memory features not included.
Pro (web/app)	Power users	⚠️ Consumer terms	❌ No (global)	Same as Free (consumer policy)	As above	~€18 + VAT (NL example shows €21.78 incl. VAT)	EU press: Pro at €18 ex VAT in NL.
Max (web/app)	Heavy use	⚠️ Consumer terms	❌ No (global)	Same as Free/Pro (consumer policy)	As above	~€100-€200 (converted; billed in local currency at checkout)	Two options reported: ~5× and ~20× Pro limits.
Team Standard	SMB/teams	✅ Commercial terms	✅ Multi-region incl. EU (effective Aug 19, 2025)	By default not used for training for commercial products	Org controls; defaults similar to API; admin features	$25 / user / mo (approx. €23 excl. VAT)	Central billing; SSO; higher limits. Min 5, max 150 seats.
Team Premium	Power teams	✅ Commercial terms	✅ Multi-region incl. EU	By default not used for training	Org controls; admin features	$125 / user / mo (approx. €115 excl. VAT)	6.25× Pro usage. Annual: $100/seat/mo.
Enterprise	Enterprise	✅ Commercial terms	✅ Multi-region incl. EU; enhanced controls	By default not used for training	Custom retention controls (org-level)	Custom	SSO/SAML, SCIM, audit logs, DPA & retention controls; 500K-1M context.
Anthropic API	Builders / integrations	✅ Commercial terms	✅ EU processing via Bedrock/Vertex (direct API: global only)	By default not used for training	7 days default (reduced from 30); ZDR by agreement	Usage-based (list in USD; EU billed in EUR)	API I/O logs deleted within 7 days unless ZDR or legal need.

• Guide prices based on publicly available information as of March 2026. Final EUR amounts and VAT depend on billing country and tax status.

Notes for Europe

• Commercial vs Consumer: Anthropic states commercial products (Team, Enterprise, API) are not used for model training by default. Consumer tiers (Free/Pro/Max): As of Oct 8, 2025, consumer plans default to opt-in for training. Data may be retained for up to 5 years for training unless opted out. Toggle at claude.ai/settings/data-privacy-controls. Incognito mode offers ephemeral chats without retention.
• EU data residency — critical distinction: The direct Anthropic API offers only "us" and "global" inference geographies — there is no dedicated EU-only option yet. For guaranteed EU data residency, use Claude through AWS Bedrock or Google Cloud Vertex AI (see Section 2a below).
• Retention: API defaults to 7 days (reduced from 30; ZDR by agreement). Enterprise admins can set custom data retention controls (org-level). Consumer tiers with training enabled: 5-year retention; with training off: 30-day retention.
• Pricing in EUR: Team Standard at $25/user/month; Team Premium at $125/user/month; Enterprise custom pricing. Pro commonly appears as €18 + VAT in the Netherlands. Max consumer plan available at $100-$200/month (~5×/20× Pro limits).
• ISO 27001 + ISO 42001: Anthropic holds both ISO 27001:2022 (Information Security) and ISO 42001 (AI Management System) certifications, plus SOC 2 Type I & II.
• New DPA (Jan 1, 2026): Anthropic’s updated DPA is automatically incorporated into Commercial Terms. It covers SCCs for international transfers and establishes the customer as data controller.
• Dark pattern controversy (Aug-Oct 2025): Anthropic received regulatory scrutiny regarding the opt-in-by-default approach for consumer training. Users should actively verify their training opt-out status in account settings.
• M365 Copilot integration: Anthropic/Claude was added as a Microsoft 365 Copilot subprocessor (Jan 2026). For EU tenants, this integration is excluded by default from the EU Data Boundary and must be explicitly governed if enabled.
• Claude Code: Anthropic’s developer CLI is governed by Commercial Terms for Team/Enterprise/API users. When used through Bedrock or Vertex AI, your existing commercial agreement applies. HIPAA/BAA extends to Claude Code when ZDR is activated.

2a EU Data Residency via Cloud Providers (NEW)

This is the most significant development for EU customers. Claude is now available through both AWS Bedrock and Google Cloud Vertex AI with full EU data residency guarantees.

