--- title: "Anthropic DPA: GDPR Article 28 Guide for German Companies" description: "Anthropic offers a DPA for Claude Enterprise and the Claude API. German companies should still verify SCCs, subprocessors, retention, and Article 28 GDPR fit." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/anthropic-dpa/" language: "en" --- ![Anthropic DPA data processing agreement Article 28 GDPR for Germany](https://compound.law/assets/images/tools/tools_1.webp) tools # Anthropic DPA: GDPR Article 28 Guide for German Companies 30 April 2026 Does Anthropic provide a DPA for Claude? Yes. Anthropic provides a Data Processing Agreement with SCCs for commercial products including Claude Enterprise and the Claude API. Whether the Anthropic DPA is sufficient for a specific German deployment depends on the workflow, data types, and internal compliance requirements. - The Anthropic DPA is incorporated into the commercial terms and includes SCCs for international data transfers. - Companies must review processor role allocation, retention periods, subprocessors, and transfer paths for their specific use case. - Employee data, Article 9 GDPR special-category data, and highly confidential documents each require stricter individual review. Yes, Anthropic provides a **Data Processing Agreement (DPA)** for commercial Claude products, including the Claude API and Claude Enterprise. The Anthropic DPA is the contractual instrument that covers processor obligations under Article 28 GDPR. It is incorporated into Anthropic’s commercial terms and accessed electronically through the Anthropic customer portal — it is not available as a standalone PDF download. For companies in Germany, the critical question is not merely whether the Anthropic DPA exists, but whether it fits the specific deployment, the data types processed, and the organization’s GDPR obligations. This page explains how to access the Anthropic DPA, what it covers, and when a deeper legal review is required. This page provides general information and is not legal advice for a specific situation. For a full GDPR review framework for Claude deployments, see our page on [Claude GDPR](https://compound.law/en-DE/tools/claude-gdpr/). For a broader overview of using Claude under German law, see our page on [Claude Enterprise](https://compound.law/en-DE/tools/claude-enterprise/). **Quick access:** The Anthropic DPA is not available as a standalone PDF download. API and Enterprise customers access it electronically through console.anthropic.com or via their account representative. See the step-by-step process below. ## How to Access the Anthropic DPA The Anthropic DPA is **not available as a standalone PDF download**. It is incorporated into the commercial terms and accessed electronically through the Anthropic customer portal. Free Claude.ai users cannot access a DPA — the agreement requires a paid API or Enterprise plan. **Three steps to access the Anthropic DPA:** 1. **Log into the Anthropic Console:** Sign in at console.anthropic.com (for API customers) or contact your Anthropic Enterprise account representative. 2. **Navigate to privacy or legal settings:** The current DPA is accessible within the portal under data privacy or contract settings. Anthropic also provides guidance on signing the DPA via help.anthropic.com. 3. **Confirm electronically:** The DPA is not executed as a separate paper document. It is countersigned electronically within the portal and incorporated into your commercial agreement on confirmation. **Note:** Only customers on a paid Anthropic contract — the Claude API or Claude Enterprise — can access a DPA. Free-tier Claude.ai users do not have access to a data processing agreement and should not process personal data that requires one. ## DPA and Data Processing Agreement — Same Document, Different Labels In international procurement contexts the term **Data Processing Agreement (DPA)** is standard. It is the English-language equivalent of the German **Auftragsverarbeitungsvertrag (AVV)** under Article 28 GDPR. From a GDPR perspective, Anthropic acts as a **data processor** for commercial products such as Claude Enterprise and the Claude API, because the company processes personal data on behalf of the customer-controller. One important distinction applies: - **Direct contract with Anthropic** (Claude Enterprise, Claude API): The Anthropic commercial terms, including the DPA and SCCs, govern the processor relationship. - **Access through a third-party platform** (e.g., Amazon Bedrock, other cloud providers): That provider’s own contract stack is controlling — not the Anthropic DPA. This distinction has significant legal consequences for procurement. Companies using Claude via Amazon Bedrock review the AWS contract stack, not the Anthropic DPA. ## What the Anthropic DPA Covers Under Article 28 GDPR **Article 28 GDPR** mandates that any data processing agreement between a controller and processor cover specific elements. Legal and privacy teams should verify whether the Anthropic DPA addresses each element for the specific deployment: | Required element | What to check | | ----------------------------------- | ---------------------------------------------------------------------------------- | | Subject matter and duration | Is the processing scope described with enough precision for the intended workflow? | | Nature and purpose of processing | Do the stated purposes match the actual use of Claude in the organization? | | Categories of personal data | Are all data types involved in the workflow covered? | | Categories of data subjects | Are customers, employees, and users correctly identified? | | Processor instructions | Is Anthropic contractually bound to process only on documented instructions? | | Confidentiality obligations | Are Anthropic personnel bound by confidentiality commitments? | | Security measures (Article 32 GDPR) | Are technical and organizational measures specified with enough detail? | | Subprocessors | Is there a current subprocessor list and a defined approval mechanism for changes? | | Data subject rights | Is Anthropic required to support access, deletion, and correction requests? | | Deletion and return | Are timelines and options for data deletion after termination specified? | | Audit rights | Can the company request audit support or documentation from Anthropic? | The Anthropic DPA addresses these mandatory elements in principle. Legal teams should review whether the current contract version and associated service documentation align with the specific workflow and data categories planned for deployment. ## International Transfers and SCCs in the Anthropic DPA A common question for German procurement teams is whether data stays within the EU. Anthropic processes data on infrastructure that may not be located exclusively within the EEA. The primary transfer mechanism is **Standard Contractual Clauses (SCCs)** under Article 46(2)(c) GDPR, which Anthropic incorporates automatically into the commercial terms. Despite the inclusion of SCCs, companies must still carry out their own transfer analysis: - **Document transfer paths.** Identify which countries outside the EEA may receive data — covering storage, processing, and potential support access. - **Review the subprocessor list.** Anthropic uses its own subprocessors. Verify whether these operate outside the EEA and whether SCCs have been passed down the chain. - **Consider a Transfer Impact Assessment.** For sensitive data categories or stricter internal policies, a dedicated Transfer Impact Assessment may be required even where SCCs are in place. - **Distinguish EU hosting from EU-only processing.** These terms are often used interchangeably but carry different legal weight. If strict data residency is required, confirm the actual architecture in writing. See our page on [Claude EU hosting](https://compound.law/en-DE/tools/claude-eu-hosting/) for more detail. ## The Anthropic DPA for Different Data Types How well the Anthropic DPA covers a specific deployment depends significantly on which data types flow through the workflow. ### Customer data Claude can be used in customer data workflows in many cases, provided the workflow is carefully designed. Lower-risk scenarios typically involve limited metadata, pseudonymized content, or non-sensitive operational data with human review at the output stage. The review becomes more demanding for large-scale customer communication ingestion, complaint handling, or contract analysis involving identifiable individuals. ### Employee data Employee data requires stricter review in Germany. Where Claude is used for hiring, performance evaluation, productivity analysis, or workplace monitoring, **co-determination rights under section 87(1) no. 6 BetrVG** may become relevant. In some cases a **Data Protection Impact Assessment (DPIA)** under Article 35 GDPR will also be required. The Anthropic DPA alone does not resolve these labor-law questions. ### Special-category data (Article 9 GDPR) Health data, biometric data, union membership, or other **Article 9 GDPR** categories require a significantly higher standard of justification. A standard enterprise rollout is usually not sufficient. Deployment of Claude for these data types requires not only a valid DPA but also a legal basis under Article 9(2) GDPR and in many cases a DPIA. ### Trade secrets and confidential documents Not every legal risk is a privacy risk. Companies considering Claude for due diligence documents, term sheets, M\&A preparation, or internal investigations need to review confidentiality obligations, access controls, and internal approval processes separately from the DPA review. ## Anthropic DPA Review Checklist Before Rollout Before deploying Claude Enterprise or the Claude API in production, legal and privacy teams should work through the following steps: 1. **Access the DPA and compare it against the planned workflow.** Verify that the stated subject matter, purposes, and data categories in the contract match what the organization actually intends to process. 2. **Confirm processor role allocation.** Document that Anthropic is acting as a processor for the relevant workflow, and record the organization’s controller responsibilities. 