Claude GDPR Compliance in Europe: 2026 Provider Comparison

TL;DR

For GDPR-compliant Claude use with EU data residency, choose AWS Bedrock (EU geo profile or in-region in Ireland and Stockholm) or Google Vertex AI (eu multi-region). Both cost 10% extra. The Anthropic API and Microsoft Foundry currently offer no EU processing option for Claude, only global or US routing.

What does GDPR actually require from a Claude integration?

GDPR does not forbid US model providers. It requires a processor contract under Article 28, a legal basis for every transfer outside the EEA, and documentation of what you process and why. Data residency in the EU is not mandatory by law, but it removes the transfer question and shortens your impact assessment considerably.

In practice, the data protection officer will ask four questions about any Claude project:

1. Who is the processor? The party that signs the data processing agreement with you and handles the prompts.
2. Where is the data processed and stored? Inference location and storage location can differ.
3. Is anything retained, and for how long? Including abuse monitoring logs and your own request logs.
4. Is customer data used for training? For all four routes below, the documented answer is no.

The rest of this article answers these four questions for each route, with sources. We do not give legal advice. We compare what the providers document, which is the evidence your DPO needs.

How do Bedrock, Vertex, Foundry and the Anthropic API compare?

Only Bedrock and Vertex let you keep Claude Opus 5 and Sonnet 5 inference inside the EU today. The Anthropic API routes globally or US-only, and Foundry offers Global Standard plus a US data zone, but no EU zone. Training on your data is excluded contractually on all four. The decision therefore comes down to residency, not to training.

Criterion	AWS Bedrock	Google Vertex AI	Microsoft Foundry	Anthropic API
EU processing for Opus 5 / Sonnet 5	Yes, EU geo profile (eu.anthropic...)	Yes, eu multi-region	No (Global or US Data Zone only)	No (global or us only)
Single named EU region	Yes, Ireland or Stockholm via bedrock-mantle	No for Claude 5 models	No	No
Scope of the EU option	EU regions; source London or Zurich adds those	EU member states only, UK and CH excluded	n/a	n/a
Processor for prompts	AWS	Google	Anthropic, as independent processor for Microsoft	Anthropic (Anthropic Ireland Limited in the EU)
Provider access to prompts	Anthropic has no access, per AWS	Not shared with third parties, per Google	Hosted on Azure: only metadata and flagged content go to Anthropic	Anthropic processes directly
Zero data retention	Per-region mode none, self-service	Per Google’s ZDR conditions; no abuse logging listed for Opus 5 / Sonnet 5	Via Anthropic, subscription-level	On request via Anthropic sales
EU price premium	+10%	+10%	n/a (US Data Zone is 1.1x)	n/a (US-only is 1.1x)
Feature parity with Anthropic API	Partial (no structured outputs on Sonnet 5)	Partial (structured outputs and web search yes)	High, depends on hosting option	Full

Sources: Bedrock Sonnet 5 model card, Google data residency, Foundry region availability, Anthropic data residency.

Our position: if personal data enters the prompt, start with Bedrock or Vertex in the EU. Use the Anthropic API or Foundry only when you have documented a transfer mechanism and your data is low risk, or when a feature you need exists only there. If your staff need the Claude apps rather than an API, read our Claude Enterprise vs Bedrock comparison, and if ChatGPT is still in the running, our Claude vs ChatGPT comparison for Europe.

Why can’t the Anthropic API keep data in the EU?

Because the only geography controls Anthropic offers today are “global” and “US”. The inference_geo parameter accepts exactly these two values, and workspace storage is available only in the US. There is no EU setting, so you cannot guarantee that personal data sent to the Anthropic API stays in the EEA.

The Anthropic data residency page states both limits plainly under “Current limitations”. What Anthropic does offer for European customers:

• Contracting entity. The Data Processing Addendum states that services in the EU are provided by Anthropic Ireland Limited.
• Transfer mechanism. The DPA, effective 24 February 2025, incorporates the Standard Contractual Clauses (Module Two and Module Three) under Irish law, plus the UK Addendum. It is part of the Commercial Terms automatically.
• No training. The Commercial Terms say: “Anthropic may not train models on Customer Content from Services.”
• Retention. Conversation content is not retained by default, and zero data retention is available on request per organisation, as described on the API and data retention page.

