Can I Use Claude at Work? Free, Pro, Max, Team and Enterprise Compared Under the GDPR

Whether you can use Claude at work depends on the plan. Anthropic divides its plans into two groups with different terms. Free, Pro and Max are consumer plans, governed by the Consumer Terms and Anthropic's privacy policy, with Anthropic as the controller of the data. Team, Enterprise and the API are governed by the Commercial Terms and a Data Processing Addendum (DPA), with your business as the controller and Anthropic as its processor. A business plan supplies the processor terms that Article 28 requires, although it does not by itself make a particular use lawful, which also depends on the purpose, the personal data involved and the safeguards you put in place.

Anthropic's consumer terms for the UK and the EEA prohibit business use, so a business should not approve personal Free, Pro or Max accounts for work. This guide sets out what Anthropic's own documents say about each plan: the terms on business use, training, retention, the contract and contracting entity, data residency, administrative controls, certifications and international transfers. All quotations were taken from Anthropic's pages on 27 October 2026, and where a page shows its own date, that date is given.

Get articles like this. Compliance Engineering, practical AI compliance for founders and the people who sign off AI tools, by a CIPP/E certified practitioner.

Need your own position checked? A £500 scoping review covers which Claude plans your staff actually use, your DPA and transfer position, retention settings, and what your records and DPIA need to say, with a written report within one week.

The plans compared

	Free, Pro, Max	Team	Enterprise	API
Business use (UK and EEA terms)	Prohibited by the consumer terms (which terms govern work use is not stated)	Permitted	Permitted	Permitted
Training on your content	Unless you opt out (feedback and flagged content still used)	No (feedback can be used)	No (feedback can be used)	No (feedback can be used)
Anthropic's role	Controller	Processor	Processor	Processor
DPA	None identified	Incorporated in the Commercial Terms	Incorporated in the Commercial Terms	Incorporated in the Commercial Terms
UK and EEA contracting party	Anthropic Ireland, Limited	Anthropic Ireland, Limited	Anthropic Ireland, Limited	Anthropic Ireland, Limited
Retention (legal and safety exceptions apply to all)	Removed within 30 days of deletion, up to 5 years if training is on, flagged content up to 2 years	Until the user deletes, then up to 30 days	Indefinite unless a custom period is set (minimum 30 days)	Anthropic's published descriptions differ (see the API guide), zero data retention by approval with feature exceptions
Audit logs, SCIM, Compliance API	No	No	Yes	Not assessed in this guide
Data stored	US	US	US (US-only inference available)	US (US-only inference available)
Assurance coverage (Trust Center)	Not in scope	SOC 2 Type 2, ISO 27001, ISO 42001	SOC 2 Type 2, ISO 27001, ISO 42001, HIPAA-ready subject to configuration and a BAA	SOC 2 Type 2, ISO 27001, ISO 42001, HIPAA-ready subject to configuration and a BAA
Transfer mechanism	Adequacy where it applies, otherwise SCCs (derogations in some cases)	SCCs and UK Addendum in the DPA (onward transfer to the US not documented)	SCCs and UK Addendum in the DPA (onward transfer to the US not documented)	SCCs and UK Addendum in the DPA (onward transfer to the US not documented)

The consumer plans: Free, Pro and Max

Business use is prohibited in the UK and EEA terms

Anthropic publishes different consumer terms for different regions, all effective 8 October 2025. The UK version contains this clause:

"Non-commercial use only. You agree not to use our Services for any commercial or business purposes and we (and our Providers) have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity."

The version for the EEA and Switzerland contains the same restriction: "Non-commercial use only. You agree that you will not use our Services for any commercial or business purposes". The US consumer terms have no general clause of this kind, which explains why guidance written for US readers often does not mention it.

The UK terms state that they apply to "a consumer who is resident in the United Kingdom", meaning someone "acting wholly or mainly outside your trade, business, craft or profession". They also state that the Commercial Terms do not cover "Claude.ai or Claude Pro use for individuals or entities". Anthropic's documents do not say which terms govern a UK or EEA individual who uses Pro or Max for work regardless, and this guide does not attempt to resolve that question. Confirm the applicable terms with Anthropic before approving any personal account for work.

There is a further point for employers. Where staff have signed up with a work email address, the consumer terms state that "your Account may be linked to the organization's enterprise account with us and the organization's administrator may be able to monitor and control the Account, including having access to Materials".

Training

The consumer terms state that Anthropic may use the content of conversations to improve its services, "including training our models, unless you opt out of training through your account settings." The setting is called Help improve our AI models. Anthropic's August 2025 announcement describes the choice being presented to new users at signup and to existing users in a pop-up.

The consumer terms then qualify the opt-out: "Even if you opt out, we will use Materials for model training when: (1) you provide Feedback to us regarding any Materials, or (2) your Materials are flagged for safety review". Switching training off also does not withdraw data from training that has already taken place. Incognito chats "are not used to improve Claude, even if you have enabled Model Improvement in your Privacy Settings."