3. **Document SCCs and transfer paths.** Map which countries outside the EEA are involved and record the transfer mechanism in the record of processing activities. 4. **Review and register subprocessors.** Request the current subprocessor list from Anthropic and document the review in the vendor management system. 5. **Assess employee data and Article 9 data separately.** Identify early whether works council involvement, HR sign-off, or a DPIA is required before rollout. ## When the Anthropic DPA Is Not Enough on Its Own The Anthropic DPA is a necessary starting point but not a sufficient basis for all Claude deployments. A more detailed legal review is regularly required where: - the Claude workflow processes large volumes of customer communications, contract documents, or support tickets - the deployment involves employee data, recruitment data, or performance-related analysis - special categories of personal data under Article 9 GDPR are involved - strict EU-only data residency or specific certification requirements apply - sector-specific regulation applies, such as financial services, healthcare, or regulated professional advice In these scenarios, checking the DPA box is not enough. What is required is a full assessment covering the DPA, processing architecture, legal basis, transfer mechanism, and internal governance rules. For the complete GDPR review framework for Claude, see our page on [Claude GDPR compliance](https://compound.law/en-DE/tools/claude-gdpr/). Compound Law advises businesses, founders, and in-house teams in Germany on **GDPR, AI contracts, and AI procurement**. If you want to review the Anthropic DPA or another AI vendor contract before rollout, [contact us](https://compound.law/en-DE/#booking). ## FAQ ### What is the Anthropic DPA? The **Anthropic DPA** is the Data Processing Agreement Anthropic provides for commercial Claude products under Article 28 GDPR. It is incorporated into the commercial terms and includes Standard Contractual Clauses (SCCs) for international data transfers. For German companies, the key question is whether the DPA fits the specific deployment and data types involved. ### Does Anthropic offer a DPA for Claude Enterprise? Yes. Anthropic states that its DPA with SCCs is incorporated into the commercial terms for Claude Enterprise and the Claude API. Companies should still verify whether the contract fits their specific deployment and data flows. ### Is the Anthropic DPA sufficient for Article 28 GDPR compliance? The Anthropic DPA covers the mandatory Article 28 GDPR content in principle. Whether it is sufficient depends on whether processor role allocation, data categories, transfer paths, and subprocessors are correctly mapped to the actual workflow. ### Does the Anthropic DPA apply to the Claude API? Yes. Anthropic states the DPA with SCCs applies to commercial products including the Claude API. Companies using Claude through a third-party platform such as Amazon Bedrock must review that platform’s contract stack separately, as the Anthropic DPA does not directly govern those deployments. ### What does the Anthropic DPA cost? Anthropic does not offer a separately priced DPA. It is included as part of the commercial terms for paid products such as Claude Enterprise and the Claude API. ### Who needs to sign the Anthropic DPA? When contracting directly with Anthropic, the DPA is incorporated into the commercial terms and is not executed as a standalone document. Companies should access the current version electronically, document the review internally, and retain a copy alongside their record of processing activities. ### Where can I download the Anthropic DPA? The Anthropic DPA is not available as a standalone PDF. It is incorporated into the commercial terms and accessed electronically through the Anthropic customer portal at console.anthropic.com. For enterprise customers, access is confirmed through the account management process. Additional guidance is available at help.anthropic.com. ### Does the Anthropic DPA cover the free Claude.ai plan? No. A data processing agreement is only available to customers on a paid Anthropic plan — the Claude API or Claude Enterprise. Free Claude.ai accounts do not have access to a DPA. Companies that need a DPA in place before processing personal data must use a paid Anthropic product. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions The Anthropic DPA is the Data Processing Agreement Anthropic provides for commercial Claude products under Article 28 GDPR. It is incorporated into the commercial terms and includes Standard Contractual Clauses (SCCs) for international data transfers. For German companies, the key question is whether the DPA fits the specific workflow and data types involved. Yes. Anthropic states that its DPA with SCCs is incorporated into the commercial terms for Claude Enterprise and the Claude API. Companies should still verify whether the contract fits their specific deployment and data flows. The Anthropic DPA covers the mandatory Article 28 GDPR content in principle. Whether it is sufficient depends on whether