GDPR-Compliant LLM APIs: OpenAI vs Anthropic vs Google (2026)

Any organisation that builds on an LLM API and processes personal data needs to decide which provider it can use in compliance with the GDPR. OpenAI, Anthropic and Google can all be configured to comply. They differ in their defaults, in the controls each offers and in how much configuration and documentation each leaves to the customer.

This page compares the three deep-dive guides: the ChatGPT / OpenAI API, the Claude API and the Gemini API.

Tier and configuration matter more than the provider

Most of the GDPR risk in an LLM API turns on two questions: whether the provider uses your data for training, and whether you can obtain an Article 28 contract together with the residency and retention controls your processing requires. On paid API tiers, all three providers give a defensible answer to the first question. The differences lie in the second, and in the unpaid and consumer tiers.

Google illustrates the point most clearly. Its unpaid Gemini tier uses prompts and responses to improve Google's products, with possible human review, while its paid Developer API and Vertex AI do not. For users in the EEA, Switzerland and the UK, however, the paid-tier data terms apply to all of Google's Gemini API services, and Google requires applications offered to those users to use Paid Services only. OpenAI and Anthropic do not use API data for training by default.

Side by side (checked 4 October 2026)

	OpenAI (API)	Anthropic (Claude API)	Google (Gemini)
Training on API data by default	No (since 1 March 2023, unless you opt in)	No	No on the paid Developer API and Vertex AI; yes on the unpaid tier outside the EEA, Switzerland and the UK
Processing agreement	DPA incorporated into the Services Agreement	DPA incorporated into the Commercial Terms	Google's Data Processing Addendum (paid Developer API); Cloud Data Processing Addendum (Vertex AI)
EU data residency	eu.api.openai.com for eligible customers, subject to approval and a Modified Retention amendment; UK endpoint stores data in the UK but does not process it there	None on Anthropic's own API (global by default, US-only on request); some models in-Region on Amazon Bedrock	Vertex AI EU multi-region, excluding grounding and RAG Engine, and excluding the UK; none on the paid Developer API
Default retention	Abuse-monitoring logs up to 30 days	Described differently in the Privacy Center and the developer documentation (see the Claude guide); covered models at least 30 days	55 days for abuse monitoring on the paid Developer API; flagged prompts up to 90 days on Vertex AI unless an exception applies
Zero data retention	Subject to approval by OpenAI	Subject to approval by Anthropic; not available for covered models or several features	Vertex AI only, subject to conditions
Transfer mechanism	EEA and Swiss data: OpenAI Ireland's onward transfers under SCC agreements or an adequacy decision. UK data: SCCs with the UK Addendum. No DPF entry	SCCs with UK and Swiss addenda. No DPF entry	DPF certification (EU-US, UK Extension, Swiss-US), with SCCs as fallback
EU AI Act role	GPAI model provider; you are usually the provider and deployer of the system you build on it	GPAI model provider; you are usually the provider and deployer of the system you build on it	GPAI model provider; you are usually the provider and deployer of the system you build on it

The table summarises the position. The configuration detail for each provider is in the deep-dive guides linked above.

Which AI APIs do not use your data for training

On their paid API tiers, none of the three providers uses your prompts and responses to train its models. OpenAI states that API data has not been used for training since 1 March 2023 unless the customer opts in, and its Services Agreement contains the same commitment. Anthropic's Commercial Terms state that it may not train models on customer content, although data submitted under its Development Partner Program, or feedback a user chooses to send, may be used. Google commits not to use paid-tier Gemini API data to improve its products, and its Vertex AI terms state that it will not use customer data to train or fine-tune AI models without permission.

A setup in which your data is not used for training is therefore available from all three providers. The practical rule is to use a paid API tier, confirm the commitment in the contractual terms, and keep personal data out of unpaid and consumer tiers.

Keeping data in the EU

Data residency is the area in which the three providers differ most, and it is often the control that a UK or EU controller, or its clients, require.

• Google (Vertex AI). Where you configure the EU multi-region, Google commits to store data at rest and perform machine learning processing only in that multi-region. Grounding with Google Search, Web Grounding for Enterprise, Grounding with Google Maps and RAG Engine are excluded, the global endpoint carries no residency guarantee, and the EU multi-region does not include the UK or Switzerland. The paid Developer API offers no residency option.
• OpenAI. Eligible customers can use EU data residency through eu.api.openai.com, which provides storage and processing in the region. It requires approval through OpenAI's sales team, approval for abuse-monitoring controls and a Modified Retention amendment, and carries a 10% price uplift for eligible models released on or after 5 March 2026. The UK endpoint stores data in the UK but does not process it there, and system data is outside the residency commitment.
• Anthropic. Anthropic's own API offers no EU processing option: inference may run in any available geography by default, customers can require US-only inference at 1.1 times the standard price, and data at rest is stored in the US. European processing of Claude requires a cloud platform. On Amazon Bedrock, Claude Opus 5 and Sonnet 5 can run in-Region in Ireland and Stockholm, and Sonnet 5 also in London, while Claude Fable 5, Fable 5.1 and Mythos 5.1 are available in the EU Regions only through global routing.

