AI models
GDPR Anthropic
In an indie stack, Anthropic is used for Model inference via the API. Entity cited: Anthropic PBC; Anthropic Ireland, Limited is the controller of personal data in the consumer policy for the EEA, the United Kingdom and Switzerland. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Anthropic
Yes. Public DPA, incorporated into the commercial terms with standard contractual clauses.
Stated role
For commercial Customer Personal Data, the customer is controller and Anthropic is processor. For the consumer policy, Anthropic Ireland, Limited is controller in the EEA, the United Kingdom, or Switzerland, and Anthropic PBC is controller elsewhere.
Personal data
Name, email, phone, indirect identifiers, payment, Inputs and Outputs submitted to the services, feedback, study data, exchanges, cookies. On the commercial DPA side, the categories of Customer Personal Data are determined by the customer.
Sub-processors of Anthropic
Public list.
Transfers outside the EU
Hosting / location
Commercial support states that customer data is stored in the United States. By default, traffic may be routed to certain countries in the United States, Europe, Asia, and Australia. The consumer policy also indicates a transfer, use, processing, and storage in the United States and in other countries.
EU–United States Data Privacy Framework
Official search for “Anthropic” and “Anthropic PBC”: no participant. Not registered.
Cookies
Anthropic and its providers use cookies, scripts, or similar technologies to manage the services, recognize users, personalize, market, and analyze usage.
Typical use, written by StackLégal and not by the vendor: Model inference via the API.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Anthropic a processor within the meaning of the GDPR?
For commercial Customer Personal Data, the customer is controller and Anthropic is processor. For the consumer policy, Anthropic Ireland, Limited is controller in the EEA, the United Kingdom, or Switzerland, and Anthropic PBC is controller elsewhere.
What DPA does Anthropic publish?
Yes. Public DPA, incorporated into the commercial terms with standard contractual clauses. https://www.anthropic.com/legal/data-processing-addendum
Which further sub-processors does Anthropic publish?
Public list. https://www.anthropic.com/subprocessors
Where does Anthropic state that it processes data, including outside the EU?
Commercial support states that customer data is stored in the United States. By default, traffic may be routed to certain countries in the United States, Europe, Asia, and Australia. The consumer policy also indicates a transfer, use, processing, and storage in the United States and in other countries.
Is Anthropic registered under the EU–United States Data Privacy Framework?
Official search for “Anthropic” and “Anthropic PBC”: no participant. Not registered.
Which personal data does Anthropic mention?
Name, email, phone, indirect identifiers, payment, Inputs and Outputs submitted to the services, feedback, study data, exchanges, cookies. On the commercial DPA side, the categories of Customer Personal Data are determined by the customer.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.