processor role allocation, data categories, transfer paths, and subprocessors are correctly mapped to the actual workflow. Yes. Anthropic states the DPA with SCCs applies to commercial products including the Claude API. Companies accessing Claude through a third-party platform such as Amazon Bedrock must review that platform's contract stack separately. Anthropic does not offer a separately priced DPA. The DPA is part of the commercial terms and automatically included with paid products such as Claude Enterprise and the Claude API. When contracting directly with Anthropic, the DPA is incorporated into the commercial terms and is not signed as a separate document. Companies should access the current version electronically, review it internally, and document the review against the specific use case. The Anthropic DPA is not available as a standalone PDF download. It is incorporated into the commercial terms and accessed electronically via the Anthropic customer portal (console.anthropic.com). Enterprise customers can access it through their account representative. Additional guidance is available at help.anthropic.com. No. A data processing agreement is only available to customers on a paid Anthropic plan — the Claude API or Claude Enterprise. Free Claude.ai users cannot access a DPA and should not process personal data that requires one. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Anthropic DPA: GDPR Article 28 Guide for German Companies", "description": "Anthropic offers a DPA for Claude Enterprise and the Claude API. German companies should still verify SCCs, subprocessors, retention, and Article 28 GDPR fit.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-04-30T00:00:00.000Z", "dateModified": "2026-04-30T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/anthropic-dpa/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Anthropic DPA: GDPR Article 28 Guide for German Companies", "item": "https://compound.law/en-DE/tools/anthropic-dpa/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the Anthropic DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The Anthropic DPA is the Data Processing Agreement Anthropic provides for commercial Claude products under Article 28 GDPR. It is incorporated into the commercial terms and includes Standard Contractual Clauses (SCCs) for international data transfers. For German companies, the key question is whether the DPA fits the specific workflow and data types involved." } }, { "@type": "Question", "name": "Does Anthropic offer a DPA for Claude Enterprise?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Anthropic states that its DPA with SCCs is incorporated into the commercial terms for Claude Enterprise and the Claude API. Companies should still verify whether the contract fits their specific deployment and data flows." } }, { "@type": "Question", "name": "Is the Anthropic DPA sufficient for Article 28 GDPR compliance?", "acceptedAnswer": { "@type": "Answer", "text": "The Anthropic DPA covers the mandatory Article 28 GDPR content in principle. Whether it is sufficient depends on whether processor role allocation, data categories, transfer paths, and subprocessors are correctly mapped to the actual workflow." } }, { "@type": "Question", "name": "Does the Anthropic DPA apply to the Claude API?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Anthropic states the DPA with SCCs applies to commercial products including the Claude API. Companies accessing Claude through a third-party platform such as Amazon Bedrock must review that platform's contract stack separately." } }, { "@type": "Question", "name": "What does the Anthropic DPA cost?", "acceptedAnswer": { "@type": "Answer", "text": "Anthropic does not offer a separately priced DPA. The DPA is part of the commercial terms and automatically included with paid products such as Claude Enterprise and the Claude API." } }, { "@type": "Question", "name": "Who needs to sign the Anthropic DPA?", "acceptedAnswer": { "@type": "Answer", "text": "When contracting directly with Anthropic, the DPA is incorporated into the commercial terms and is not signed as a separate document. Companies should access the current version electronically, review it internally, and document the review against the specific use case." } }, { "@type": "Question", "name": "Where can I download the Anthropic DPA?", "acceptedAnswer": { "@type": "Answer", "text": "The Anthropic DPA is not available as a standalone PDF download. It is incorporated into the commercial terms and accessed electronically via the Anthropic customer portal (console.anthropic.com). Enterprise customers can access it through their account representative. Additional guidance is available at help.anthropic.com." } }, { "@type": "Question", "name": "Does the Anthropic DPA cover the free Claude.ai plan?", "acceptedAnswer": { "@type": "Answer", "text": "No. A data processing agreement is only available to customers on a paid Anthropic plan — the Claude API or Claude Enterprise. Free Claude.ai users cannot access a DPA and should not process personal data that requires one." } } ] } ] ```