--- title: "Claude Code Data Privacy: GDPR, DPA & No Training Policy" description: "Claude Code's data privacy policy: no training on your code by default, GDPR DPA included via Anthropic API, zero data retention for Enterprise." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/claude-code-gdpr/" language: "en" --- ![Claude Code GDPR compliance — DPA, data retention and EU hosting guide](https://compound.law/assets/images/tools/tools_1.webp) tools # Claude Code Data Privacy: GDPR, DPA & No Training Policy 26 June 2026 Short answer Yes, Claude Code can be used in a GDPR-compliant way for German companies, but only on a commercial deployment path with documented controls. The key questions are repository contents, the 30-day retention window, local transcript caching, and whether Team is enough or Enterprise, Bedrock, Vertex, or ZDR is required. - Commercial Claude Code sessions are retained for 30 days by default, and local clients cache transcripts for 30 days unless configured otherwise. - Claude Team may be enough for lower-risk work, but Enterprise or a cloud-provider path is safer for sensitive repositories and audit needs. - If repositories contain personal data, customer secrets, or employee-monitoring implications, legal and engineering need a documented rollout review. **Claude Code can be GDPR-compliant for German companies, but it is not a blanket yes.** The 2026 answer is narrower and more operational: use a commercial deployment path, document the processor contract, decide what repository data may be exposed in prompts, review the default **30-day retention** window, and account for the fact that the local client caches session transcripts on the developer machine by default. If your teams need stricter retention, auditability, or region controls, **Claude Enterprise**, **AWS Bedrock**, **Google Vertex AI**, or a qualified **Zero Data Retention (ZDR)** setup is usually the better fit. This page provides general legal information, not legal advice for a specific deployment. For the contract layer, start with our [Anthropic DPA](https://compound.law/en-DE/tools/anthropic-dpa/). For the broader vendor review, see [Claude GDPR compliance](https://compound.law/en-DE/tools/claude-gdpr/), [Claude Team GDPR](https://compound.law/en-DE/tools/claude-team-gdpr/), [Claude Enterprise](https://compound.law/en-DE/tools/claude-enterprise/), our [Claude ZDR guide](https://compound.law/en-DE/tools/claude-zdr/), and our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/). ## Is Claude Code GDPR Compliant in 2026? **Yes, conditionally.** Claude Code is not a separate legal category. The compliance answer depends on which commercial path you use and what data your repositories actually contain. For most German companies, the practical split looks like this: - **Consumer Claude accounts are the wrong baseline** for business repository work involving personal data. - **Commercial Claude Code usage** can sit on a defensible GDPR path, because Anthropic treats Team, Enterprise, and API usage under its commercial framework rather than the consumer one. - **The real risk is repository content, not the CLI itself.** If source code contains employee data, customer records, production credentials, access tokens, or confidential diligence material, the legal review becomes stricter immediately. - **Data minimization still applies.** Even where the vendor contract is usable, your team must decide which files, prompts, logs, and tickets may be sent through the tool. The direct answer for searchers is therefore: **Claude Code is usually acceptable for lower-risk engineering workflows, but not as an ungoverned default for every repository.** ## Where Claude Code Creates GDPR Risk The page lost relevance because searchers no longer want only a DPA answer. They want to know what Claude Code actually sees and where the exposure points sit. ### Repository contents and prompt exposure Claude Code runs locally, but that does **not** mean no data leaves the machine. The legal question is which repository material becomes part of prompts, diffs, outputs, or session state sent to the model provider. Typical high-risk examples: - repositories containing **personal data** in fixtures, logs, screenshots, tickets, or copied production samples - engineering workspaces containing **API keys, secrets, certificates, or tokens** - repositories tied to **employee monitoring**, internal investigations, or HR tooling - legal or commercial repositories holding **M\&A, contract, or regulated-sector** material If a developer can open it in the Claude Code session, you should assume the workflow needs a documented rule on whether that material may be processed. ### Retention, telemetry, and local transcripts Anthropic’s current Claude Code documentation is materially more specific than many older GDPR explainers. For commercial users, the standard retention period is **30 days**. Anthropic also documents that Claude Code clients store **session transcripts locally in plaintext** under the user profile for **30 days by default** unless the cleanup period is changed. That matters for two reasons: 1. **Server-side retention and local caching are different risks.** 2. **“Not used for training” is not the same as “not stored.”