--- title: "Claude Enterprise GDPR Compliance: A Checklist for Companies in Germany" description: "Deploy Claude Enterprise in GDPR compliance: a 7-step checklist for German companies covering DPA, third-country transfers, DPIA, and usage policies." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/claude-enterprise-gdpr/" language: "en" --- ![Claude Enterprise GDPR compliance checklist for companies in Germany](https://compound.law/assets/images/tools/tools_1.webp) tools # Claude Enterprise GDPR Compliance: A Checklist for Companies in Germany 13 April 2026 How do I deploy Claude Enterprise in GDPR compliance? GDPR-compliant Claude Enterprise deployment requires a structured review before go-live: confirm the deployment path, document the DPA, classify data types, resolve third-country transfer questions, lock in retention settings, assess co-determination and DPIA obligations, and create an internal usage policy. - Purchasing Claude Enterprise does not automatically make your deployment GDPR-compliant — the DPA is necessary but not sufficient. - Employee data use cases require a review under § 87 BetrVG and may trigger a Data Protection Impact Assessment under Article 35 GDPR. - Zero-Data-Retention (ZDR) is not enabled by default for all enterprise deployments and must be explicitly configured or requested. **GDPR-compliant Claude Enterprise deployment** requires more than purchasing the Enterprise tier. Companies operating in Germany need to complete seven concrete steps before go-live: determine the deployment path, review and document the DPA (DSGVO-Datenschutzvereinbarung), classify data types, resolve third-country transfer questions, configure retention settings, assess co-determination and DPIA obligations, and create an internal usage policy. This checklist walks through every step in the order it should be completed. This article is general information and does not constitute legal advice for specific situations. For a comprehensive analytical overview, see our [Claude Enterprise review](https://compound.law/en-DE/tools/claude-enterprise/). For data privacy strategy questions, see [Compound Law’s data privacy expertise](https://compound.law/en-DE/expertise/). ## Why Claude Enterprise Requires a GDPR Review Claude Enterprise automatically includes a **Data Processing Agreement (DPA)** under **Article 28 GDPR** — a significant step above the Free and Pro tiers, which offer no DPA at all. But the DPA is a necessary condition for lawful deployment, not a sufficient one. German companies must independently verify several things before rollout: - **Processor role allocation:** Does Anthropic act as a processor for your specific deployment path? When Claude is accessed through third-party platforms (Amazon Bedrock, Google Vertex AI), different contractual relationships apply. - **Third-country transfers:** Even with Standard Contractual Clauses (SCCs), companies must assess whether a third-country transfer under Chapter V GDPR applies and whether a Transfer Impact Assessment (TIA) is required. - **Data categories:** The review burden increases significantly once employee data, special-category data under Article 9 GDPR, or highly confidential documents enter the system. - **Retention:** The **Zero-Data-Retention (ZDR)** option must be explicitly enabled for most enterprise deployments with elevated data protection requirements — it is not the default. ## Step-by-Step Checklist: GDPR-Compliant Claude Enterprise Rollout ### Step 1: Determine Your Deployment Path Decide whether you are accessing Claude Enterprise directly through Anthropic or through a cloud platform such as Amazon Bedrock or Google Vertex AI. The deployment path determines which contractual framework applies: - **Direct access through Anthropic:** The Anthropic DPA incorporating SCCs is automatically part of the commercial terms. - **Access through Amazon Bedrock or Google Vertex:** The AWS or Google contractual stack governs — the Anthropic DPA does not apply. This is a critical first step: a wrong assumption here invalidates the rest of your DPA review. ### Step 2: Review and Document the DPA Retrieve the current Anthropic DPA through the Anthropic Console (console.anthropic.com) and verify that it covers the mandatory elements under Article 28 GDPR: binding instructions, subprocessor list, deletion timelines, technical and organizational measures (TOMs), and data subject rights procedures. For a detailed breakdown, see our [Claude DPA guide](https://compound.law/en-DE/tools/claude-dpa/). Document internally which DPA version was in effect at the time of contracting. ### Step 3: Classify Data Types Define before rollout which categories of data your teams will input into Claude: | Data Category | Review Intensity | | ----------------------------------------------- | ---------------- | | General productivity data without personal data | Low | | General customer data with personal identifiers | Medium | | Employee data | High | | Special-category data under Article 9 GDPR | Very high | | Confidential business or M\&A documents | High | Each category carries different requirements for legal basis, retention limits, and technical