Retention

A deleted conversation is "Deleted from our back-end storage systems within 30 days". Where training is switched on, Anthropic "may retain your data in a de-identified format for up to 5 years in our model training pipelines." Feedback submissions are kept for five years. Conversations flagged by Anthropic's trust and safety systems are kept for up to two years, and the classification scores for up to seven.

The contract

The privacy policy (effective 10 September 2026) makes Anthropic the controller: "If you live in the European Economic Area (EEA), UK or Switzerland (the "European Region"), the data controller responsible for your personal data is Anthropic Ireland, Limited." The DPA is incorporated into the Commercial Terms, and no consumer-plan DPA was identified.

When an employee uses a personal Claude account to work on customer or staff data, the business therefore discloses that data to Anthropic, which processes it as a controller under its own privacy policy. Because Anthropic acts as an independent controller, no Article 28 processor contract exists for these accounts, and the disclosure to Anthropic needs its own lawful basis. Personal accounts also give the business no central retention controls or audit records.

Claude Team

Claude Team is sold for teams of 2 to 150 people. It falls under Anthropic's Commercial Terms (effective 17 June 2025), which state that "Services under these Terms are not for consumer use."

The contract and the contracting entity

The Commercial Terms incorporate the DPA: "Data submitted through the Services will be processed in accordance with the Anthropic Data Processing Addendum ("DPA"), which is incorporated into these Terms by reference." Anthropic's Privacy Center adds that "When you accept Anthropic's Commercial Terms of Service, you also accept our DPA." No separate signature is needed. The current DPA is dated 24 February 2025.

Anthropic acts as processor and "only processes the data as instructed by the customer in order to provide the Claude service." The contracting entity for European customers is Anthropic Ireland, Limited: the Commercial Terms define Anthropic as "Anthropic Ireland, Limited if Customer resides in the European Economic Area ("EEA"), Switzerland or UK, and Anthropic, PBC if Customer resides anywhere else." This differs from OpenAI, whose UK customers contract with its US company (see our ChatGPT plan comparison).

The Service Specific Terms also place a notice obligation on the customer. A business on Team or Enterprise "must inform its Users that (i) they are accessing an administered service offering that enables Customer's access to and control over data submitted to the Services by Customer and its Users". That belongs in your staff privacy notice or acceptable use policy.

Training and feedback

Anthropic states that "By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models." Feedback is the exception: "If you explicitly report feedback or bugs to us (e.g. via our thumbs up/down feedback button), or otherwise choose to allow us to use your data, then we may use your chats and coding sessions to train our models." A conversation submitted as feedback is stored, with its content, "in our secured back-end for up to 5 years."

Administrators can prevent this. Anthropic's Privacy Center states that "you can disable the ability for members of your organization to submit feedback to Anthropic via the thumbs up / down button using the Rate chats setting". If you do not want staff conversations stored for five years, switch it off.

Retention and controls

Anthropic's Trust Center states that "By default, Anthropic retains all Customer Data within the Claude for Work platform until the data is deleted by the customer. After deletion, we may retain for up to 30 days in our systems." Team has no custom retention controls, so retention depends on users deleting their own conversations. The longer periods still apply: flagged content may be kept for up to two years and its classification scores for up to seven, feedback submissions are kept for five years, and data may be retained where the law requires.

Team includes single sign-on and central administration. It does not include domain capture, role-based access, SCIM, audit logs, the Compliance API or custom retention controls, all of which start at Enterprise. The Primary Owner of a Team account can request data exports, which "may contain your conversations with Claude, uploaded files, and usage patterns."

Certification

Anthropic's Trust Center shows Claude Team in scope for SOC 2 Type 2, ISO 27001, ISO 42001 and CSA STAR. Anthropic's regional compliance page also lists ISO/IEC 27017 and 27018, but neither appears in the Trust Center's certification list or documents, so a supplier assessment should not rely on them without seeing a certificate.

Claude Enterprise

Enterprise has the same contract, contracting entity and training position as Team. The differences are in retention and control.

Retention is indefinite by default

Anthropic's Privacy Center article on retention controls (updated 27 October 2026) states: "By default, data is retained indefinitely unless a custom retention period is set." The minimum custom period is 30 days. Projects are also "retained indefinitely, so chats inside projects are not deleted by your chat retention period."

Anthropic's documentation gives further defaults. "Local session transcripts (from sessions on users' machines, in apps such as Cowork and Claude Code) are stored for 6 years by default", and "The Activity Feed retains data for 6 years." Custom retention periods "don't apply to standalone Claude Design at claude.ai/design, Claude Tag, Claude Managed Agents, or any other feature that runs Claude Code in the cloud."

Under Article 5(1)(e) of the GDPR, personal data must not be kept for longer than necessary. An Enterprise administrator should therefore set a custom retention period, decide how projects are handled, and record the retention of the features that the custom period does not cover.

Controls

Enterprise adds role-based access, SCIM, audit logs, the Compliance API, IP allowlisting and custom retention controls, and Anthropic states that "All retention-related actions and changes are automatically tracked in audit logs." The Claude interfaces themselves are not available with zero data retention: "Claude Teams and Claude Enterprise product interfaces: These interfaces are not ZDR-eligible."