That is a workable package for internal documents without personal data, code, or pseudonymised content. It is weak for HR data, health data or customer support transcripts, because you carry the transfer risk assessment yourself. The Anthropic API also gets new features first, so some teams run it for development and a 3P cloud in the EU for production.

Is Microsoft Foundry an option for EU data residency?

Not for Claude, as of September 2026. Microsoft’s own region table lists “Not available” for a European Data Zone for every Claude model. In Europe, Claude deploys only as Global Standard from Sweden Central, and Microsoft states that global deployments may process prompts in any Azure region. That is global processing, not EU processing.

Details from Microsoft Learn and the Anthropic Foundry guide:

• Two hosting options. “Hosted on Azure” runs an Anthropic-operated service on Azure infrastructure; prompts and completions stay within Azure and only usage metadata and content flagged by safety systems egress to Anthropic. “Hosted on Anthropic” runs on Anthropic infrastructure.
• Processor chain. Anthropic acts as an independent processor for Microsoft, and customers are subject to Anthropic’s data use terms.
• Product terms. Microsoft classifies partner models not sold by Azure as Non-Microsoft Products under its Product Terms. Ask your Microsoft account team in writing which DPA governs Claude in your tenant.
• Data zone. The only data zone for Claude is the US Data Zone Standard, priced at 1.1x.

Foundry makes sense for companies whose procurement runs entirely through Azure and whose Claude use involves no personal data. For regulated EU workloads, we would not choose it today.

How do retention and zero data retention differ?

All four routes can run Opus 5 and Sonnet 5 without storing prompts, but the mechanism differs: self-service on Bedrock, Google’s documented conditions on Vertex, a request to Anthropic sales for the Anthropic API. The Fable models are the common exception. Anthropic designates Fable 5 and 5.1 as Covered Models that require 30 days of retention everywhere.

Route	How to get zero retention	Fable 5 / 5.1
AWS Bedrock	Set mode none per region, enforce with an SCP on bedrock:DataRetentionMode	Requires aws_review: up to 30 days in AWS, reviewed by AWS, not shared with Anthropic
Google Vertex AI	Follow Google’s zero data retention conditions; its 30-day abuse logging is documented for Google models and Advanced AI models, not for Opus 5 or Sonnet 5	Stored up to 30 days for abuse monitoring
Microsoft Foundry	Managed by Anthropic at subscription level	ZDR subscriptions get a 400 error for Covered Models
Anthropic API	ZDR per organisation via sales; Batch API is not ZDR-eligible (29 days)	30-day retention, ZDR only if Anthropic expressly authorises

Sources: Bedrock data retention, Anthropic API and data retention, Microsoft Learn Claude troubleshooting.

Two practical notes. Your own request logs, which Anthropic recommends keeping for 30 days on every platform, are personal data too if prompts contain it. And on Bedrock, retained data with cross-region inference is stored in the region that processed the request, so the EU profile keeps it in the EU.

What does the EU AI Act change for companies using Claude?

For most companies that use Claude through an API, the AI Act assigns the heavy obligations to Anthropic as the provider of a general-purpose AI model. Those obligations have applied since 2 August 2025. Your duties as a deployer depend on the use case, and the high-risk deadlines were pushed back by the AI Omnibus in July 2026.

The timeline, taken from the European Commission’s AI Act page:

Date	What applies
2 February 2025	Prohibited practices and AI literacy obligations
2 August 2025	Obligations for providers of general-purpose AI models
2 August 2026	AI Act generally applicable
2 December 2027	High-risk rules for Annex III use cases (HR, credit scoring, education and others), extended from 2026
2 August 2028	High-risk rules for AI embedded in regulated products (Annex I)

The AI Omnibus that moved these dates entered into force on 27 July 2026. Anthropic, Amazon, Google and Microsoft all appear on the Commission’s list of GPAI Code of Practice signatories.

What this means for you as a deployer:

• Inventory your use cases now. A support chatbot is not high-risk. Claude screening job applicants falls under Annex III and triggers deployer obligations from December 2027.
• AI literacy. This obligation has applied since February 2025. Document the training you give staff who use Claude.
• Transparency. If users interact with Claude directly or you publish generated content, check the Article 50 transparency duties for your case.

The choice between Bedrock, Vertex, Foundry and the Anthropic API does not change your AI Act role. Residency is a GDPR question; the AI Act is about use case and risk. Our EU AI Act guide for LLM deployers turns this into a checklist.