** For regulated engineering teams, the local plaintext cache can matter just as much as Anthropic’s server-side retention window. Security and privacy teams should review workstation controls, endpoint encryption, and whether the cache period should be shortened. ### Workspace boundaries and access scope Anthropic states that Claude Code accesses the repository where the session is started, and that remote-control sessions still execute on the user’s machine rather than in Anthropic cloud VMs. That is useful, but it is not the same thing as zero exposure. Any prompt, output, or repository material surfaced during the session still travels through the configured model provider. The right governance question is: **what can the session read, and what does the user allow it to send?** ## When Team Is Enough and When You Need More The commercial answer is no longer just “use the API.” Anthropic’s current deployment guidance explicitly places **Team** and **Enterprise** at the center for most organizations, with **Bedrock**, **Vertex**, or other provider paths used where infrastructure requirements are stricter. | Situation | Likely path | | ----------------------------------------------------------------------------------------------------------------- | -------------------------------------- | | Small engineering team, lower-risk repositories, no special audit or region obligations | Claude Team can be enough | | Need SSO, role controls, managed settings, or stronger enterprise governance | Claude Enterprise | | Need AWS- or GCP-native region, IAM, or logging controls | Bedrock or Vertex deployment | | Need the strictest retention posture for eligible workflows | Qualified ZDR setup | | Repositories contain sensitive personal data, highly confidential material, or employee-surveillance implications | Individual legal review before rollout | Two cautions matter here: - **ZDR is not standard.** Anthropic documents it as a qualified setup, not an automatic Enterprise feature. - **Cloud-provider deployment changes the contract stack.** If Claude Code runs through Bedrock or Vertex, the legal review must include the provider’s own data-processing and logging setup, not just Anthropic’s commercial terms. ## Claude Code Checklist for Legal and Engineering Teams Before enabling Claude Code across a German development team, work through the following: 1. **Choose the deployment path first.** Decide whether Team, Enterprise, Anthropic API, Bedrock, or Vertex is the actual operating model. 2. **Classify repository data.** Mark which repositories contain personal data, customer content, secrets, incident material, or employee-related information. 3. **Review retention in two layers.** Document the provider-side retention window and the local Claude Code transcript cache on developer machines. 4. **Set repository rules.** Decide which repositories are allowed, which require approval, and which are out of scope entirely. 5. **Review permissions and monitoring.** For sensitive repositories, use project-specific permission settings and an auditable managed rollout path. 6. **Check employment-law impact.** If Claude Code is paired with systematic code review, productivity analysis, or developer monitoring, assess co-determination risk under **section 87(1) no. 6 BetrVG** and whether a DPIA threshold review is needed. 7. **Train developers on prompt hygiene.** No production dumps, no copied customer tickets with identifiers, and no secret material unless the approved deployment path explicitly permits it. ## When Claude Code Is Usually Not the Right Default Claude Code should not be treated as a frictionless default when the repository or workflow includes: - **Article 9 GDPR special-category data** - large volumes of **customer communications or support records** - **works council-sensitive** employee monitoring implications - strict **EU-only** contractual data-location commitments - internal projects where local plaintext session caching is itself unacceptable In those cases, the question stops being “is Claude Code compliant?” and becomes **which deployment architecture, retention posture, and approval workflow are legally defensible for this repository class?** ## FAQ ### Is Claude Code GDPR compliant? Yes, potentially. Claude Code can be used in a GDPR-compliant way if the company deploys it on a commercial path, documents the processor setup, and controls which repository data may be exposed during sessions. It is not a one-size-fits-all approval for every engineering repository. ### Does Claude Code train on my source code? For commercial products, Anthropic states customer data is not used for model training by default. That reduces one major concern, but legal review still has to cover retention, local transcript storage, transfers, and the actual sensitivity of the repository. ### Does Claude Code store repository data? Potentially yes. Anthropic documents a standard **30-day** retention period for commercial Claude Code usage, and local clients keep session transcripts in plaintext for **30 days by default** unless the cleanup setting is changed. ### When is Claude Team enough for Claude Code? Team can be enough for ordinary software development on lower-risk repositories where standard retention, standard admin tooling, and non-EU-exclusive processing are