--- title: "Anthropic API and GDPR: DPA, EU Data Residency & Compliance Guide" description: "Anthropic API GDPR compliance: DPA availability, EU data residency options, training data opt-out, and how to build GDPR-compliant products with Claude." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/anthropic-api/" language: "en" --- ![Anthropic API GDPR compliance and EU data residency for Germany](https://compound.law/assets/images/tools/tools_3.webp) tools # Anthropic API and GDPR: DPA, EU Data Residency & Compliance Guide 17 April 2026 Short answer The Anthropic API can be used GDPR-compliantly: sign Anthropic's DPA, API inputs are excluded from model training by default, and EU-based inference is available via Amazon Bedrock in Frankfurt — verify DPA scope, transfer mechanisms, AI Act obligations, and works council requirements before deployment. - Sign Anthropic's DPA before processing personal data via the API — establishes the Article 28 processor relationship and includes Standard Contractual Clauses. - Choose EU-based inference via Amazon Bedrock (AWS eu-central-1, Frankfurt) to keep data processing within the EU for the strongest GDPR data residency posture. - Confirm API data is excluded from model training by default and request zero data retention mode for the most sensitive use cases. **The Anthropic API can be used in a GDPR-compliant manner by German companies — but compliance requires deliberate setup.** The API’s default policy of not training on user data removes one of the most common GDPR concerns with consumer AI tools, and Anthropic provides a Data Processing Agreement that includes Standard Contractual Clauses for EU–US transfers. However, data residency decisions, transfer documentation, AI Act obligations, and works council requirements all need to be addressed before deployment. For an overview of how Anthropic API compares with other AI platforms, see the [AI tools assessed by Compound Law](https://compound.law/en-DE/tools/). ## Is the Anthropic API GDPR Compliant? Yes — when correctly configured. The Anthropic API can satisfy **GDPR requirements** under Regulation (EU) 2016/679 if three conditions are met: 1. **Anthropic’s Data Processing Agreement (DPA) is signed.** This establishes Anthropic as an Article 28 processor and governs how your data is handled, including security obligations, subprocessor disclosure, and breach notification. 2. **A valid data transfer mechanism is in place.** The DPA includes **Standard Contractual Clauses (SCCs)** covering EU–US data transfers under GDPR Chapter V. For companies requiring data to remain within the EU, deploying Claude via **Amazon Bedrock with the Frankfurt region (AWS eu-central-1)** eliminates the cross-border transfer entirely. 3. **Your organisation has a documented legal basis.** Typically Article 6(1)(b) (contract performance) or Article 6(1)(f) (legitimate interests) for internal API integrations, or explicit consent where end-users’ personal data is involved. What differentiates the Anthropic API from many consumer AI tools for GDPR purposes: **Anthropic does not use API inputs or outputs to train its foundation models by default.** This removes the training-data risk that makes direct consumer-grade usage of many AI services legally problematic for business deployment in Germany. ## Anthropic’s Data Processing Agreement (DPA) The **Anthropic DPA** is the contractual foundation for any GDPR-compliant API deployment. It is available and can be accepted through the Anthropic Console. Enterprise customers negotiating volume contracts may request a customised DPA with additional terms. Key elements the Anthropic DPA covers: - **Article 28 GDPR processor obligations** — Anthropic commits to process personal data only according to your documented instructions. - **Standard Contractual Clauses (SCCs)** — The 2021 EU SCCs are incorporated to provide a valid legal mechanism for EU–US data transfers under GDPR Chapter V. - **Subprocessors** — Anthropic discloses authorised subprocessors and provides advance notice of changes, with customer objection rights. - **Security measures** — Technical and organisational measures (TOMs) cover encryption in transit and at rest, access controls, and incident response. - **Data breach notification** — Anthropic commits to notify customers of security incidents affecting their data without undue delay. - **Data deletion** — Customer data is deleted upon request or contract termination within defined timeframes. **Customer obligations:** As the data controller, your organisation is responsible for maintaining a valid Record of Processing Activities (ROPA) that includes the Anthropic API deployment, establishing the legal basis for each processing purpose, and ensuring that application users do not submit data outside the documented scope. Legal teams building on the API for client-facing workflows should review the [AI APIs for law firms in