Claude Code Data Privacy: GDPR, DPA & No Training Policy

Short answer

Yes, Claude Code can be used in a GDPR-compliant way for German companies, but only on a commercial deployment path with documented controls. The key questions are repository contents, the 30-day retention window, local transcript caching, and whether Team is enough or Enterprise, Bedrock, Vertex, or ZDR is required.

• Commercial Claude Code sessions are retained for 30 days by default, and local clients cache transcripts for 30 days unless configured otherwise.
• Claude Team may be enough for lower-risk work, but Enterprise or a cloud-provider path is safer for sensitive repositories and audit needs.
• If repositories contain personal data, customer secrets, or employee-monitoring implications, legal and engineering need a documented rollout review.

Claude Code can be GDPR-compliant for German companies, but it is not a blanket yes. The 2026 answer is narrower and more operational: use a commercial deployment path, document the processor contract, decide what repository data may be exposed in prompts, review the default 30-day retention window, and account for the fact that the local client caches session transcripts on the developer machine by default. If your teams need stricter retention, auditability, or region controls, Claude Enterprise, AWS Bedrock, Google Vertex AI, or a qualified Zero Data Retention (ZDR) setup is usually the better fit.

This page provides general legal information, not legal advice for a specific deployment. For the contract layer, start with our Anthropic DPA. For the broader vendor review, see Claude GDPR compliance, Claude Team GDPR, Claude Enterprise, our Claude ZDR guide, and our GDPR AI procurement guide.

Is Claude Code GDPR Compliant in 2026?

Yes, conditionally. Claude Code is not a separate legal category. The compliance answer depends on which commercial path you use and what data your repositories actually contain.

For most German companies, the practical split looks like this:

• Consumer Claude accounts are the wrong baseline for business repository work involving personal data.
• Commercial Claude Code usage can sit on a defensible GDPR path, because Anthropic treats Team, Enterprise, and API usage under its commercial framework rather than the consumer one.
• The real risk is repository content, not the CLI itself. If source code contains employee data, customer records, production credentials, access tokens, or confidential diligence material, the legal review becomes stricter immediately.
• Data minimization still applies. Even where the vendor contract is usable, your team must decide which files, prompts, logs, and tickets may be sent through the tool.

The direct answer for searchers is therefore: Claude Code is usually acceptable for lower-risk engineering workflows, but not as an ungoverned default for every repository.

Where Claude Code Creates GDPR Risk

The page lost relevance because searchers no longer want only a DPA answer. They want to know what Claude Code actually sees and where the exposure points sit.

Repository contents and prompt exposure

Claude Code runs locally, but that does not mean no data leaves the machine. The legal question is which repository material becomes part of prompts, diffs, outputs, or session state sent to the model provider.

Typical high-risk examples:

• repositories containing personal data in fixtures, logs, screenshots, tickets, or copied production samples
• engineering workspaces containing API keys, secrets, certificates, or tokens
• repositories tied to employee monitoring, internal investigations, or HR tooling
• legal or commercial repositories holding M&A, contract, or regulated-sector material

If a developer can open it in the Claude Code session, you should assume the workflow needs a documented rule on whether that material may be processed.

Retention, telemetry, and local transcripts

Anthropic’s current Claude Code documentation is materially more specific than many older GDPR explainers. For commercial users, the standard retention period is 30 days. Anthropic also documents that Claude Code clients store session transcripts locally in plaintext under the user profile for 30 days by default unless the cleanup period is changed.

That matters for two reasons:

1. Server-side retention and local caching are different risks.
2. “Not used for training” is not the same as “not stored.”

For regulated engineering teams, the local plaintext cache can matter just as much as Anthropic’s server-side retention window. Security and privacy teams should review workstation controls, endpoint encryption, and whether the cache period should be shortened.

Workspace boundaries and access scope

Anthropic states that Claude Code accesses the repository where the session is started, and that remote-control sessions still execute on the user’s machine rather than in Anthropic cloud VMs. That is useful, but it is not the same thing as zero exposure. Any prompt, output, or repository material surfaced during the session still travels through the configured model provider.

The right governance question is: what can the session read, and what does the user allow it to send?