acceptable. Once your requirements move toward audit exports, tighter policy control, or sensitive repository classes, Enterprise or a provider-specific deployment is usually the safer route. ### When do we need Enterprise, Bedrock, Vertex, or ZDR? Usually when you need stronger governance than a default self-serve rollout provides: stricter retention control, identity and access management, auditability, or cloud-provider-native regional controls. ZDR should be treated as a qualified exception path, not an assumed default. ## Need a Repository-Level Review? If your company wants to use Claude Code for real development work in Germany, the right review usually combines **GDPR**, **vendor contracting**, **engineering guardrails**, and sometimes **employment law**. Compound Law advises on AI procurement, DPA review, internal rollout policies, and repository-specific governance. For that broader intake process, start with our [GDPR AI procurement guide](https://compound.law/en-DE/compliance/gdpr-ai-procurement/) or [contact us](https://compound.law/en-DE/#booking). ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions Claude Code can be used in a GDPR-compliant way when deployed on a commercial path with a documented processor contract, retention review, and internal usage controls. The decisive question is not the tool name but the concrete deployment, data categories, and governance around repository access. Anthropic states that data from commercial products is not used for model training by default. That helps, but it does not remove the need to review retention, local caching, data categories, and transfer paths. Yes, potentially in more than one place. Anthropic documents a standard 30-day retention period for commercial Claude Code usage, and the local client stores session transcripts in plaintext under the user profile for 30 days by default unless you shorten or disable that behavior. Claude Team can be enough for ordinary engineering work on lower-risk repositories where 30-day retention, standard admin controls, and non-EU-exclusive processing are acceptable. Enterprise or a cloud-provider deployment is the safer path where you need stricter auditability, retention control, or infrastructure-level governance. That is usually the right path when repositories contain sensitive personal data, regulated-sector information, trade secrets under strict policy, or when your company needs stronger retention controls, identity management, audit exports, or cloud-provider region governance. ZDR is not standard and must be separately qualified. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Claude Code Data Privacy: GDPR, DPA & No Training Policy", "description": "Claude Code's data privacy policy: no training on your code by default, GDPR DPA included via Anthropic API, zero data retention for Enterprise.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-06-26T00:00:00.000Z", "dateModified": "2026-06-26T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/claude-code-gdpr/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Claude Code Data Privacy: GDPR, DPA & No Training Policy", "item": "https://compound.law/en-DE/tools/claude-code-gdpr/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Claude Code GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Claude Code can be used in a GDPR-compliant way when deployed on a commercial path with a documented processor contract, retention review, and internal usage controls. The decisive question is not the tool name but the concrete deployment, data categories, and governance around repository access." } }, { "@type": "Question", "name": "Does Claude Code train on my source code?", "acceptedAnswer": { "@type": "Answer", "text": "Anthropic states that data from commercial products is not used for model training by default. That helps, but it does not remove the need to review retention, local caching, data categories, and transfer paths." } }, { "@type": "Question", "name": "Does Claude Code store repository data?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, potentially in more than one place. Anthropic documents a standard 30-day retention period for commercial Claude Code usage, and the local client stores session transcripts in plaintext under the user profile for 30 days by default unless you shorten or disable that behavior." } }, { "@type": "Question", "name": "When is Claude Team enough for Claude Code?", "acceptedAnswer": { "@type": "Answer", "text": "Claude Team can be enough for ordinary engineering work on lower-risk repositories where 30-day retention, standard admin controls, and non-EU-exclusive processing are acceptable. Enterprise or a cloud-provider deployment is the safer path where you need stricter auditability, retention control, or infrastructure-level governance." } }, { "@type": "Question", "name": "When do we need Enterprise, Bedrock, Vertex, or ZDR?", "acceptedAnswer": { "@type": "Answer", "text": "That is usually the right path when repositories contain sensitive personal data, regulated-sector information, trade secrets under strict policy, or when your company needs stronger retention controls, identity management, audit exports, or cloud-provider region governance. ZDR is not standard and must be separately qualified." } } ] } ] ```