safeguards. ### Step 4: Resolve Third-Country Transfer and EU Hosting Questions Anthropic processes data primarily in the United States. Verify: - Whether SCCs serve as the transfer mechanism for your deployment path and whether a TIA is required. - Whether EU-only hosting requirements apply in your organization and how they can be confirmed contractually. - Which subprocessors Anthropic uses and where they are located. For additional detail, see our [Claude EU hosting guide](https://compound.law/en-DE/tools/claude-eu-hosting/). ### Step 5: Review Retention Settings and the ZDR Option Claude Enterprise offers a **Zero-Data-Retention (ZDR)** option that prevents Anthropic from storing inputs beyond the session or using them for training. Confirm: - Whether ZDR is enabled by default for your plan or must be explicitly configured. - What the standard retention windows are when ZDR is not active. - Whether the resulting deletion timelines meet your internal data protection requirements. ZDR requires a separate agreement with Anthropic and is not available on all plans by default. For a full breakdown of ZDR eligibility, retained-data exceptions, and the exact split between Claude Enterprise chat, Claude Code, and API access, see our [Claude Zero Data Retention guide](https://compound.law/en-DE/tools/claude-zdr/). ### Step 6: Assess Co-Determination and DPIA Obligations If Claude Enterprise will be used in workflows involving **employee data**, two additional requirements must be addressed: - **Works council co-determination (§ 87 BetrVG):** Under **§ 87 (1) No. 6 of the German Works Constitution Act (BetrVG)**, the introduction of technical systems capable of monitoring employee performance or behavior is subject to co-determination rights. Assess whether a works council agreement (Betriebsvereinbarung) is required before rollout. - **Data Protection Impact Assessment (DPIA):** Workflows that systematically process employee data, enable profiling, or produce decisions with significant effects on employees may trigger a mandatory DPIA under Article 35 GDPR. ### Step 7: Create an Internal Usage Policy Technical and contractual safeguards alone are not enough. Companies need an internal **AI usage policy** covering at minimum: - Which data types may be entered into Claude — and which are prohibited - Who is authorized to use Claude for which workflows, and who can grant exceptions - How unexpected or erroneous outputs are handled and escalated - How usage and incidents are logged and reported internally The policy should be reviewed by the Data Protection Officer (DPO) before go-live. ## When Standard Review Is Not Enough Certain use cases require deeper legal guidance beyond a standard checklist review: - **Regulated industries:** Financial services (BaFin-regulated firms), healthcare organizations, and law firms face requirements that go beyond standard GDPR compliance. - **Special-category data (Article 9 GDPR):** Health data, biometric data, trade union membership, and similar data require a separate legal basis and heightened safeguards. - **M\&A and insider information:** Highly confidential business data should generally not be entered into external AI systems — regardless of data protection compliance status. - **Automated decision-making:** If Claude outputs will have legal or significant practical effects on individuals, additional requirements under Article 22 GDPR apply. Compound Law advises companies, founders, and in-house teams in Germany on GDPR, commercial contracts, and AI procurement. If you want to review a Claude Enterprise rollout, vendor agreements, or internal AI policies, [contact us](https://compound.law/en-DE/#booking). ## Claude Enterprise GDPR vs. Other AI Tools | Criterion | Claude Enterprise | ChatGPT Enterprise | Gemini Enterprise | | ------------------------------------- | -------------------- | -------------------- | ----------------------- | | DPA available | Yes (automatic) | Yes (automatic) | Yes (automatic) | | SCCs for third-country transfers | Yes | Yes | Yes | | Zero-Data-Retention option | Yes | Yes | Yes (GCP configuration) | | EU data residency | Limited availability | Limited availability | Yes (GCP EU regions) | | Works council relevance (§ 87 BetrVG) | Yes (employee data) | Yes (employee data) | Yes (employee data) | GDPR compliance requirements are broadly comparable across all three providers. The decisive question is not which vendor is “more GDPR-compliant” in the abstract, but how a specific deployment is configured, documented, and legally safeguarded. ## FAQ ### Does Claude Enterprise include a GDPR Data Processing Agreement? Yes. Claude Enterprise automatically incorporates a Data Processing Agreement with Standard Contractual Clauses under Article 28 GDPR. This is a prerequisite for any deployment involving personal data — but the DPA alone does not confirm that the deployment is fully GDPR-compliant. ### Is Claude Enterprise GDPR compliant? Claude Enterprise can support GDPR-compliant use, but compliance depends on the use case, legal basis, DPA, transfer mechanism, retention settings, and data categories processed. Purchasing the Enterprise