--- title: "Anthropic Data Processing Addendum: Where to Find the Official DPA" description: "Where to find Anthropic's official Data Processing Addendum, who can access it, and what EU buyers should verify before accepting Claude terms." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/anthropic-data-processing-addendum/" language: "en" --- ![Anthropic Data Processing Addendum official DPA access guide](https://compound.law/assets/images/tools/tools_1.webp) tools # Anthropic Data Processing Addendum: Where to Find the Official DPA 1 May 2026 Where is the Anthropic Data Processing Addendum? Anthropic's Data Processing Addendum is the DPA built into the Commercial Terms for paid Claude products. API and Enterprise customers access it through Anthropic channels, while free Claude.ai users do not get a separate DPA. EU buyers should still verify transfer paths, subprocessors, retention, and workflow fit. - The addendum is part of Anthropic Commercial Terms rather than a standalone public PDF. - It applies to paid Claude products, including the API and Enterprise offerings. - If Claude is used through another provider, that provider's contract stack may control instead. The **Anthropic Data Processing Addendum** is Anthropic’s **data processing agreement (DPA)** for paid Claude products such as **Claude Enterprise** and the **Claude API**. Anthropic states that the addendum is incorporated into its **Commercial Terms**, so customers usually access it through the contracting flow or customer portal rather than downloading a separate public PDF. For companies in Germany and the EU, the key question is not only where to find the addendum, but also whether it fits the real workflow, transfer setup, and data categories involved. This page provides general information and is not legal advice for a specific situation. For the broader contract and compliance analysis, see our page on [Anthropic DPA](https://compound.law/en-DE/tools/anthropic-dpa/). For a fuller GDPR review framework, see our page on [Claude GDPR compliance](https://compound.law/en-DE/tools/claude-gdpr/). If you are comparing direct Anthropic contracting with a cloud intermediary, see our page on [AWS Bedrock GDPR](https://compound.law/en-DE/tools/aws-bedrock/). ## Where to Find the Anthropic Data Processing Addendum Anthropic describes the **Data Processing Addendum** as part of the contractual package for its paid Claude products. In practice, that means most customers will not find a general public PDF download page titled “Anthropic Data Processing Addendum.” Instead, the current DPA is made available through Anthropic’s customer contracting channels. For most buyers, the access path is: 1. **Paid Anthropic account:** The DPA is relevant for Claude Enterprise and the Claude API, not for free Claude.ai use. 2. **Commercial Terms flow:** Anthropic incorporates the DPA into the Commercial Terms rather than treating it as a separate offline document. 3. **Customer channel access:** API customers usually review it through Anthropic’s console flow, while enterprise buyers may receive access through their account manager or procurement process. This distinction matters for exact-match search intent. Someone searching for **“Anthropic Data Processing Addendum”** usually wants the official document location first, not a generic explanation of Article 28 GDPR. The short answer is that the official addendum is tied to the paid Anthropic contracting flow. ## What the Anthropic Addendum Actually Is The Anthropic Data Processing Addendum is the **Article 28 GDPR processor contract** used when Anthropic processes personal data on behalf of a customer through paid Claude services. In functional terms, it is the same type of document many EU teams call a **DPA**, and many German teams call an **AVV**. Its role is usually to address two core points: 1. **Processor obligations under Article 28 GDPR:** instructions, confidentiality, security, subprocessors, data subject support, deletion, and audit support. 2. **International transfer mechanism:** Standard Contractual Clauses (**SCCs**) for personal data transferred outside the EEA. For German companies, the practical point is straightforward: if you contract directly with Anthropic for Claude Enterprise or the Claude API, the addendum is the contract you review as the processor agreement. ## Who Can Access the Addendum The Anthropic Data Processing Addendum is generally relevant only for **paid customers**. - **Claude Enterprise customers:** usually yes, through enterprise contracting or account-management channels. - **Claude API customers:** usually yes, through the console or associated legal flow. - **Free Claude.ai users:** usually no separate DPA access. - **Customers using Claude through another provider:** not necessarily, because the intermediary provider’s contract stack may govern instead. This last point is easy to miss. If your team uses Claude through **Amazon Bedrock** or another infrastructure provider, the key processor agreement is often not the direct Anthropic addendum at all. In that structure, the relevant DPA may come from the platform provider rather than from Anthropic. ## How to Review the Official Anthropic Addendum Once you have access to the current version, the review should be practical rather than abstract. ### Step 1: Confirm the exact product and terms path Check whether your deployment is: - **Claude Enterprise** - **Claude API** - **Claude via another provider** That determines whether the Anthropic addendum is the governing document at all. ### Step 2: Save the version you actually accepted Because the addendum is incorporated into the Commercial Terms, legal and procurement teams should retain the version that was in force when the account or contract was accepted. That copy matters more than a later web reference. ### Step 3: Check the Article 28 basics against the workflow At minimum, verify whether the contract language fits: - the real **data categories** - the affected **data subjects** - the planned **processing purpose** - the **retention and deletion** approach - the **subprocessor** chain - the expected **security** and audit documentation ### Step 4: Review transfer mechanics, not just contract labels If personal data leaves the EEA, the review should cover the actual transfer architecture. The Anthropic addendum may include SCCs, but EU buyers still need to understand where data is processed, which subprocessors are involved, and whether the intended use case requires additional transfer analysis. ## What EU and German Buyers Should Verify Before Accepting For DACH legal, privacy, and procurement teams, the addendum is only one checkpoint in the approval process. Before accepting it, verify the following: 1. **Direct or indirect contracting model** If Claude is purchased through Anthropic directly, the Anthropic addendum is usually the relevant DPA. If Claude is purchased through another provider, that provider’s DPA may control. 