How should you decide in practice?

Start from the data, not from the cloud. Classify what goes into prompts, then pick the narrowest residency option that supports your models and features. For most EU companies with personal data, that means Bedrock or Vertex in the EU, on the cloud where the data already lives. If AWS is new territory, our Amazon Bedrock guide explains what the platform covers beyond Claude. If no managed route fits, self-hosting open weights is the fallback, as our DeepSeek V4.1 Flash self-hosted guide shows.

1. Classify prompt content. No personal data: any route works. Personal data: prefer EU processing. Special categories under Article 9: EU processing plus zero retention.
2. Check model needs. Opus 5 or Sonnet 5 work in the EU on both Bedrock and Vertex. Fable 5.1 has no EU option on Bedrock and requires 30-day retention everywhere.
3. Match your cloud. Existing AWS landing zone: use our Claude on AWS Bedrock in the EU guide. Existing Google Cloud: use our Claude on Vertex AI in Europe guide.
4. Lock it down. Block global endpoints by policy (SCP on Bedrock, constraints/gcp.restrictEndpointUsage on Google Cloud), set retention, and document the setup in your records of processing.
5. Review quarterly. Model availability, retirement dates and data zones change several times a year.

FAQ

Each answer stands alone and reflects provider documentation read on 18 September 2026. This is a technical comparison by our editorial team, not legal advice. Before you sign, confirm the current terms with your provider and your data protection officer, because EU options for Claude change frequently.

Is Claude GDPR compliant?

Claude can be used in a GDPR-compliant way, but compliance depends on your setup, not on the model. You need a processor agreement, a lawful basis and, for transfers outside the EEA, a transfer mechanism. The simplest route is Claude on Bedrock or Vertex AI with EU processing, which avoids third-country transfers for inference.

Does the Anthropic API offer EU data residency?

No. As of September 2026, the inference_geo parameter accepts only global and us, and workspace storage is available only in the US. Anthropic Ireland Limited is the EU contracting entity and the DPA includes Standard Contractual Clauses, but processing is not guaranteed to happen in the EU.

What does EU data residency for Claude cost?

On both Bedrock and Vertex AI, EU processing costs 10% more than the global endpoint. Sonnet 5 rises from 2 USD to 2.20 USD per million input tokens and from 10 USD to 11 USD per million output tokens. For a typical mid-size workload, that is a few dollars a month, not a budget decision. Seat prices for the Claude apps are in our Claude pricing plans overview.

Bedrock vs. Vertex AI: which is better for GDPR?

Vertex AI’s eu endpoint has the tighter geographic scope because it covers only EU member states, excluding the UK and Switzerland. Bedrock offers more control if you must name a single region, with in-region Opus 5 and Sonnet 5 in Ireland and Stockholm. Both exclude training and let you avoid prompt storage.

Is my data used to train Claude?

Not on any of the four routes. Anthropic’s Commercial Terms prohibit training on customer content, Google’s training restriction covers partner models, and AWS documents that Anthropic has no access to Bedrock prompts at all. Consumer Claude apps have separate terms, which this comparison does not cover. Our Claude data privacy guide covers them plan by plan.

Do I need to worry about the AI Act if I only call the Claude API?

Usually less than you think. Obligations for general-purpose AI models fall on Anthropic as the provider and have applied since August 2025. As a deployer, you must ensure AI literacy and check transparency duties. High-risk obligations apply only to specific use cases, and the Annex III deadline is now 2 December 2027.

Sources

1. Anthropic docs: Data residency (18 September 2026)
2. Anthropic docs: API and data retention (18 September 2026)
3. Anthropic Data Processing Addendum (18 September 2026)
4. Anthropic Commercial Terms of Service (18 September 2026)
5. Anthropic docs: Claude in Microsoft Foundry (18 September 2026)
6. Microsoft Learn: Foundry Models from partners and community (18 September 2026)
7. AWS Bedrock docs: Claude Sonnet 5 model card (18 September 2026)
8. AWS Bedrock docs: Data retention (18 September 2026)
9. Google Cloud docs: Data residency (18 September 2026)
10. European Commission: AI Act regulatory framework (18 September 2026)
11. European Commission: GPAI Code of Practice signatories (18 September 2026)