--- title: "Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise" description: "Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/claude-pro-privacy/" language: "en" --- ![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp) tools # Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise 6 October 2026 Is Claude Pro GDPR compliant? No. Claude Pro is not GDPR-compliant for business use because it does not include a Data Processing Agreement (DPA) under Article 28 GDPR. The minimum compliant tier for German business use is Claude Team; solo users need the Anthropic API. - Claude Pro runs on consumer terms — no DPA, no business controls, not suitable for business personal data. - Claude Team is the minimum GDPR-compliant tier: Article 28 DPA included, from approx. $25 per seat per month. - Before deployment: confirm the DPA/AVV, SCC coverage for transfers, and your EU data residency needs. **Claude Pro is not GDPR-compliant for business use because it does not include a Data Processing Agreement (DPA) under Article 28 GDPR.** Any business that processes personal data — client records, employee files, third-party correspondence — through Claude Pro has no contractual processing basis under EU data protection law. **The minimum compliant plan for German business use is Claude Team.** Solo users who cannot meet a team plan should use the Anthropic API. This page gives you the decision in the first screen: the compliance verdict for every Claude plan, the cheapest compliant tier, and the checks to complete before any deployment. It provides general information, not legal advice for a specific implementation. ## Claude Plan Compliance Verdicts at a Glance (2026) | Plan | Article 28 DPA included | Suitable for business personal data | Verdict | | ----------------- | ----------------------- | ----------------------------------- | ---------------------------------------------------------- | | Claude Free | No | No | Consumer use only | | Claude Pro | No | No | Not for business personal data | | Claude Team | Yes — automatic | Yes | **Minimum compliant tier** | | Claude Enterprise | Yes — automatic | Yes | For SSO, audit logs, EU data location, Zero-Data-Retention | | Anthropic API | Yes — automatic | Yes | Compliant option for solo users and developers | **Looking for a “Claude Business” plan?** There is no separate Anthropic SKU with that name — “Claude Business” is a market term for Claude Team. We cover the naming confusion and current pricing on our [Claude Business](https://compound.law/en-DE/tools/claude-business/) page. **The decision in 30 seconds:** - **Using Claude Pro with personal data today?** Stop the workflow and move it to Claude Team or the Anthropic API — every day of processing without a DPA is a violation of Article 28 GDPR. - **Need the cheapest compliant tier?** Claude Team — DPA included automatically, from approx. $25 per seat per month (Standard seat, billed annually; regional pricing may differ). - **Need SSO, audit logs, or EU data residency?** Claude Enterprise is the upgrade path. - **Solo practitioner or micro-team?** The Anthropic API includes the DPA without a team minimum. ## Pre-Deployment Checklist for German Businesses Before any Claude deployment processes personal data, complete these checks: 1. **Confirm the DPA/AVV is in force.** The Anthropic DPA is incorporated into the Commercial Terms for Claude for Work products (Team, Enterprise, API). Verify it in the console at console.anthropic.com and keep a dated record for your procurement file. 2. **Check international transfers and SCCs.** The DPA includes Standard Contractual Clauses. Map where your personal data flows and confirm the Chapter V GDPR transfer mechanism covers every route. 3. **Clarify EU hosting and data residency.** Claude Team does not promise EU data residency. If residency is a hard requirement, evaluate Claude Enterprise with configurable data location via AWS Bedrock or Google Vertex AI — see our [Claude EU hosting](https://compound.law/en-DE/tools/claude-eu-hosting/) page. 4. **Verify Article 32 safeguards.** SSO, audit logs, and Zero-Data-Retention are Enterprise-only. Document which technical and organizational measures your deployment actually has. 5. **Set internal ground rules.** Adopt a permitted-use policy, involve the works council (Betriebsrat) where co-determination applies, and run a DPIA for high-risk processing — the full framework is on our [Claude GDPR](https://compound.law/en-DE/tools/claude-gdpr/) page. ## What Is Claude Pro — and Why Does It Fail Article 28 GDPR? **Claude Pro** is Anthropic’s paid consumer subscription for individuals, priced at approximately €18 per month. It provides higher usage limits and more capable models than the free tier — but it is legally structured identically to Claude Free: consumer terms, no DPA, no business controls. **Article 28 GDPR** requires a written contract (a DPA; in German, **Auftragsverarbeitungsvertrag, AVV**) whenever a business has a third party process personal data on its behalf. Without