Can a company use Claude under GDPR?

Yes, with the usual processor safeguards: a lawful basis, a data processing agreement, transfer safeguards where data leaves the EEA, a record of processing and, for high-risk processing, an impact assessment.

Can the Claude API keep inference in Europe?

Not directly today. The Claude API's inference_geo setting offers global and us, and us is the only workspace geo for data at rest (Claude API data residency).

Which routes process Claude requests in Europe?

Anthropic lists Europe processing on Amazon Bedrock and Google Cloud, with Microsoft Foundry marked as coming soon (regional compliance). A gateway that pins requests to European endpoints is the other route.

Is Claude GDPR compliant?

GDPR compliance is a duty of your company as controller. Claude can be part of compliant processing when you have a lawful basis, a signed DPA, transfer safeguards where needed and a record of processing.

Does Claude Enterprise process data in Europe?

Anthropic's regional compliance page lists Europe processing on Amazon Bedrock and Google Cloud. The Claude API offers global or US-only inference as of 7 November 2026.

Does a Standard Compute Europe rule cover retries and fallbacks?

Yes. Every request, including retries and fallbacks, is served only by approved European inference endpoints. If no European endpoint can serve it, the request is refused before your prompt is sent.

Where is our account data stored with Standard Compute?

Your account and usage records are stored in Frankfurt, Germany, and our EU gateway runs in Finland. Request records hold metadata only, never your prompts or outputs.

How to use Claude in Europe under GDPR

GDPR does not name AI vendors. It asks for a lawful basis, a written contract with each processor, safeguards for any transfer outside the EEA, and a record of what you process. For Claude, the practical question is where inference runs, because that decides how much of the transfer work you take on.

This guide sets out the routes and the steps. It is practical guidance for IT and engineering leads, and your data protection officer makes the final call. Vendor facts are from Anthropic, AWS, Google and Microsoft.

By Standard Compute · Facts checked 7 November 2026 · Where Standard Compute does these steps

Short answers

Can a company use Claude under GDPR?: Yes, with the usual processor safeguards: a lawful basis, a data processing agreement, transfer safeguards where data leaves the EEA, a record of processing and, for high-risk processing, an impact assessment.
Can the Claude API keep inference in Europe?: Not directly today. The Claude API's inference_geo setting offers global and us, and us is the only workspace geo for data at rest (Claude API data residency).
Which routes process Claude requests in Europe?: Anthropic lists Europe processing on Amazon Bedrock and Google Cloud, with Microsoft Foundry marked as coming soon (regional compliance). A gateway that pins requests to European endpoints is the other route.

Four routes to Claude and where each one processes

Pick the route first. Every later step depends on it.

Four routes to Claude and where each one processes
Route	Where inference runs	What you manage
Claude API (first party)	Where inference runs: Global by default, or US only at 1.1 times the standard price	What you manage: A transfer to the US and Anthropic's DPA. No Europe option as of 7 November 2026.
Amazon Bedrock	Where inference runs: Europe through the `eu.` geographic cross-Region inference profiles, which keep processing in EU Regions	What you manage: AWS account, IAM, quotas per Region, and your own controls for identity, spend and records.
Google Cloud	Where inference runs: European regions for Claude models on Google Cloud	What you manage: Google Cloud project, quotas and the same identity, spend and record controls.
Microsoft Foundry	Where inference runs: Claude deployments use the US Data Zone; Anthropic lists Europe as coming soon	What you manage: Not a Europe route today.
An AI gateway with a Europe rule	Where inference runs: Only on the European endpoints the gateway allows	What you manage: The gateway's DPA and sub-processor list. Identity, spend and records come with it.

Sources: Anthropic data residency and regional compliance pages, AWS Bedrock geographic cross-Region inference, Microsoft Foundry Claude hosting options.

Use Claude under GDPR in eight steps

Steps one, two and seven are the GDPR paperwork. Steps three to six are configuration.