Germany guide](https://compound.law/en-DE/compliance/ai-apis-for-law-firms-germany/). ## EU Data Residency for the Anthropic API Anthropic’s direct API (**api.anthropic.com**) routes inference requests to servers in the **United States** by default. The Anthropic DPA covers this transfer through Standard Contractual Clauses, but for German companies requiring data to remain within the EU, there is a dedicated infrastructure path. **Amazon Bedrock with AWS eu-central-1 (Frankfurt)** provides the strongest EU data residency option for Claude models: - Claude models — including Claude 3 Haiku, Sonnet, and Opus — are available on Amazon Bedrock in the Frankfurt region. - Configuring Bedrock with `eu-central-1` keeps model inference and any associated data within **Germany’s geographic boundaries**. - AWS eu-central-1 is backed by the **AWS Data Processing Addendum**, which satisfies Article 28 GDPR processor obligations for the underlying cloud infrastructure. - German companies already running workloads on AWS Frankfurt benefit from consistent data governance across their entire stack. This approach is directly comparable to deploying [Azure OpenAI with Germany West Central data residency](https://compound.law/en-DE/tools/azure-openai/) and is the recommended path for any API deployment involving sensitive personal data, healthcare records, or financial information requiring strict EU data processing controls. **Direct API with SCCs:** For use cases where US-based processing is acceptable with appropriate legal documentation, the Anthropic DPA’s SCCs provide the transfer mechanism. Your organisation must complete a **Transfer Impact Assessment (TIA)** under GDPR Article 46 to document that SCCs provide adequate protection for your specific data flows, taking into account US surveillance law. ## Data Retention and Training Policies One of the most legally significant differences between the Anthropic API and consumer Claude.ai is data handling: - **API default policy:** Anthropic does **not** use API inputs and outputs to train, fine-tune, or improve its foundation models. Submitted data is used only to fulfil the API request. - **Retention period:** By default, Anthropic retains API request and response metadata for a limited period for abuse prevention and operational purposes. The current retention schedule is documented in the Anthropic privacy policy and DPA. - **Zero Data Retention (ZDR) mode:** Enterprise customers can request **Zero Data Retention mode**, under which Anthropic does not persist prompts or completions beyond the API call itself. This is appropriate for deployments involving highly sensitive personal data, attorney-client privileged information, healthcare data, or regulated financial records. - **Consumer Claude.ai:** The consumer-facing Claude.ai product operates under different, more permissive data usage terms. GDPR risk assessments should clearly distinguish between API access and consumer product usage within the same organisation — they are separate products with different legal treatment. Document the applicable retention settings in your ROPA and internal data protection assessments, and review them whenever Anthropic updates its privacy policy. ## Roles Under GDPR: Processor vs. Controller Understanding who carries what GDPR obligation shapes your compliance programme when building on the Anthropic API: **Anthropic as data processor:** When your application submits personal data to the Anthropic API to fulfil a task — for example, processing customer support messages, generating personalised content, or analysing user documents — **Anthropic acts as a data processor** under GDPR Article 4(8). Anthropic processes the data on your documented instructions and is bound by the DPA. **Your organisation as data controller:** The company or developer deploying the API is the **data controller** responsible for: - Determining the purpose and legal basis for processing (GDPR Article 6) - Informing data subjects via a privacy notice that their data may be processed using AI systems - Conducting a **Data Protection Impact Assessment (DPIA)** under GDPR Article 35 if the processing is likely to result in high risk — for example, large-scale automated processing of sensitive personal data or systematic profiling - Documenting the Anthropic API deployment in your ROPA **Anthropic as independent controller:** For internal purposes such as account management, billing, security monitoring, and abuse prevention, Anthropic acts as an independent controller under its own privacy policy. This processing is separate from the processor relationship governed by the DPA. ## EU AI Act Implications Claude models (Claude 3.x Haiku, Sonnet, Opus) are **General Purpose AI (GPAI) models** under the EU AI Act (Regulation EU 2024/1689). This triggers obligations for both Anthropic as the model provider and companies that build products on the API. **Anthropic’s