Is Claude GDPR compliant? A guide for UK businesses

The short answer

Used on a business plan, with the right setup and sensible rules, Claude can be used in line with UK GDPR. Anthropic's Commercial Terms say data submitted through its services is processed under its Data Processing Addendum, and that Anthropic may not train models on customer content.²³

Used on free or personal accounts, by staff who paste in client or personal data, it is a different story. The difference is not the model. It is the account, the terms and the habits around it.

Who is responsible for what

When your business uses AI to process personal data, you remain responsible for that processing. On business plans, the AI provider acts on your instructions under a data processing agreement, and you decide what data goes in, why and how it is protected.¹

• Your business decides whether personal data is used at all, and on what lawful basis.
• Your business sets the rules for staff, controls access and keeps sensitive data out.
• Anthropic processes the data you submit under its Commercial Terms and Data Processing Addendum.

What Anthropic's business terms give you

• A Data Processing Addendum, including Standard Contractual Clauses, automatically incorporated into the Commercial Terms when you accept them.
• A commitment that Anthropic may not train models on customer content from its services.
• Outputs assigned to you, subject to the terms.²³⁴

On retention, Anthropic says chats you delete are removed from your history straight away and from its back-end systems within 30 days, and that API inputs and outputs are deleted within 30 days by default, with stated exceptions such as content flagged for policy violations.⁵

International transfers

Anthropic is a US company, so personal data you submit may be processed outside the UK. Transfers like this need an appropriate safeguard under UK GDPR. Anthropic's Data Processing Addendum includes Standard Contractual Clauses; check with your data protection adviser that the transfer terms cover your UK transfers, and record your assessment. The ICO publishes guidance on international transfers.³⁴

Your checklist

1. Use a business plan for all work use, never free or personal accounts.
2. Decide whether personal data needs to go in at all. Most useful work, such as drafting, summarising your own documents and analysis of anonymised figures, needs none.
3. Where personal data is involved, identify your lawful basis and update your records of processing.
4. Carry out a data protection impact assessment where the processing is likely to be high risk.
5. Write a short AI usage policy that lists what must never go in, and train everyone on it.
6. Set access so people only reach what their role needs, including any connected tools.
7. Review your privacy notice if AI changes how you use people's data.¹⁶

What should never go in

• health information and other special category personal data
• passwords, keys and access credentials
• payment card details
• identifiable client or customer information you do not need for the task
• anything a contract or confidentiality agreement says must not be shared⁷

Remove names and identifying details before you paste anything in. It is the simplest safeguard there is, and it removes most of the risk.