AWS Bedrock — EU Cross-Region Inference

All current Claude models are available via EU inference profiles that guarantee data stays within EU regions:

Model	EU Profile ID	EU Regions
Claude Opus 4.6	eu.anthropic.claude-opus-4-6-v1	Frankfurt, Ireland, Paris, Stockholm, Milan, Spain
Claude Sonnet 4.6	eu.anthropic.claude-sonnet-4-6	Frankfurt, Ireland, Paris, Stockholm, Milan, Spain
Claude Opus 4.5	eu.anthropic.claude-opus-4-5-20251101-v1:0	Same as above
Claude Sonnet 4.5	eu.anthropic.claude-sonnet-4-5-20250929-v1:0	Same as above
Claude Haiku 4.5	eu.anthropic.claude-haiku-4-5-20251001-v1:0	Same as above + Zurich

When using EU inference profiles, AWS’s DPA applies — not Anthropic’s consumer terms. Anthropic does not retain prompts/outputs for training when accessed via Bedrock.

Note: The AWS European Sovereign Cloud (eusc-de-east-1) launched Jan 2026, but Claude models are not yet available there.

Google Cloud Vertex AI — EU Regional Endpoints

All current Claude models are available in 10 EU regions via Vertex AI:

Region	Location
europe-west1	Belgium
europe-west2	London
europe-west3	Frankfurt
europe-west4	Netherlands
europe-west6	Zurich
europe-west8	Milan
europe-west9	Paris
europe-north1	Finland
europe-central2	Warsaw
europe-southwest1	Madrid

Using regional endpoints guarantees data stays in that region. Google Cloud’s DPA applies. Regional endpoints carry a 10% premium over global endpoints.

Direct Anthropic API — No EU Guarantee

The direct API offers an inference_geo parameter, but only "us" and "global" are available. With "global", inference may run in Europe, but this is not guaranteed. Workspace data storage is US only. Additional regions are planned but no timeline is given.

Bottom line: For GDPR-compliant EU deployment, route through AWS Bedrock EU profiles or Vertex AI EU regional endpoints.

3 Recommendations (GDPR-first)

• For business processing of personal data, prefer Claude Team or Enterprise deployed through AWS Bedrock (EU profiles) or Google Vertex AI (EU regional endpoints) for guaranteed EU data residency.
• For API usage, the direct Anthropic API does not guarantee EU-only processing. Use Bedrock or Vertex AI instead, and enable Zero Data Retention if required.
• For consumer plans (Free/Pro/Max), immediately verify your opt-out status at claude.ai/settings/data-privacy-controls (Oct 2025 policy change defaults to opt-in for training with 5-year retention). Use Incognito mode for ephemeral chats. Do not process personal data on consumer plans.
• For regulated data (special categories), complete a DPIA, sign the DPA, configure enterprise retention, SSO, and consider ZDR.
• For Claude Code (developer CLI), route through Bedrock or Vertex AI for EU compliance. Enable ZDR for HIPAA scenarios.

4 Disclaimer

This analysis is for information only (not legal advice). Verify current terms directly with Anthropic before deployment.

---

References

• https://www.anthropic.com/privacy - Anthropic Privacy Policy
• https://privacy.anthropic.com/en/articles/9858051-privacy-policy-and-terms-of-service-updates-august-28-2025 - Privacy Policy Updates (August 28, 2025)
• https://www.anthropic.com/news/anthropic-privacy-commitment - Anthropic Privacy Commitment
• https://www.anthropic.com/legal/commercial-terms - Anthropic DPA (updated Jan 1, 2026)
• https://platform.claude.com/docs/en/build-with-claude/data-residency - Anthropic Data Residency Documentation
• https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html - AWS Bedrock EU Cross-Region Inference Profiles
• https://docs.cloud.google.com/vertex-ai/generative-ai/docs/learn/locations - Vertex AI EU Locations for Claude
• https://trust.anthropic.com - Anthropic Trust Center (ISO 27001, ISO 42001, SOC 2)
• https://code.claude.com/docs/en/legal-and-compliance - Claude Code Legal and Compliance
• https://learn.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-copilot-subprocessors - Anthropic as M365 Copilot subprocessor (Jan 2026; EU excluded by default)

---

Disclaimer

This overview is intended solely as an informative tool. We strongly advise customers to thoroughly review all Data Processing Agreements (DPAs) and privacy documentation before deploying Claude in production environments - especially when personal data or proprietary business information are processed. WAIMAKERS applies this same principle internally; all tools we use have been thoroughly assessed and included in our own privacy and security documentation. Customers should always carefully evaluate the official documentation, terms, and DPAs of each AI provider they use. WAIMAKERS cannot be held legally liable for any mistakes, errors, inaccuracies, or for the accuracy, currency, or completeness of the information in this document; the ultimate responsibility for GDPR compliance rests with the customer.

Prepared and issued by WAIMAKERS B.V. - March 2026.