Anthropic: DPA, subprocessors and data location
Where to find the Anthropic DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: llm api (claude). The table is the short version; the sections below add detail.
Anthropic at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | Not stated in the source we checked (2026-10-17). Details on subprocessors |
| Objection window and remedy | Window: 15 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Anthropic
The DPA is part of Anthropic's Commercial Terms, so it covers commercial products such as the Claude API. The help center article is scoped to commercial products and points consumer plans to a different article.
Notice of a new subprocessor is "reasonable notice" with no day count. You have 15 days from that notice to object in writing, or you are deemed to consent (section C.3). The clause names no termination right; it says only that the parties work in good faith toward a resolution.
The DPA states no data location. Anthropic's docs say workspace data at rest is in the US, currently the only option, and that inference runs in any available geography unless you set inference_geo to "us". The DPA names the SCCs plus UK and Swiss addenda and does not mention the DPF.
Anthropic DPA: where to find it and how it is accepted
Read the DPA on www.anthropic.com. Incorporated into the Commercial Terms of Service; accepting those terms also accepts the DPA, with no separate signature step (help center article, March 16, 2026).
Source: privacy.claude.com, checked 2026-10-16Plans covered: Commercial products (for example Claude API and Claude for Work)
The help article is scoped to commercial products and points consumer plans to a different article. The DPA text itself says it forms part of the Commercial Terms or another agreement that references it.
Source: privacy.claude.com, checked 2026-10-16Anthropic subprocessors: the list and how change notices reach you
Anthropic's subprocessor list.
Source: www.anthropic.com, checked 2026-10-17How changes are announced: Reasonable notice of a new subprocessor before it gets access to personal data (DPA section C.3).
Source: www.anthropic.com, checked 2026-10-17Not stated in the source we checked (2026-10-17).
Section C.3: "reasonable notice" before a new subprocessor gets access to personal data. No number of days is stated.
Source: www.anthropic.com, checked 2026-10-17You can object within 15 days. The parties work together in good faith to find a mutually acceptable resolution (section C.3). The clause names no termination right.
Section C.3(b): on the basis of reasonable data privacy or data security concerns, written objection "within fifteen (15) days of the date of such notice, or Customer is deemed to consent".
Source: www.anthropic.com, checked 2026-10-17Source: www.anthropic.com, checked 2026-10-17Where Anthropic stores data
- United States (workspace data at rest; currently the only workspace geo)
- Inference: global by default, or US-only with inference_geo
You can choose the region.
The DPA itself states no data location. Anthropic's data residency docs say workspace geo, set when a workspace is created, currently only offers "us", and that inference runs in any available geography unless you set inference_geo to "us". The inference_geo parameter is supported on Claude 4.6 and later models.
Source: platform.claude.com, checked 2026-10-16How Anthropic moves data outside the EU and UK
- SCCs (Modules 2 and 3)
- UK Addendum
- Swiss Addendum
Section I and Schedule 3. SCCs are governed by Irish law. The DPA does not mention the EU-U.S. Data Privacy Framework.
Source: www.anthropic.com, checked 2026-10-16Not stated in the source we checked (2026-10-17).
A search of the Data Privacy Framework participant list on 2026-10-17 returned no organisation under this name. That can also mean a different legal name, so we record no value; check the list yourself. The DPA does not mention the DPF either.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Anthropic a processor or a controller?
Processor: it handles your customers' data on your instructions.
Section B.1: you are the controller and Anthropic is your processor for Customer Personal Data.
Source: www.anthropic.com, checked 2026-10-16Is Anthropic GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Anthropic's own documents say:
- A DPA is published: Incorporated into the Commercial Terms of Service; accepting those terms also accepts the DPA, with no separate signature step (help center article, March 16, 2026).
- A subprocessor list is published.
- Transfer mechanisms named: SCCs (Modules 2 and 3), UK Addendum, Swiss Addendum.
- Data locations named: United States (workspace data at rest; currently the only workspace geo), Inference: global by default, or US-only with inference_geo.
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Anthropic to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Anthropic, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Anthropic | LLM API (Claude) | United States (workspace data at rest; currently the only workspace geo); Inference: global by default, or US-only with inference_geo | SCCs (Modules 2 and 3); UK Addendum; Swiss Addendum | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Anthropic | LLM API (Claude) | United States (workspace data at rest; currently the only workspace geo); Inference: global by default, or US-only with inference_geo | SCCs (Modules 2 and 3); UK Addendum; Swiss Addendum | [DPA](https://www.anthropic.com/legal/data-processing-addendum) | [Subprocessors](https://www.anthropic.com/subprocessors) |
If you add or replace Anthropic: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
In the source we checked, Anthropic doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked section C.3 and Schedule 4 against the raw DPA text: reasonable notice before the subprocessor gets access, 15 days from the date of the notice to object (silence is deemed consent), good-faith resolution and no termination right all confirmed. Added the objection ground (reasonable data privacy or data security concerns). The subprocessor list (anthropic.com/subprocessors redirects to trust.anthropic.com) is a script-rendered Trust Center page and could not be read automatically, so no count is recorded.
- Searched the Data Privacy Framework list for "Anthropic" (active and inactive): no organisation found. dpf_listed set to false.
- First check: facts recorded from Anthropic's own DPA (effective February 24, 2025), help center and data residency docs.
Related vendors
Sources and method
- https://www.anthropic.com/legal/data-processing-addendum checked 2026-10-16
- https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa checked 2026-10-16
- https://platform.claude.com/docs/en/manage-claude/data-residency checked 2026-10-16
- https://www.dataprivacyframework.gov/list checked 2026-10-17
Facts come from Anthropic's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: www.anthropic.com.