When Team Is Enough and When You Need More

The commercial answer is no longer just “use the API.” Anthropic’s current deployment guidance explicitly places Team and Enterprise at the center for most organizations, with Bedrock, Vertex, or other provider paths used where infrastructure requirements are stricter.

Situation	Likely path
Small engineering team, lower-risk repositories, no special audit or region obligations	Claude Team can be enough
Need SSO, role controls, managed settings, or stronger enterprise governance	Claude Enterprise
Need AWS- or GCP-native region, IAM, or logging controls	Bedrock or Vertex deployment
Need the strictest retention posture for eligible workflows	Qualified ZDR setup
Repositories contain sensitive personal data, highly confidential material, or employee-surveillance implications	Individual legal review before rollout

Two cautions matter here:

• ZDR is not standard. Anthropic documents it as a qualified setup, not an automatic Enterprise feature.
• Cloud-provider deployment changes the contract stack. If Claude Code runs through Bedrock or Vertex, the legal review must include the provider’s own data-processing and logging setup, not just Anthropic’s commercial terms.

Claude Code Checklist for Legal and Engineering Teams

Before enabling Claude Code across a German development team, work through the following:

1. Choose the deployment path first. Decide whether Team, Enterprise, Anthropic API, Bedrock, or Vertex is the actual operating model.
2. Classify repository data. Mark which repositories contain personal data, customer content, secrets, incident material, or employee-related information.
3. Review retention in two layers. Document the provider-side retention window and the local Claude Code transcript cache on developer machines.
4. Set repository rules. Decide which repositories are allowed, which require approval, and which are out of scope entirely.
5. Review permissions and monitoring. For sensitive repositories, use project-specific permission settings and an auditable managed rollout path.
6. Check employment-law impact. If Claude Code is paired with systematic code review, productivity analysis, or developer monitoring, assess co-determination risk under section 87(1) no. 6 BetrVG and whether a DPIA threshold review is needed.
7. Train developers on prompt hygiene. No production dumps, no copied customer tickets with identifiers, and no secret material unless the approved deployment path explicitly permits it.

When Claude Code Is Usually Not the Right Default

Claude Code should not be treated as a frictionless default when the repository or workflow includes:

• Article 9 GDPR special-category data
• large volumes of customer communications or support records
• works council-sensitive employee monitoring implications
• strict EU-only contractual data-location commitments
• internal projects where local plaintext session caching is itself unacceptable

In those cases, the question stops being “is Claude Code compliant?” and becomes which deployment architecture, retention posture, and approval workflow are legally defensible for this repository class?

FAQ

Is Claude Code GDPR compliant?

Yes, potentially. Claude Code can be used in a GDPR-compliant way if the company deploys it on a commercial path, documents the processor setup, and controls which repository data may be exposed during sessions. It is not a one-size-fits-all approval for every engineering repository.

Does Claude Code train on my source code?

For commercial products, Anthropic states customer data is not used for model training by default. That reduces one major concern, but legal review still has to cover retention, local transcript storage, transfers, and the actual sensitivity of the repository.

Does Claude Code store repository data?

Potentially yes. Anthropic documents a standard 30-day retention period for commercial Claude Code usage, and local clients keep session transcripts in plaintext for 30 days by default unless the cleanup setting is changed.

When is Claude Team enough for Claude Code?

Team can be enough for ordinary software development on lower-risk repositories where standard retention, standard admin tooling, and non-EU-exclusive processing are acceptable. Once your requirements move toward audit exports, tighter policy control, or sensitive repository classes, Enterprise or a provider-specific deployment is usually the safer route.

When do we need Enterprise, Bedrock, Vertex, or ZDR?

Usually when you need stronger governance than a default self-serve rollout provides: stricter retention control, identity and access management, auditability, or cloud-provider-native regional controls. ZDR should be treated as a qualified exception path, not an assumed default.

Need a Repository-Level Review?

If your company wants to use Claude Code for real development work in Germany, the right review usually combines GDPR, vendor contracting, engineering guardrails, and sometimes employment law. Compound Law advises on AI procurement, DPA review, internal rollout policies, and repository-specific governance. For that broader intake process, start with our GDPR AI procurement guide or contact us.