With each provider, residency is a setting that must be configured and then confirmed in your own integration.

The data processing agreement and what it does not cover

All three providers offer an Article 28 data processing agreement, but the transfer mechanisms underneath differ. Check each provider on the Data Privacy Framework register by legal entity name rather than relying on a summary: Google LLC holds active certifications under the EU-US Framework, the UK Extension and the Swiss-US Framework, while OpenAI and Anthropic have no entry.

Anthropic's DPA incorporates the Standard Contractual Clauses with the UK and Swiss addenda, and for customers in the EEA, Switzerland or the UK the contracting entity is Anthropic Ireland, Limited. OpenAI's DPA distinguishes between EEA and Swiss data, which OpenAI Ireland Limited processes and transfers onward under agreements containing the Standard Contractual Clauses or an adequacy decision, and UK data, which OpenAI OpCo, LLC processes under the clauses as amended by the UK Addendum. Google applies its Data Processing Addendum to the paid Gemini Developer API and the Cloud Data Processing Addendum to Vertex AI, and both rely on its Data Privacy Framework certification with the clauses as a fallback. The eight DPA clauses to check are the same for all three, and CompanyScope's vendor profiles set them out side by side.

The data processing agreement covers the provider's obligations. You remain the controller, and your obligations are the same whichever provider you choose:

• a DPIA before the system goes live;
• data minimisation built into prompt construction, so that only the data the model needs is sent;
• a privacy notice that names the AI processor and where data is processed;
• a lawful basis, usually legitimate interests or contract;
• an automated decision-making assessment, because where an output is used to make a significant decision about a person by solely automated means, the safeguards in Articles 22A to 22D apply;
• the transfer recorded in your records of processing.

These documents, as templates. The £49 AI API GDPR Compliance Pack contains editable Word templates for the DPIA, the privacy notice wording, the legitimate interests assessment, the automated decision-making assessment, the transfer assessment and the records of processing entries. It also contains a contract review checklist comparing OpenAI, Anthropic, the Gemini Developer API and Vertex AI on fourteen points as published on 4 October 2026.

Mistral and self-hosted models

Two options outside the three major providers are also suitable for GDPR work.

Mistral is an EU company, which removes the international transfer question for many European controllers, and it offers a data processing agreement. Where residency is the main concern and the model is adequate for the task, it is worth considering.

Self-hosted open models, such as Llama and Mistral's open-weight models, keep data on your own infrastructure. There is no external processor, so there is no third-party data processing agreement or transfer to manage. You take on the work of running and securing the infrastructure, and the DPIA and AI Act classification still apply to the processing.

Choosing a provider

• A straightforward configuration: OpenAI or Anthropic on a paid API tier, which do not use API data for training by default and incorporate a data processing addendum, with zero data retention requested where the data warrants it.
• Residency in the EU: Google's Vertex AI with the EU multi-region, or OpenAI's EU data residency for eligible customers, or Claude on Amazon Bedrock with a model that runs in-Region, each subject to the conditions above.
• Fewer or no international transfers: Mistral for many European controllers, or a self-hosted model, where model capability allows.

In every case the controller obligations above are the same. The provider choice affects how much configuration is required, not what must be documented.

Summary

No single LLM API is the most GDPR compliant in every case. Compliance depends on using the right tier with the right configuration and completing the controller work on top. OpenAI and Anthropic require the least configuration to avoid training on your data. Google offers contractual EU residency on Vertex AI, subject to exclusions, but its unpaid tier is unsuitable for personal data outside the EEA, Switzerland and the UK. Mistral simplifies the transfer question for many European controllers, and self-hosted models avoid it. Choose on capability and residency, configure the training and retention settings, confirm the data processing agreement, and complete your own DPIA, minimisation, privacy notice and transfer record.

---

Michael K. Onyekwere is a CIPP/E certified data protection professional at Janus Compliance. For a review of your provider setup, transfers, retention and DPIA, start with a £500 scoping review.

OpenAI, Anthropic and Google provider terms, residency, retention and training positions, and the Data Privacy Framework register, were checked on 4 October 2026. This page is general information, not legal advice. Provider terms change, so check each provider's current data processing terms, training policy, retention, residency options and certifications before relying on them. Deep-dives: ChatGPT / OpenAI API, Claude API, Gemini API. See also: AI vendor due diligence.