obligations as GPAI model provider (Article 53):** - Maintain and publish technical documentation describing model capabilities, limitations, and training data provenance. - Publish a model card or equivalent transparency documentation for downstream deployers. - Implement a copyright compliance policy under EU Directive 2019/790. - Cooperate with downstream deployers to enable them to meet their own AI Act obligations. **Your obligations as a deployer:** - **Risk classification:** Assess whether your application of Claude falls under the AI Act’s **prohibited practices** (Article 5), **high-risk AI system** categories (Annex III), or the limited/minimal risk tier. Standard business productivity and internal tooling applications typically fall under minimal or limited risk. - **Transparency:** If your application uses Claude to interact with natural persons who might not realise they are communicating with an AI system, you must **disclose the AI interaction** (Article 50 AI Act). - **High-risk systems:** Applications using Claude for CV screening, creditworthiness decisions, or determinations in education, employment, essential services, or law enforcement are **high-risk** under Annex III. These require conformity assessment procedures, human oversight measures, logging, and technical documentation before deployment. - **Professional services:** Law firms, healthcare providers, and financial services using the API for client-facing decisions should review the [professional services AI Act compliance guide](https://compound.law/en-DE/ai-act/professional-services/) and the [legal services AI Act overview](https://compound.law/en-DE/ai-act/legal-services/). ## Setting Up a GDPR-Compliant Anthropic API Integration A practical checklist for German companies and startups deploying the Anthropic API: 1. **Sign the Anthropic DPA** — accept it in the Anthropic Console before any personal data is processed. 2. **Choose your data residency path** — direct API with SCCs plus Transfer Impact Assessment, or Amazon Bedrock Frankfurt for EU-resident processing without cross-border transfer. 3. **Request Zero Data Retention mode** — if the deployment involves sensitive personal data, healthcare records, or legally privileged information. 4. **Document the legal basis** — record the applicable GDPR Article 6 ground and add the Anthropic API to your ROPA. 5. **Conduct a DPIA if required** — high-volume or high-risk processing applications require a Data Protection Impact Assessment under Article 35 before go-live. 6. **Update your privacy notice** — inform end-users that their data may be processed by an AI model provider acting as a sub-processor. 7. **Classify your AI Act risk tier** — determine whether the application is minimal, limited, or high-risk before deployment. 8. **Engage your works council** — if the API deployment changes how employees work in Germany, co-determination rights under §87 BetrVG may apply before rollout. ## Anthropic API vs. Azure OpenAI: EU Compliance Comparison | | Anthropic API (direct) | Anthropic via Bedrock | Azure OpenAI | | ------------------------- | ---------------------------------- | ----------------------------- | ------------------------------------ | | EU data residency | US processing, SCCs cover transfer | AWS eu-central-1 (Frankfurt) | Germany North / Germany West Central | | DPA available | Yes (Anthropic Console) | Yes (AWS DPA + Anthropic DPA) | Yes (Microsoft DPA) | | Transfer mechanism needed | Yes (SCCs + TIA) | No (EU processing) | No (EU processing) | | Training on API data | No (default policy) | No | No | | Zero data retention | Available on request | Available on request | Configurable per deployment | | AI Act model status | GPAI (Anthropic) | GPAI (Anthropic) | GPAI (Microsoft/OpenAI) | [Azure OpenAI](https://compound.law/en-DE/tools/azure-openai/) offers the most mature EU data residency story for companies requiring processing strictly within Germany without routing through AWS infrastructure. [AWS Bedrock](https://compound.law/en-DE/tools/aws-bedrock/) with Claude is the preferred path for organisations already running their stack on AWS Frankfurt. For companies that prefer a fully managed enterprise SaaS product rather than a raw API integration, [Claude Enterprise](https://compound.law/en-DE/tools/claude-enterprise/) provides additional administrative controls and access management. ## Works Council Requirements If the Anthropic API affects how employees work in Germany — automating tasks previously performed by staff, generating content submitted under employees’ names, or processing workplace communications — the **Betriebsrat (works council)** may have co-determination rights under §87(1) BetrVG. This is especially relevant if the API integration could monitor employee activity, influence performance evaluations, or fundamentally change work processes. Engage your works council early: explain the