US-only inference is available on usage-based Enterprise plans, billed at 1.1 times standard rates for recent models. There is no EU equivalent, and stored data is held in the US.

The Trust Center shows Enterprise in scope for SOC 2 Type 2, ISO 27001, ISO 42001, CSA STAR and HIPAA, which Anthropic describes as a "HIPAA-ready configuration (BAA available)".

Covered models

Anthropic designates some models, including the Fable and Mythos models, as covered models. "Prompts submitted to, and outputs generated by, covered models are retained for 30 days to support our safety work, on every platform where these models are offered." The Service Specific Terms state that this "supersedes any modified retention commitments (e.g., ZDR)", and the API documentation states that covered models "are not available under ZDR unless expressly authorized by Anthropic." If your contracts with clients promise shorter retention, check which models your staff can select.

The API

The API is governed by the same Commercial Terms and DPA, with the same contracting entities. Inputs and outputs are not used for training by default, zero data retention is available with Anthropic's approval for most models, and the first-party API stores data in the US, with US-only inference as the only regional option. The setup, retention and residency choices for the API are covered in our Claude API compliance guide.

Data residency

Claude.ai and Anthropic's own API have no EU or UK storage option. For Team and Enterprise, Anthropic states that "By default, we may route customer traffic to select countries in the US, Europe, Asia and Australia, unless otherwise agreed upon or at your instructions." It adds: "Note that data is stored in the US."

Anthropic's regional compliance page names Amazon Bedrock and Google Cloud Vertex AI as the routes where "both data storage and model processing remain within your specified geographic region", with Microsoft Foundry listed as coming soon for Europe. On those platforms the cloud provider's terms apply. For covered models used through a cloud platform, however, the Service Specific Terms provide that "Anthropic will process such data on Customer's behalf in accordance with the Anthropic Data Processing Agreement", so both contracts need to be recorded.

International transfers

Every Claude plan involves a transfer of personal data outside the UK and the EEA, because data is stored in the US.

Anthropic is not on the EU-US Data Privacy Framework. A search of the Framework's participant register on 27 October 2026 found no Anthropic entity, either active or inactive, and none of the Anthropic documents reviewed for this guide refers to the Framework. For the business plans, the DPA incorporates the Standard Contractual Clauses (Module Two, controller to processor, and Module Three, processor to processor), which "will be deemed to have been executed by the parties", with Irish law governing the Clauses. A UK Addendum applies "to any processing of Customer Personal Data that is subject to the UK GDPR". The consumer plans rely on the Clauses as well, according to the privacy policy.

Before approving Claude, confirm and document the transfer mechanism, including the onward transfer discussed below, and complete the required transfer assessment. The record of processing should name the Standard Contractual Clauses, with the UK Addendum for UK data. The ICO's guidance, updated on 15 January 2026, explains that following the Data (Use and Access) Act 2025, a transfer risk assessment "is now referred to in UK legislation as a 'data protection test'". Under the EU GDPR the equivalent is usually called a transfer impact assessment. Anthropic commits in the DPA to provide, on request, "information to Customer which is reasonably necessary for Customer to complete a transfer impact assessment". Because the contracting party for UK and EEA customers is Anthropic Ireland, Limited, it is reasonable to ask Anthropic which mechanism covers the onward transfer to Anthropic, PBC in the US, which the published documents do not set out.

What a business should do

Identify which Claude accounts your staff use and what personal data they enter. Anthropic's UK and EEA consumer terms prohibit business use, and a personal account leaves the business without a processor contract. Confirm the applicable terms before approving any personal account for work.

Where staff need Claude for work involving personal data, provide a Team or Enterprise workspace and prohibit personal accounts for that work. Record Anthropic Ireland, Limited as your processor if you are in the UK or the EEA, and keep a copy of the Commercial Terms and the DPA as accepted.

On Team, switch off the Rate chats setting if you do not want conversations stored for five years, and give staff a rule on deleting conversations, because Team has no retention controls. On Enterprise, set a custom retention period and decide how projects and long-retained features are handled. In either case, update your staff privacy notice to tell users they are on an administered service.

Confirm and document the transfer mechanism, including the onward transfer to the US, and complete the transfer risk assessment (the data protection test) before approval. If the use involves special category data, monitoring of staff or decisions about individuals, assess whether a data protection impact assessment is required before the processing begins. Anthropic's DPA lists the special categories of personal data processed as "None", so confirm the contractual position and identify an Article 9 condition before staff submit health or other special category data.

For firms handling client files, our guide on using Claude or ChatGPT on client files covers confidentiality, lawful basis and the documents to prepare.

Checked on 27 October 2026 against Anthropic's Consumer Terms of Service for the UK and for the EEA and Switzerland (effective 8 October 2025), Commercial Terms of Service (effective 17 June 2025), Service Specific Terms (effective 31 August 2026), Privacy Policy (effective 10 September 2026), Data Processing Addendum (effective 24 February 2025), the August 2025 announcement on consumer terms, the pricing and regional compliance pages, the Trust Center, the API documentation on retention and data residency, Anthropic Privacy Center articles, and the Data Privacy Framework participant register.