one, the processing cannot lawfully proceed. Claude Pro fails this test on three counts: - **No DPA:** Anthropic treats Claude Pro subscribers under consumer terms, outside the controller-processor framework. There is no contractual basis for business processing of personal data. - **No processor commitments:** The consumer terms do not carry the Article 28 obligations — processing security, sub-processor controls, assistance duties — that GDPR-compliant processing requires. - **No Article 32 controls:** No access controls, audit logs, or SSO — the organizational safeguards a defensible business deployment needs. The problem is not theoretical. Client contracts, HR documents, or support tickets pasted into Claude Pro are concrete Article 28 violations, regardless of data volume. ## Can You Use Claude Pro for Work at All? Using Claude Pro *at work* differs from using it to *process personal data*: **Permitted without GDPR concerns:** - Brainstorming and drafting content with no identifiable individuals - Reviewing general contract templates without party details - Research on publicly available, non-personal topics **Not permitted:** - Client or customer data of any kind - Employee or applicant information - Contracts with named parties or identifiable terms - Support tickets or correspondence involving individuals **Practical rule:** if you are unsure whether data may enter Claude Pro, assume it may not. The compliant alternative costs less than one GDPR fine letter — see the upgrade paths below. ## Upgrade Paths From Claude Pro **Claude Team** is the minimum tier for GDPR-compliant business use: DPA automatically incorporated, conversations excluded from model training, central team administration. For what the plan includes and where it stops, see our [Claude Team GDPR](https://compound.law/en-DE/tools/claude-team-gdpr/) review. **The Anthropic API** includes the same DPA and suits solo practitioners and developer teams — the only compliant route without a team-seat minimum. **Claude Enterprise** adds SSO, audit logs, configurable data location, and optional Zero-Data-Retention for organizations with stricter governance needs. For what the DPA obligates Anthropic to, see our [Claude DPA](https://compound.law/en-DE/tools/claude-dpa/) analysis. > **Upgrade path from Claude Pro** > > Minimum compliant tier: **[Claude Team](https://compound.law/en-DE/tools/claude-team-gdpr/)** (DPA included, from approx. $25/seat/month). Need SSO, audit logs, or EU data residency? The next step is **[Claude Enterprise](https://compound.law/en-DE/tools/claude-enterprise/)**. Compound Law advises businesses, founders, and in-house legal teams in Germany on **GDPR compliance, AI procurement, and commercial contracts**. If you want your Claude deployment reviewed — including the step from Claude Pro to a business tier — [contact us](https://compound.law/en-DE/#booking). ## FAQ: Claude Pro and GDPR ### Is Claude Pro GDPR compliant? No. Claude Pro does not include a Data Processing Agreement under Article 28 GDPR. Any business use involving personal data has no lawful contractual basis under GDPR. The minimum compliant tier is Claude Team; solo users should use the Anthropic API. ### Does Claude Pro include a data processing agreement (DPA)? No. The Anthropic DPA is incorporated into the Commercial Terms only for Claude for Work products — Claude Team, Claude Enterprise, and the Anthropic API. Claude Free and Pro run on consumer terms with no DPA. Details in our [Claude DPA](https://compound.law/en-DE/tools/claude-dpa/) analysis. ### Which Claude plan is the minimum for GDPR-compliant business use in Germany? Claude Team — DPA included automatically, from approx. $25 per seat per month. There is no separate Claude Business plan; that search term maps to Claude Team. Solo users who cannot staff a team plan use the Anthropic API. ### Does the Anthropic DPA include Standard Contractual Clauses (SCCs)? Yes. Anthropic states its DPA with SCCs is automatically incorporated into the Commercial Terms for commercial products. Confirm the SCCs cover your data-transfer routes before go-live. ### Does Claude Pro or Claude Team offer EU data residency? No. EU data residency is not part of Claude Pro or Claude Team. Claude Enterprise offers configurable data location via AWS Bedrock or Google Vertex AI. See our [Claude EU hosting](https://compound.law/en-DE/tools/claude-eu-hosting/) page. ### Can employees use personal Claude Pro accounts for work? Not for personal data. Without a DPA, processing client, employee, or candidate data via a personal Pro subscription violates Article 28 GDPR. Provide Claude Team or API access with a permitted-use policy instead. ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) [![Claude ZDR zero data retention guide for Anthropic API and Claude Code enterprise use](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-zdr/) [tools](https://compound.law/en-DE/tools/claude-zdr/) ### [Claude ZDR: What It Covers, Who Qualifies, How to Get It](https://compound.law/en-DE/tools/claude-zdr/) [Claude ZDR is available for the Anthropic API and Claude Code. See which plans qualify, what's excluded, and how to request enablement for your organization.](https://compound.law/en-DE/tools/claude-zdr/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks tools](https://compound.law/en-DE/tools/hubspot/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions No. Claude Pro does not include a Data Processing Agreement (DPA) under Article 28 GDPR. Any business use that involves personal data — client records, employee data, third-party correspondence — has no contractual processing basis under GDPR. The minimum compliant tier is Claude Team. No. Anthropic incorporates its DPA into the Commercial Terms only for Claude for Work products — Claude Team, Claude Enterprise, and the Anthropic API. Claude Free and Claude Pro operate under consumer terms with no DPA and no processor role under Article 28 GDPR. Claude Team. It includes the Article 28 DPA automatically from approx. $25 per seat per month. There is no separate Claude Business plan — that search term maps to Claude Team. Solo users who cannot staff a team plan use the Anthropic API instead. Yes. Anthropic states its DPA with Standard Contractual Clauses is automatically incorporated into the Commercial Terms of Service for commercial products. SCCs are the transfer mechanism your business relies on for any personal-data flows outside the EU under Chapter V GDPR. No. Neither Claude Pro nor Claude Team promises EU data residency. Claude Enterprise offers configurable data location via AWS Bedrock or Google Vertex AI. If EU hosting is a hard requirement for your deployment, Enterprise is the tier to evaluate. Not for personal data. A personal Claude Pro subscription has no DPA, so processing client, employee, or candidate data through it violates Article 28 GDPR — a shadow-IT risk. Companies should provide Claude Team or API access with a permitted-use policy instead. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise", "description": "Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.", "image": "https://compound.law/assets/images/tools/tools_1.webp", "datePublished": "2026-10-06T00:00:00.000Z", "dateModified": "2026-10-06T00:00:00.000Z", "author": { "@type": "Person", "name": "Julian Jantze", "image": "https://compound.law/assets/images/team/julianjantze.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/claude-pro-privacy/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise", "item": "https://compound.law/en-DE/tools/claude-pro-privacy/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is Claude Pro GDPR compliant?", "acceptedAnswer": { "@type": "Answer", "text": "No. Claude Pro does not include a Data Processing Agreement (DPA) under Article 28 GDPR. Any business use that involves personal data — client records, employee data, third-party correspondence — has no contractual processing basis under GDPR. The minimum compliant tier is Claude Team." } }, { "@type": "Question", "name": "Does Claude Pro include a data processing agreement (DPA)?", "acceptedAnswer": { "@type": "Answer", "text": "No. Anthropic incorporates its DPA into the Commercial Terms only for Claude for Work products — Claude Team, Claude Enterprise, and the Anthropic API. Claude Free and Claude Pro operate under consumer terms with no DPA and no processor role under Article 28 GDPR." } }, { "@type": "Question", "name": "Which Claude plan is the minimum for GDPR-compliant business use in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "Claude Team. It includes the Article 28 DPA automatically from approx. $25 per seat per month. There is no separate Claude Business plan — that search term maps to Claude Team. Solo users who cannot staff a team plan use the Anthropic API instead." } }, { "@type": "Question", "name": "Does the Anthropic DPA include Standard Contractual Clauses (SCCs)?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. Anthropic states its DPA with Standard Contractual Clauses is automatically incorporated into the Commercial Terms of Service for commercial products. SCCs are the transfer mechanism your business relies on for any personal-data flows outside the EU under Chapter V GDPR." } }, { "@type": "Question", "name": "Does Claude Pro or Claude Team offer EU data residency?", "acceptedAnswer": { "@type": "Answer", "text": "No. Neither Claude Pro nor Claude Team promises EU data residency. Claude Enterprise offers configurable data location via AWS Bedrock or Google Vertex AI. If EU hosting is a hard requirement for your deployment, Enterprise is the tier to evaluate." } }, { "@type": "Question", "name": "Can employees use personal Claude Pro accounts for work?", "acceptedAnswer": { "@type": "Answer", "text": "Not for personal data. A personal Claude Pro subscription has no DPA, so processing client, employee, or candidate data through it violates Article 28 GDPR — a shadow-IT risk. Companies should provide Claude Team or API access with a permitted-use policy instead." } } ] } ] ```