tier is not a compliance confirmation in itself. ### Do we need a works council agreement before deploying Claude Enterprise in Germany? Possibly. If Claude Enterprise will be used in workflows that process employee data or could monitor employee performance, the works council has co-determination rights under § 87 (1) No. 6 BetrVG. A legal review before rollout is strongly recommended. ### What is the ZDR option and how do we activate it? Zero-Data-Retention prevents Anthropic from storing inputs beyond the session or using them for training. ZDR is not automatically active and must be explicitly configured or requested for enterprise deployments with elevated data protection requirements. ### Does the Anthropic DPA cover Claude accessed through Amazon Bedrock? No. When Claude is accessed through Amazon Bedrock, the AWS contractual stack governs. The Anthropic DPA does not apply in that scenario. Companies must review the AWS Data Processing Addendum and relevant AWS documentation separately. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) ## Frequently asked questions Yes. Claude Enterprise automatically includes a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs) under Article 28 GDPR. Companies still need to verify that the DPA fits their specific deployment, data types, and data flows. Claude Enterprise can support GDPR-compliant use, but compliance depends on the use case, legal basis, DPA terms, third-country transfer mechanism, retention settings, subprocessors, and the categories of data processed. Buying the Enterprise plan is not itself a compliance confirmation. Zero-Data-Retention (ZDR) prevents Anthropic from storing inputs beyond the session or using them for training purposes. ZDR is not automatically active for all Enterprise plans and must be explicitly configured or requested for deployments with higher data protection requirements. Possibly. If Claude Enterprise will be used in workflows that process employee data or monitor employee performance or behavior, the works council has co-determination rights under § 87 (1) No. 6 of the German Works Constitution Act (BetrVG). A legal review before rollout is strongly recommended. No. When Claude is deployed through Amazon Bedrock, the AWS contractual stack governs — not the Anthropic DPA. Companies must review the AWS Data Processing Addendum and relevant AWS data protection documentation separately. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Claude Enterprise GDPR Compliance: A Checklist for Companies in Germany", "description": "Deploy Claude Enterprise in GDPR compliance: a 7-step checklist for German companies covering DPA, third-country transfers, DPIA, and usage policies.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-04-13T00:00:00.000Z", "dateModified": "2026-04-13T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/claude-enterprise-gdpr/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Claude Enterprise GDPR Compliance: A Checklist for Companies in Germany", "item": "https://compound.law/en-DE/tools/claude-enterprise-gdpr/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does Claude Enterprise include a GDPR Data Processing Agreement?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Claude Enterprise automatically includes a Data Processing Agreement (DPA) incorporating Standard Contractual Clauses (SCCs) under Article 28 GDPR. Companies still need to verify that the DPA fits their specific deployment, data types, and data flows." } }, { "@type": "Question", "name": "Is Claude Enterprise GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "Claude Enterprise can support GDPR-compliant use, but compliance depends on the use case, legal basis, DPA terms, third-country transfer mechanism, retention settings, subprocessors, and the categories of data processed. Buying the Enterprise plan is not itself a compliance confirmation." } }, { "@type": "Question", "name": "What is the Claude Enterprise Zero-Data-Retention option?", "acceptedAnswer": { "@type": "Answer", "text": "Zero-Data-Retention (ZDR) prevents Anthropic from storing inputs beyond the session or using them for training purposes. ZDR is not automatically active for all Enterprise plans and must be explicitly configured or requested for deployments with higher data protection requirements." } }, { "@type": "Question", "name": "Do we need works council approval before deploying Claude Enterprise in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Possibly. If Claude Enterprise will be used in workflows that process employee data or monitor employee performance or behavior, the works council has co-determination rights under § 87 (1) No. 6 of the German Works Constitution Act (BetrVG). A legal review before rollout is strongly recommended." } }, { "@type": "Question", "name": "Does the Anthropic DPA cover Claude deployed through Amazon Bedrock?", "acceptedAnswer": { "@type": "Answer", "text": "No. When Claude is deployed through Amazon Bedrock, the AWS contractual stack governs — not the Anthropic DPA. Companies must review the AWS Data Processing Addendum and relevant AWS data protection documentation separately." } } ] } ] ```