Map the personal data that will reach Claude
List what goes in (prompts, pasted documents, files, code with customer data) and what comes out (answers, logs, transcripts). Note special categories such as health data, which need a separate condition under Article 9.
Set the lawful basis and assess the risk
Record the lawful basis for each use under Article 6. Where processing is likely to be high risk, for example profiling or large volumes of sensitive data, carry out a data protection impact assessment under Article 35 before you start (GDPR on EUR-Lex).
Choose a route that processes in Europe
If you want inference in Europe, use Bedrock's eu. inference profiles, a European region on Google Cloud, or a gateway with a Europe rule. On the Claude API, inference runs globally or in the US (data residency).
Check model by model. Not every Claude model is offered in every European region, and new models can reach Europe later than the US.
Sign the processor terms
Article 28 requires a contract with every processor. Sign the DPA of the party you contract with: Anthropic, AWS, Google or the gateway. Read its sub-processor list and notice period, because a sub-processor outside the EEA brings transfer safeguards back in.
Set retention and training controls
Anthropic does not train on commercial inputs and outputs by default. On Claude Enterprise, chat data is kept until an admin sets a retention period of at least 30 days; set one. Zero data retention for eligible APIs and Claude Code on Enterprise needs Anthropic's approval (zero data retention).
Make the European route the only route
A Europe setting on one project doesn't stop a developer calling a global endpoint from another. On AWS, allow only the eu. inference profile IDs in IAM. In Claude Code, pin the endpoint in managed settings with allowedProviders and the base URL, so sessions pointed anywhere else are refused (Claude Code admin setup).
Update your records and privacy notice
Add the processing to your records of processing activities under Article 30: purpose, categories of data, recipients, transfers and retention. Update your employee or customer privacy notice if people's data reaches the model.
Re-check every quarter
Regions, models and sub-processors change. Diary a quarterly check of the vendor's residency page, its sub-processor list and the models your teams use.

Where Standard Compute does these steps for you

Standard Compute is the gateway route in the table above. It covers the configuration steps and gives your DPO the documents for the paperwork steps.

Where Standard Compute does these steps for you
Step	What Standard Compute does
Processing in Europe	What Standard Compute does: Set a Europe rule for your company, a team or a single key, and every request, including retries and fallbacks, is served only by approved European inference endpoints. If no European endpoint can serve it, the request is refused before your prompt is sent. Our EU gateway terminates TLS and runs in Finland, and your account data is stored in Frankfurt.
Claude in Europe	What Standard Compute does: Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 are available under a Europe rule, alongside open models from European providers.
Processor terms	What Standard Compute does: Sign our Data Processing Agreement in the dashboard. It commits us to no training on your data, no retention of your content, and breach notification within 72 hours. We publish every sub-processor with its purpose, data and location, and give you 14 days' notice before adding a new one.
Retention and training	What Standard Compute does: Turn on zero data retention for your company, a team or a key, and every request is routed only to inference endpoints that commit to keeping no copy of your data. Teams and keys inherit the requirement and can never switch it off underneath you. Standard Compute never trains on your prompts or outputs. With a region rule or zero retention turned on, every request goes only to providers that commit not to train on it.
The only route	What Standard Compute does: Choose exactly which inference providers may handle your data, for the whole company, a team or a single key. Lower levels can only narrow the rules, new providers are never added without an admin's approval, and fallbacks can never route around your list.
Records	What Standard Compute does: Your account and usage records are stored in Frankfurt, Germany, and our EU gateway runs in Finland. Request records hold metadata only (model, provider, tokens, cost and status), never your prompts or outputs.

Standard Compute dashboard, audit log: a change of the company-wide region rule from any region to Europe, zero data retention required, a pay-as-you-go limit raised from $5,000 to $8,000 a month, a model added to an application key, and a domain verified for single sign-on. — The admin audit log in the Standard Compute dashboard. The company shown is example data.

Our DPA is public at /dpa and the sub-processor list at /sub-processors. In a Europe rule, Europe means the EU and EEA, the UK and Switzerland.

Create a company workspaceRead the enterprise overview

Questions from IT, security and finance

Is Claude GDPR compliant?: GDPR compliance is a duty of your company as controller. Claude can be part of compliant processing when you have a lawful basis, a signed DPA, transfer safeguards where needed and a record of processing.
Does Claude Enterprise process data in Europe?: Anthropic's regional compliance page lists Europe processing on Amazon Bedrock and Google Cloud. The Claude API offers global or US-only inference as of 7 November 2026.
Does a Standard Compute Europe rule cover retries and fallbacks?: Yes. Every request, including retries and fallbacks, is served only by approved European inference endpoints. If no European endpoint can serve it, the request is refused before your prompt is sent.
Where is our account data stored with Standard Compute?: Your account and usage records are stored in Frankfurt, Germany, and our EU gateway runs in Finland. Request records hold metadata only, never your prompts or outputs.

How to use Claude in Europe under GDPR

Short answers

Four routes to Claude and where each one processes

Use Claude under GDPR in eight steps

Map the personal data that will reach Claude

Set the lawful basis and assess the risk

Choose a route that processes in Europe

Sign the processor terms

Set retention and training controls

Make the European route the only route

Update your records and privacy notice

Re-check every quarter

Where Standard Compute does these steps for you

Questions from IT, security and finance

Related pages

Sources, checked on 7 November 2026