Is Claude GDPR-Compliant? Examples, Costs and How to Start

“Is Claude GDPR-compliant?” is the question the IT lead gets when the sales team has been drafting offers with Claude for weeks and someone has just pasted a customer contract into a private Pro account. The answer depends less on the model than on the plan, the contract and where the data is processed. This article goes through it plainly, as of October 2026: what Anthropic offers today, what is missing for company use, what it costs and how to start. This is not legal advice - confirm the details with your data protection officer.

Is Claude GDPR-compliant?

Claude is not GDPR-compliant or non-compliant on its own: on a commercial plan with Anthropic’s Data Processing Addendum, clear rules for staff and your own documentation, companies can use it in a GDPR-compliant way. For customers in the EEA, Anthropic Ireland is the contracting partner, the DPA is part of the Commercial Terms and Anthropic may not train models on your inputs and outputs⁵. The open points are the private accounts in your team, the data location and your own paperwork.

Claude models, processed in Europe: Superkind

If you want Claude-class models for real work without setting up a cloud account in Frankfurt yourself, Superkind is one way. Superkind is the AI employee for your team: you write to it in Outlook or any email, Microsoft Teams, Slack or the Superkind web app like you would to a colleague, and it does the task in your programs through 1,500+ integrations such as SharePoint, DATEV, HubSpot and Personio. Superkind is hosted in Europe, GDPR compliant, aligned with the EU AI Act and never trains models on your data. It uses AI models from OpenAI, Anthropic, Mistral and Google, processed in Europe, and the DPA comes through the Trust Center.

1. 1

   You write the task

   In Outlook, Teams, Slack or the web app, in plain words: “Check the new supplier contract against our standard terms.”

2. 2

   Superkind does it in your systems

   It takes the contract from the email or SharePoint, compares it with your templates and your company knowledge, and follows your rules, such as “Liability clauses go to management”.

3. 3

   Superkind asks before anything goes out

   You get the list of deviations and the draft reply with Approve or Reject. Nothing is sent without your OK, and a colleague can approve in Teams or Slack.

4. 4

   Next time it runs as a routine

   What you explain once keeps running, for example “Every new supplier contract - check it, mark deviations, ask me”. Every task adds to your Company Brain.

What Claude offers today

Six facts from Anthropic’s own pages decide how Claude fits the GDPR.

1. Commercial plans with a DPA - Team (2 to 150 seats), Enterprise and the API run under the Commercial Terms. The Data Processing Addendum is incorporated by reference, so accepting the terms means accepting the DPA. The DPA includes Standard Contractual Clauses, and for customers in the EEA the contracting entity is Anthropic Ireland, Limited¹³⁵.
2. No training on business content - the Commercial Terms say Anthropic may not train models on Customer Content, meaning inputs and outputs. The exception: chats a user rates with thumbs up or down can be used; Team and Enterprise owners can switch this off with the “Rate chats” setting⁴⁵.
3. Consumer plans with a training choice - on Free, Pro and Max, chats are used for model improvement only if the user allows it in the Model Improvement setting, or if a chat is flagged for a safety review. Incognito chats are never used².
4. Admin and security features by plan - Team includes SSO and no training by default. Custom data retention, audit logs, SCIM, a Compliance API and IP allowlisting are Enterprise features¹.
5. Data location - for the first-party API, Anthropic offers the inference locations “global” (default) and “us”, and “us” as the only storage location for workspaces. An EU option is not listed as of October 2026⁶.
6. Claude through cloud providers - Amazon Bedrock offers EU cross-region inference profiles, where requests stay within EU regions. Google lists Claude models on Vertex AI for its EU endpoints. Model availability differs per region, and the cloud provider’s terms apply⁷⁸.

What is missing for company use

The contract is in place on commercial plans. The gaps are in practice and in the paperwork.

• Private accounts in the team - many people started with Free or Pro. Those chats sit outside your DPA, and the training choice is up to each person². Without a rule, customer data ends up there.
• No EU location in the Claude apps - if your data protection policy requires processing in the EU, Team and Enterprise do not offer that choice on Anthropic’s pages; the route is Bedrock or Vertex AI, which means building and running your own setup⁶⁷⁸.
• Transfers to third countries - without EU processing, data goes to the US. The DPA includes Standard Contractual Clauses for this, and your record of processing has to name the transfer³⁹.
• Your own documentation - a lawful basis under Art. 6 (and Art. 9 for health or other special data), an entry in the record of processing (Art. 30) and a DPIA (Art. 35) where the use is likely to be high risk⁹.
• AI literacy and transparency - Art. 4 EU AI Act has required AI literacy for staff since 2 February 2025; Art. 50 adds transparency duties from 2 August 2026, such as labelling AI-generated text published to inform the public unless a person reviewed it¹⁰.
• Work, not just answers - Claude writes, analyses and, with connectors, reads from your tools. Approvals before something is sent, team rules and routines across DATEV, HubSpot or SharePoint are not part of the chat; you set them up yourself or use a tool built for it.

