Menu
No data was found
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Whether you’re a one-person operation or a growing business with a full team, we’re here to help. Get in touch and let’s talk about what we can do for you.
Claude can be used in a way that meets UK GDPR requirements, but only on commercial terms and with the correct setup. Anthropic provides the contractual side. Everything else, the lawful basis, the records, the decisions about what staff may put in, is your responsibility as the controller.
There is no single switch that makes an AI system “GDPR compliant.” Compliance depends on two sides working together: what the vendor provides and what your organisation does with it.
Anthropic’s commercial terms include a data processing addendum that sets out security measures, subprocessor obligations, and deletion commitments. GDPR compliance is a shared responsibility between vendors and organisations. Anthropic holds ISO 27001:2022 certification, ISO/IEC 42001:2023 certification for AI management systems, and SOC 2 Type II certification. Encryption standards include AES-256 for data at rest and TLS 1.2+ for data in transit. These certifications support enterprise procurement assessments and are relevant for regulatory compliance documentation.
Anthropic models used in Claude models are designed with privacy and security in mind, ensuring that data processing is controlled and compliant under the commercial terms.
You must establish a lawful basis for processing personal data under UK GDPR (Article 6), such as legitimate interests or performance of a contract. You must be transparent with data subjects about what data you collect, how Claude processes personal data, and where it goes. You must practise data minimisation, only inputting what is necessary and anonymising where possible. And you must carry out a risk assessment, including a formal data protection impact assessment where the processing is high risk.
The distinction matters. Anthropic can give you the contractual and technical controls. Whether your deployment of Claude is compliant depends on how you configure and govern it within your organisation.
Which side of the line you are on decides what contract you need, and consumer plans are on the wrong side of it.
When your business uses Claude to handle personal data, your organisation is the data controller. You decide what data to send, why, and for what purpose. Anthropic acts as your processor, handling that data on your behalf and on your instructions.
That controller-processor relationship requires a binding data processing agreement under Article 28 of the UK GDPR. It must set out the scope of processing, security obligations, subprocessor arrangements, breach notification and your audit rights. Claude Team and Enterprise include one.
Under Anthropic’s consumer terms, Anthropic may act as an independent controller of what you input. No DPA between your organisation and Anthropic, no contractual obligation to process only on your instructions, and no Article 28 protections.
For any UK business processing personal data, that last one is a compliance gap rather than a technicality.
A signed DPA is required before processing personal data through Claude in a business context. Anthropic’s data processing addendum is included in commercial plans only. The DPA covers Team, Enterprise, and API tiers. When you accept those commercial terms, the DPA is automatically incorporated.
The DPA incorporates EU Standard Contractual Clauses for international data transfers and includes the UK Addendum, which makes those clauses valid under UK GDPR when data flows from the UK to jurisdictions without an adequacy decision.
Confirm it covers the categories of personal data and processing activities your business needs
Check which third parties will handle your data and where they are located
Understand what happens to conversation data after processing and what custom retention controls are available on your plan
Confirm the timeframe and process Anthropic follows if a data breach occurs
Check whether you or a nominated third party can audit Anthropic’s compliance with the DPA terms
Data residency refers to where your data is stored and where the AI model runs its processing. This matters under UK GDPR because personal data transferred outside the UK needs a lawful transfer mechanism.
When you use the Claude API or Claude’s web interface under commercial terms, the data involved may be processed on infrastructure outside the UK. Anthropic’s published documentation does not currently confirm a UK-only data residency option through its direct service.
For organisations that need EU data residency, Anthropic supports deployments through AWS Bedrock, Google Vertex AI and Microsoft Foundry, which may offer EU-only processing through regional endpoints. AWS Bedrock EU profiles and Google Cloud Vertex configurations may allow you to keep workspace data storage and inference within an EU data boundary.
For international transfers under Anthropic’s direct service, the DPA uses Standard Contractual Clauses and the UK Addendum as the transfer mechanism. This is the same approach used across the industry when EU personal data or UK personal data moves to the United States or other jurisdictions.
Handling customer data through Claude processes personal data with particular caution. Your organisation remains the data controller and must ensure that any personal data or confidential information you input is processed lawfully and securely.
