Is Claude GDPR compliant in Ireland? A small business guide

Short answer: Claude can be used in a GDPR-compliant way by an Irish small business, if you use a business plan, accept the Data Processing Addendum, and put a few plain rules in place for your team. No AI tool is "GDPR compliant" on its own. Compliance is about how you use it, and that part is yours.

This guide is written for the owner of a small Irish firm who wants to use Claude for drafting, summarising, admin and customer work without creating a data protection problem. It is not legal advice. Every claim about Anthropic's terms was checked in August 2026 and is cited so you can read the live version, because terms change. For the wider comparison, see Claude vs ChatGPT for Irish small businesses. If you want this done for you, see Claude for Small Business setup in Ireland and the FMOps data protection and security page, which lists the DPA I sign with every client.

Who is the controller and who is the processor?

Under GDPR you are the controller: you decide why and how personal data is used. Anthropic, when it runs Claude for you on a business plan, is your processor. GDPR Article 28 requires a written contract between the two. The Data Protection Commission's Know Your Obligations pages set out what a controller must do, and its 2024 note on AI, large language models and data protection is worth ten minutes of your time.

Which Claude plan can you use with client data?

This is the decision that settles most of the question. The plan you pick changes the contract you get. Checked against Anthropic's published terms in August 2026.

• Claude Free, Pro and Max (consumer, claude.ai). Governed by the Consumer Terms. No Data Processing Addendum. Model training is a privacy setting you choose, and chats used for training can be kept for up to five years. There is no admin console and no company-level control. Verdict: personal use only. Never client personal data.
• Claude Team. Commercial Terms, which incorporate the Data Processing Addendum by reference. No training on your inputs or outputs by default. Admin console for adding and removing staff. Verdict: the normal choice for an Irish SME.
• Claude Enterprise. Everything in Team plus stronger admin controls, SSO, audit logs and longer retention settings. Verdict: for regulated firms and larger teams.
• Anthropic API. Commercial Terms and the same DPA. You control what is sent and logged, which suits an app you build. Processing is not EU-only. Verdict: fine for products, not a substitute for a staff tool.
• Claude via AWS Bedrock. Your contract is with AWS. You choose the region, so data stays in the EU. Verdict: the only route to true EU data residency.

The short rule: the app you log into personally is not the app your business should run on. If a member of staff pastes a client file into their own Claude Pro account, you have a processor with no contract. For the setup steps, see how to set up Claude for a small business team, and for the cost, Claude Team pricing in Ireland.

Does Anthropic train Claude on your data?

For business products, Anthropic's privacy centre states: "By default, we will not use your inputs or outputs from our commercial products to train our models." The exception is where you explicitly send feedback (for example, the thumbs-up and thumbs-down buttons) or otherwise opt in. The Commercial Terms of Service say the same in contract language: Anthropic may not train models on Customer Content from the Services, and the customer retains rights to inputs and owns outputs.

Consumer plans (Free, Pro and Max) are governed by separate Consumer Terms and a separate privacy setting. There, training is a choice the user makes, and Anthropic states that conversations used for training may be kept in de-identified form for up to five years. On Team and Enterprise an administrator can also switch off the feedback feature entirely in Data and Privacy settings, which closes the one route by which a rated conversation could be used. Checked Aug 2026 — read the full training policy article for the live wording before you rely on it.

That difference is the practical reason to keep work on a business plan. It is the plan where the no-training default, the admin control and the DPA all apply at once.

What does the Data Processing Addendum cover?

The Anthropic Data Processing Addendum is incorporated by reference into the Commercial Terms, so accepting the business terms puts it in place. At the time of writing it includes:

• EU Standard Contractual Clauses (Modules Two and Three) for transfers out of the EEA, plus UK and Swiss addenda.
• Sub-processors listed at anthropic.com/subprocessors, with 15 days' notice of additions and a right to object.
• Deletion: within 30 days of termination Anthropic will delete Customer Data, subject to legal-hold and safety exceptions.
• Security: AES-256 encryption at rest, TLS 1.2+ in transit, multi-factor authentication, role-based access, annual penetration testing.
• Contracting entity: for customers in the EEA, Switzerland or UK, "Anthropic" means Anthropic Ireland, Limited.

You do not have to negotiate it. Accepting the Commercial Terms when you set up a Team or Enterprise workspace puts the DPA in place. Save a PDF of the DPA and the Commercial Terms on the day you accept them. If the Data Protection Commission or a customer asks how you meet Article 28, that file is the answer. FMOps signs its own DPA with every client on top of that — the terms are on the Claude security and data protection page.

Where is your data processed and how are transfers handled?

Contracting through an Irish entity does not by itself mean data stays in Ireland. Two different things get confused here, so separate them.

• Transfer safeguard. Anthropic's DPA covers transfers to the United States and elsewhere through the EU Standard Contractual Clauses. This is the normal, accepted mechanism, and for most small businesses it is enough.
• Data residency. This means your data is stored and processed only inside the EU. As checked in August 2026, claude.ai and the Anthropic API do not offer this. The route that does is running the Claude models through AWS Bedrock in an EU region — Ireland (eu-west-1), Frankfurt (eu-central-1) or Paris (eu-west-3). There, your contract is with AWS, the region is yours to choose, and the data stays in it.

So the answer to "can I keep Claude data in the EU?" is yes, but only through Bedrock, and only if you are building on the API rather than using the chat app. If your requirement is EU-only storage for the staff chat tool, that requirement is not met today. Say so honestly in your assessment rather than assuming it. Check the sub-processor list for where each service runs.