tool’s purpose, address data protection and surveillance concerns, and agree on an appropriate use policy before the deployment goes live. ## How Compound Law Helps - DPA review and gap analysis for Anthropic API deployments - Transfer Impact Assessment (TIA) preparation for EU–US data flows - DPIA preparation for high-volume or sensitive use cases - AI Act risk classification and technical documentation support - Works council coordination and Betriebsvereinbarung negotiation - Ongoing compliance monitoring and policy updates as Anthropic’s terms evolve ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions The Anthropic API can be used in a GDPR-compliant manner when Anthropic's Data Processing Agreement is signed, a valid legal basis under Article 6 GDPR is established, and appropriate data transfer mechanisms (Standard Contractual Clauses) are in place for EU–US data flows. API inputs are not used to train Anthropic's models by default. Yes. Anthropic provides a Data Processing Agreement available through the Anthropic Console covering Article 28 GDPR processor obligations, Standard Contractual Clauses for EU–US transfers, subprocessor disclosure, security measures, breach notification, and data deletion commitments. Anthropic's direct API primarily processes data in the United States, with SCCs covering the data transfer. Companies that deploy Claude through Amazon Bedrock can select AWS eu-central-1 (Frankfurt) to run inference within the EU, which provides a stronger EU data residency posture under GDPR. No. Anthropic explicitly does not use API inputs and outputs to train its foundation models by default. Enterprise customers can additionally request zero data retention mode, where Anthropic does not persist prompts or completions after the API call completes. When processing personal data submitted through the API on behalf of a customer, Anthropic acts as a data processor under GDPR Article 28. The company building the product or service on the API is the data controller, responsible for documenting the legal basis, informing data subjects, and ensuring GDPR compliance. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Anthropic API and GDPR: DPA, EU Data Residency & Compliance Guide", "description": "Anthropic API GDPR compliance: DPA availability, EU data residency options, training data opt-out, and how to build GDPR-compliant products with Claude.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-04-17T00:00:00.000Z", "dateModified": "2026-04-17T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/anthropic-api/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Anthropic API and GDPR: DPA, EU Data Residency & Compliance Guide", "item": "https://compound.law/en-DE/tools/anthropic-api/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is the Anthropic API GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "The Anthropic API can be used in a GDPR-compliant manner when Anthropic's Data Processing Agreement is signed, a valid legal basis under Article 6 GDPR is established, and appropriate data transfer mechanisms (Standard Contractual Clauses) are in place for EU–US data flows. API inputs are not used to train Anthropic's models by default." } }, { "@type": "Question", "name": "Does Anthropic offer a Data Processing Agreement (DPA)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Anthropic provides a Data Processing Agreement available through the Anthropic Console covering Article 28 GDPR processor obligations, Standard Contractual Clauses for EU–US transfers, subprocessor disclosure, security measures, breach notification, and data deletion commitments." } }, { "@type": "Question", "name": "Does Anthropic process API data in the EU?", "acceptedAnswer": { "@type": "Answer", "text": "Anthropic's direct API primarily processes data in the United States, with SCCs covering the data transfer. Companies that deploy Claude through Amazon Bedrock can select AWS eu-central-1 (Frankfurt) to run inference within the EU, which provides a stronger EU data residency posture under GDPR." } }, { "@type": "Question", "name": "Does Anthropic train on API data?", "acceptedAnswer": { "@type": "Answer", "text": "No. Anthropic explicitly does not use API inputs and outputs to train its foundation models by default. Enterprise customers can additionally request zero data retention mode, where Anthropic does not persist prompts or completions after the API call completes." } }, { "@type": "Question", "name": "What is Anthropic's role under GDPR — processor or controller?", "acceptedAnswer": { "@type": "Answer", "text": "When processing personal data submitted through the API on behalf of a customer, Anthropic acts as a data processor under GDPR Article 28. The company building the product or service on the API is the data controller, responsible for documenting the legal basis, informing data subjects, and ensuring GDPR compliance." } } ] } ] ```