Is Claude Code GDPR compliant?

Yes

Anthropic · Coding

Yes. Anthropic offers a Data Processing Agreement (DPA) for Claude Code, the baseline GDPR control when a vendor processes personal data on your behalf.

What we checked

This assessment separates the consumer product from any business plan. It uses the vendor documents linked below; an unverified item is not a pass.

Data Processing Agreement: Confirmed; Anthropic publishes a DPA. A DPA is necessary but does not replace your own lawful-basis, DPIA and transfer assessment.
EU data residency: Not verified; No EU-residency option was confirmed in the sources reviewed for this profile.
Default data training: Opt-out required; Consumer accounts (Free, Pro, Max) are trained on when the data-sharing setting is enabled; turn off data sharing at claude.ai settings.
Business-tier training: No by default; Commercial users (Team, Enterprise, API) are not trained on for code or prompts sent to Claude Code under commercial terms.

Practical risk: Under commercial terms, Claude Code is not trained on, retains data 30 days by default (Zero Data Retention on qualified Enterprise), and rides Anthropic's SOC 2 and ISO 27001 with a BAA available. Consumer accounts are trained on when data-sharing is enabled and can retain data for 5 years.

How to make a decision

Check the precise account tier, written contract and intended data before approving Claude Code. A security certification, DPA or setting can apply to only part of a vendor's service. Keep the source links with your supplier review and revisit them when the vendor changes its terms.

More on Claude Code

Is Claude Code HIPAA compliant?Is Claude Code SOC 2 compliant?Is Claude Code ISO 27001 certified?Does Claude Code train on your data?

See the full Claude Code risk profile, with every data-handling fact and its source, or browse all rated AI tools.