What must an Irish SME do before using Claude with personal data?

Six steps. None takes more than an afternoon.

1. Move everyone onto a business plan. Team or Enterprise, one workspace, company email addresses. Close the personal Pro accounts used for work.
2. Get the DPA on file. Accept the Commercial Terms, download the DPA and Commercial Terms as PDFs, and note the date and version.
3. Add an entry to your record of processing activities. Article 30. Name Anthropic Ireland, Limited as processor, the purpose, the data categories, the transfer safeguard and the retention period. A spreadsheet row is fine.
4. Write a one-page staff AI policy. What Claude may be used for, who reviews the output, and the rule that no decision affecting a customer is made by the tool alone.
5. List what must never be pasted in. Special category data (health, biometric, trade union, religious or political), full PPS numbers, card and bank details, passwords, garda vetting material, and anything under legal privilege unless you have assessed it. Give staff the list, not a lecture.
6. Read the DPC guidance. The Data Protection Commission's note on AI and large language models sets the Irish regulator's expectations, and its DPIA guidance tells you when a higher-risk use needs an assessment before you start.

Sector matters. An accountancy or legal practice handling client files should also check its professional body's rules on confidentiality and outsourcing before it starts. See Claude for accountants in Ireland for how that works in practice.

What retention and access controls do you have?

Two layers. First, Anthropic's own retention, set out in its privacy policy and the DPA. Second, your controls inside the product: on Team and Enterprise plans an admin can manage members, remove people who leave, and delete conversations. Use them. Set a rule that customer files are removed from Claude projects when the job closes, and that anyone leaving the firm is removed the same day.

Why does human oversight matter?

GDPR Article 22 gives people the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. For a small firm this means: Claude can draft the credit-control letter, score the lead or summarise the complaint, but a person decides and can explain why. Put that in a one-page AI use policy. The DPC's guidance on Data Protection Impact Assessments tells you when the higher-risk uses need a DPIA before you start.

What should you put in your privacy policy?

Add a short section. In plain words:

• You use an AI language model provider (Anthropic) to help draft documents, summarise correspondence and support customer service.
• What categories of personal data may be processed this way (for example, name, contact details, correspondence content).
• Your lawful basis, usually legitimate interests or contract.
• That the provider acts as your processor under a Data Processing Addendum, does not use your data to train its models, and transfers are covered by Standard Contractual Clauses.
• Retention: how long data stays in the tool.
• That decisions affecting individuals are reviewed by a person.

Add the same processor to your Article 30 record of processing activities. That is a spreadsheet, not a project.

What should you ask any AI vendor?

Whether it is Claude, ChatGPT, Copilot or a niche tool, ask these before you sign:

1. Do you train on my inputs or outputs? Where is that written?
2. Do you offer a DPA, and which contracting entity signs it for Irish customers?
3. What transfer mechanism covers data leaving the EEA?
4. Where is my data stored, and can I choose an EU region?
5. What is your retention period, and can I delete data on demand?
6. Who are your sub-processors, and how are changes notified?
7. What security certifications and audits do you hold?
8. What admin controls do I get for staff access and offboarding?

A vendor that answers these in writing is one you can put in your privacy policy with a straight face. For the budget side, see automation costs in Ireland.

Frequently asked questions

Is Claude GDPR compliant?

No tool is compliant on its own; compliance is about how you use it. On a business plan Anthropic gives you a Data Processing Addendum with the EU Standard Contractual Clauses, contracts with EEA customers through Anthropic Ireland, Limited, does not train on your inputs or outputs by default, and deletes customer data within 30 days of termination. Those are the building blocks. You still need a lawful basis, a privacy notice, a record of processing and internal rules. Claude Pro, the consumer plan, has no DPA and should not hold client personal data.

Does Claude have a DPA?

Yes, on the business plans. Anthropic's Commercial Terms incorporate its Data Processing Addendum by reference, so accepting the business terms for Claude Team, Enterprise or the API puts the DPA in place. There is nothing to negotiate. Consumer Free, Pro and Max accounts are under the Consumer Terms and get no DPA. Keep a PDF of the version you accepted, with the date.

Where is Claude data stored — is there EU residency?

Anthropic covers transfers with the EU Standard Contractual Clauses, but that is a safeguard, not residency. As checked in August 2026, claude.ai and the Anthropic API do not offer EU-only storage. True EU data residency comes from running the Claude models through AWS Bedrock in an EU region, such as Ireland (eu-west-1), Frankfurt or Paris. There your contract is with AWS and you choose the region.

Does Claude train on my business data?

Not by default on the business plans. Anthropic states it will not use inputs or outputs from its commercial products, such as Claude for Work and the API, to train its models. The exception is data you choose to send through the feedback buttons, and an admin on Team or Enterprise can switch that feature off. Consumer Free, Pro and Max plans work differently: training is a user setting and chats used for training may be kept for up to five years. Checked August 2026.

Can an Irish accountant or solicitor use Claude with client data?

Yes, with the right setup. Use Claude Team or Enterprise, not a personal Pro account. Have the DPA on file, add the processor to your record of processing activities, write a short staff policy, and keep special category data, PPS numbers, bank details and privileged material out of the tool unless you have assessed the risk. Also check your professional body's rules on client confidentiality and outsourcing. A person, not the model, must make and be able to explain any decision that affects a client.

Can I put customer personal data into Claude?

Yes, on a business plan with the DPA in place, if you have a lawful basis, tell people in your privacy notice, and keep to data minimisation. Do not paste special category data such as health or financial details unless you have done a Data Protection Impact Assessment and have a clear need.