2. **Personal data scope** Lower-risk operational use is easier to fit than workflows involving large volumes of customer content, employee data, or special-category data under Article 9 GDPR. 3. **Cross-border transfers** Check which transfer mechanism applies and whether a separate **Transfer Impact Assessment** is needed for the deployment. 4. **Subprocessor governance** Review current subprocessors and the notification process for changes. 5. **Internal German-law requirements** Where employee-related use cases are involved, also assess possible **works council** implications under section 87(1) no. 6 BetrVG. ## Exact-Match Questions Buyers Commonly Ask ### Is the Anthropic Data Processing Addendum a separate PDF? Usually no. Anthropic presents the addendum as part of the Commercial Terms for paid products, so the document is commonly accessed through the contracting flow rather than as a public standalone PDF. ### Is the Anthropic addendum the same as an AVV? Functionally, yes. For German buyers, the Anthropic DPA is the Article 28 processor agreement that serves the same role as an **Auftragsverarbeitungsvertrag**. ### Does the addendum apply to free Claude.ai? No. Free consumer-style access is not the same as a paid commercial processor arrangement. If your organization needs a DPA in place, it should use the paid API or Enterprise path. ### Is accepting the addendum enough for GDPR compliance? No. The addendum is necessary for many controller-processor deployments, but it does not replace the rest of the GDPR analysis. The workflow, legal basis, internal governance, transfer assessment, and documentation still have to be handled separately. Compound Law advises businesses and in-house teams in Germany on **GDPR, AI contracts, and AI procurement**. If you want legal review of the Anthropic Data Processing Addendum before accepting it, [contact us](https://compound.law/en-DE/#booking). ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions Anthropic provides the Data Processing Addendum through its customer contracting flow for paid Claude products. It is incorporated into the Commercial Terms rather than published as a standalone public PDF. API and Enterprise customers can access the current version through Anthropic's console or account-management channel. Yes. Anthropic states that its DPA with SCCs applies to paid commercial products, including Claude Enterprise and the Claude API. Free Claude.ai accounts do not receive a separate DPA. Usually no. The Anthropic DPA is the functional equivalent of an Auftragsverarbeitungsvertrag under Article 28 GDPR. German buyers should still confirm whether the workflow, data categories, transfers, and internal governance requirements are fully covered. Usually no. If Claude is accessed through another platform such as Amazon Bedrock, that provider's contract stack generally governs the processing arrangement. The direct Anthropic addendum is relevant mainly for customers contracting with Anthropic itself. EU buyers should verify which product and terms version apply, whether SCCs cover the actual transfer path, which subprocessors are involved, how retention and deletion work, and whether the intended workflow triggers extra requirements such as a DPIA, a Transfer Impact Assessment, or works council involvement. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Anthropic Data Processing Addendum: Where to Find the Official DPA", "description": "Where to find Anthropic's official Data Processing Addendum, who can access it, and what EU buyers should verify before accepting Claude terms.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-05-01T00:00:00.000Z", "dateModified": "2026-05-01T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/anthropic-data-processing-addendum/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Anthropic Data Processing Addendum: Where to Find the Official DPA", "item": "https://compound.law/en-DE/tools/anthropic-data-processing-addendum/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Where can I find the Anthropic Data Processing Addendum?", "acceptedAnswer": { "@type": "Answer", "text": "Anthropic provides the Data Processing Addendum through its customer contracting flow for paid Claude products. It is incorporated into the Commercial Terms rather than published as a standalone public PDF. API and Enterprise customers can access the current version through Anthropic's console or account-management channel." } }, { "@type": "Question", "name": "Does Anthropic offer a DPA for Claude Enterprise and the API?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Anthropic states that its DPA with SCCs applies to paid commercial products, including Claude Enterprise and the Claude API. Free Claude.ai accounts do not receive a separate DPA." } }, { "@type": "Question", "name": "Do German companies need a separate AVV with Anthropic?", "acceptedAnswer": { "@type": "Answer", "text": "Usually no. The Anthropic DPA is the functional equivalent of an Auftragsverarbeitungsvertrag under Article 28 GDPR. German buyers should still confirm whether the workflow, data categories, transfers, and internal governance requirements are fully covered." } }, { "@type": "Question", "name": "Does the Anthropic addendum apply through another provider?", "acceptedAnswer": { "@type": "Answer", "text": "Usually no. If Claude is accessed through another platform such as Amazon Bedrock, that provider's contract stack generally governs the processing arrangement. The direct Anthropic addendum is relevant mainly for customers contracting with Anthropic itself." } }, { "@type": "Question", "name": "What should EU buyers verify before accepting the addendum?", "acceptedAnswer": { "@type": "Answer", "text": "EU buyers should verify which product and terms version apply, whether SCCs cover the actual transfer path, which subprocessors are involved, how retention and deletion work, and whether the intended workflow triggers extra requirements such as a DPIA, a Transfer Impact Assessment, or works council involvement." } } ] } ] ```