Claude plans and the GDPR compared

As of October 2026. Where each option stands on the points that decide GDPR fit, with Superkind for comparison, based on the vendors’ own pages¹²⁵⁶⁷⁸. Not a compliance sign-off.

In short: private accounts are the wrong place for customer or employee data; with Team, Enterprise or the API you get the DPA and no training, and the open point is the data location. For the same question on other tools, see Is ChatGPT GDPR-compliant? and Is Microsoft Copilot GDPR-compliant?

Examples: Claude and the GDPR in practice

Five situations and what each needs to stay compliant.

1. Superkind checks contracts with models processed in Europe

Nadine forwards a supplier contract in Teams. Superkind compares it with your standard terms, lists the deviations and asks her before the reply goes out. The models run in Europe, there is no training on the data, and the DPA comes through the Trust Center. It connects through 1,500+ integrations such as SharePoint, DocuSign, DATEV and HubSpot. See contract review for how this runs day to day.

2. The sales team on Claude Team

Five people draft offers and emails in Claude Team. The DPA applies, inputs are not used for training, and SSO controls who gets in¹⁵. What is left: switch off “Rate chats” if you want no exceptions⁴, add Claude to the record of processing and name the transfer to the US.

3. A colleague uses Claude Pro privately

Someone pastes a customer complaint into a personal Pro account. That chat is outside your DPA, and whether it is used for training depends on that person’s setting². Make the rule explicit: company data only in company accounts.

4. The developers build on Bedrock in the EU

The IT team builds an internal assistant on Claude through Amazon Bedrock with an EU inference profile, so requests stay in EU regions⁷. The contract is now with AWS, model availability differs per region, and running the setup is your job.

5. HR summaries with health data

An HR lead wants Claude to summarise sick notes. Health data is a special category under Art. 9 GDPR, so a DPIA under Art. 35 is likely due⁹. For how to run one, see DPIA for AI agents.

What a compliant Claude setup needs (and what it costs)

Five points, none of which happens by itself.

• Commercial accounts only - company data only in Team, Enterprise or the API, where the DPA applies⁵.
• A decision on feedback - switch off “Rate chats” or tell staff not to rate chats with personal data⁴.
• A decision on the data location - accept processing in the US with the SCCs, or move to Bedrock or Vertex AI in the EU⁶⁷⁸.
• Record of processing and DPIA - add Claude to your record (Art. 30) and run a DPIA (Art. 35) where the risk is high⁹.
• AI literacy and transparency - train staff and set rules under Art. 4 EU AI Act; Art. 50 adds transparency duties for some AI-generated content¹⁰.

What Claude costs

As of October 2026. Anthropic list prices in US dollars, excl. tax¹. For the full breakdown see Claude pricing 2026.

Ten people on Team Standard with annual billing come to $200 per month before tax at list price. With US-only inference on the API, Anthropic charges 1.1x the standard token rate⁶; Bedrock and Vertex AI have their own regional prices.

Data protection and EU hosting

For a supplier contract, a customer email or an employee file, the personal data is processed in Europe from the first task, even when the work runs on an Anthropic model, with approval before anything leaves the team.

What Superkind costs

As of October 2026. Prices excl. VAT, for the whole company with unlimited users.

• Free - EUR 0 with a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and connection.
• Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
• Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, a DPA and help with the security review, payment by invoice.
• What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.

How to start

Start with one real task and put Claude in order in the same week. Three steps:

From the first task to your own app

With Superkind, the data stays in Europe from the first task to the app you build later. Four stages, on the contract example from above:

1. 1

   Ready in minutes

   Sign up for free, forward the first contract in Teams or by email and watch Superkind list the deviations.

2. 2

   Tasks become routines

   What you explain once keeps running as a routine, for example every new supplier contract checked the day it arrives. Before anything goes out, Superkind asks for approval.

3. 3

   Learns from day one

   Every task makes Superkind smarter. Your standard terms, suppliers and exceptions end up in your Company Brain, and that knowledge is never lost.

4. 4

   Your own app, without starting over

   When it gets more complex, you build custom solutions, apps and integrations on top of what Superkind already knows, for example your own contract app with deadlines and signature status: your Super App. Built yourself or together with us. It all belongs to you.

Conclusion

Claude can be used in a GDPR-compliant way: Team, Enterprise and the API come with a built-in DPA, Anthropic Ireland as partner and no training on your content. The open points are private Pro accounts, the missing EU location in Anthropic’s own offer and the paperwork that stays with you. If you want Anthropic models for real tasks, processed in Europe with approval before anything goes out, Superkind connects to SharePoint, DATEV, HubSpot and 1,500+ integrations from EUR 50 per month for unlimited users (as of October 2026). Write your Claude rule this week, then send Superkind one real task and compare.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, the AI employee teams write to in Outlook, Teams and Slack. Henri helps companies, from small teams to the Mittelstand, hand their routine work to AI - without new tools, consultants or an in-house AI team.