Confidential documents, such as contracts, client records, or sensitive internal papers, should only be input into Claude under strict policies that limit access and ensure compliance with data protection principles. Avoid inputting special category data unless you have explicit lawful basis and safeguards.
Implement clear staff guidance on what constitutes confidential data and how to handle it within Claude. Define escalation procedures for any suspected data breaches or misuse.
Verify you are on a commercial Claude plan (Team, Enterprise, or API) with Anthropic's data processing agreement active. Consumer plans (Claude Free, Pro, Max) do not include a DPA and are not suitable for processing personal data in a business context.
Under Article 6 of the UK GDPR, you need a lawful basis for each type of personal data processing you intend to carry out through Claude. Common bases for business use are legitimate interests or performance of a contract. Record your reasoning.
Set clear rules for what data can and cannot be entered into Claude. Specify that confidential documents, special category data (such as health records or biometric data), and client confidential data must not be input without explicit authorisation and safeguards. Define escalation protocols and who approves exceptions.
If your use case involves health data, racial or ethnic origin, biometric data, or any other special category data, you need a separate lawful basis under Article 9 of the UK GDPR. Consult your Data Protection Officer or adviser before proceeding.
Add Claude to your processing records: what categories of personal data are processed, retention periods, data flows including international transfers, subprocessors, and the lawful basis for each activity.
A DPIA is legally required under Article 35 for high risk processing. If you are deploying Claude across the organisation, handling large volumes of personal data, or inputting sensitive data, carry out a DPIA before go-live. Your DPO should assess whether your specific use case triggers this requirement.
Ensure only authorised staff can access Claude under your commercial plan. Check whether your plan provides audit logs to support usage policy enforcement and accountability.
Most UK SMEs we work with know they should be doing something about AI governance but do not have the internal resource to build a compliance framework from scratch. The Core AI Security Pack gives you the structure: AI policy templates, DPIA frameworks and the compliance documentation that shows deploying Claude was done with proper governance in place.
It does not replace legal advice. It sits between the legal requirements and the day-to-day reality of staff using Claude with real data.
We Do Your IT Support helps UK businesses implement AI tools with proper data protection governance in place. If you are considering deploying Claude across your organisation and want to understand your compliance position before staff start using it with real data, we can help.
Book half an hour on a call with Adam Gillett. He will talk you through how we approach AI data security, what we would put in place and why, and what we would be watching for in a business like yours. No charge and no expectation that you buy anything. The Core AI Security Pack then gives you the complete framework to move from there to compliant deployment.
Get in touch to discuss your Claude implementation and compliance requirements.
Anthropic does not train models on data from commercial plans. Claude’s commercial terms prohibit training on customer data. This is a contractual commitment built into Anthropic’s commercial terms, not a user setting you need to toggle. Under consumer terms, data may be used for model training depending on your settings, with retention of up to five years if you opt in to allow training data use.
Retention policies differ by plan and data type. Anthropic deletes API inputs and outputs within 30 days. Claude retains deleted chats for 30 days by default. Zero data retention (ZDR) is available for eligible API traffic and for qualifying enterprise customers handling sensitive data, preventing storage beyond the active session. Some data may be retained for up to 2 years for safety reviews where content has been flagged. Data retention policies aim to keep personal data only as long as necessary for specified purposes.
There is no confirmed UK-only data residency option through Anthropic’s direct service at the time of writing. Alternative routes through AWS Bedrock or Google Cloud Vertex may offer EU data residency through regional endpoints. Confirm current options directly with Anthropic, as these arrangements may change. Ask specifically about whether inference and storage can both be confined to a UK or EU region for your plan.
A data protection impact assessment is often necessary for deployment, particularly where your organisation is rolling out Claude across teams, handling large volumes of personal data, or processing special category data. Article 35 of the UK GDPR requires a DPIA for high-risk processing. Your Data Protection Officer should assess whether your specific use case meets that threshold. Even where a DPIA is not strictly required, completing one demonstrates good governance.
The team plan, by comparison, offers standard seats and premium seats at fixed rates billed annually or monthly with a minimum of five seats, giving you more predictable budgeting.