Short answer: Neither Claude nor ChatGPT is GDPR-compliant or non-compliant on its own. Three things decide it: whether personal data goes into the tool, which version is used (a personal account or a company-managed business account), and whether the company has written rules for that use. If no personal data goes in, GDPR generally does not apply. Once it does, your company is the controller. You then need a data processing agreement with the provider, and the rules on transfers outside the EU apply.
This article refers to the text of the GDPR (Regulation (EU) 2016/679) and the EU AI Act. It is for information only and is not legal advice. Review your own situation with your data protection officer or legal counsel.
When Does GDPR Apply?
GDPR covers personal data: any information relating to an identified or identifiable natural person1. Two everyday examples show the line:
- An employee asks an AI tool to "make this email more formal". The text contains no names and no customer details. No personal data is processed.
- An employee pastes a customer's name, phone number and complaint history and asks "write a reply". Personal data is processed, and GDPR applies.
The first usually stays outside GDPR. The second does not.
There is one more point that is easy to miss: the output counts too. If you ask a general question and the answer contains information about a real, identifiable person, that output is personal data as well.
Who Is Responsible: the Employee or the Company?
Under GDPR, the controller is whoever decides the purposes and means of processing2. When an employee uses an AI tool for work, the work is the company's: the company decides why the data is used and what happens with the result. So the company is the controller, not the employee.
The AI provider then processes personal data on the company's behalf. That makes it a processor, and GDPR requires a written contract between controller and processor, usually called a data processing agreement (DPA)3.
This is where personal accounts become a real problem. When an employee uses their own free or paid account, the company has no DPA with the provider. The provider works under its consumer terms with the employee, not under a contract with the company. "Our employees use their own accounts, it's not our concern" does not hold. Use the company doesn't know about is risk the company doesn't manage.
Data Leaves the EU
Anthropic (Claude) and OpenAI (ChatGPT) are US companies. If personal data from the EU is transferred outside the EU or EEA, the GDPR rules on international transfers apply4. In short, a transfer needs one of these, in this order:
- An adequacy decision by the European Commission for the destination. For the US, the EU-U.S. Data Privacy Framework (2023) covers companies that have certified under it,
- Without that, appropriate safeguards, most commonly the Commission's Standard Contractual Clauses (SCCs),
- Without either, only narrow derogations for occasional, non-repetitive transfers.
An employee pasting customer data into an AI tool every day is not an occasional transfer. For business use, both providers offer a DPA that includes SCCs5. Personal accounts do not give your company this contract. Whether you also want processing to stay in a specific region is a separate decision; we cover it in our article on when local AI makes sense.
A Personal Account Is Not the Same as a Business Version
"We use AI" can describe very different situations. With both providers, there is a clear difference between personal accounts and company-managed business versions:
| Personal accounts | Business versions | |
|---|---|---|
| Claude (Anthropic) | Free, Pro, Max: the user chooses in their own settings whether chats are used for model training. No DPA with your company. | Team, Enterprise and API: inputs and outputs are not used for model training by default. DPA with SCCs. |
| ChatGPT (OpenAI) | Free, Plus: content may be used to improve models by default; the user can turn this off in Data Controls. No DPA with your company. | Business, Enterprise and API: data is not used for model training by default. DPA with SCCs. |
Sources: Anthropic's model training and data use page, OpenAI's enterprise privacy commitment, and both providers' DPAs5. Providers update these terms from time to time; check the current version before you decide.
The key difference: with a personal account, the setting is up to each employee, and the company has no contract. With a business version, the company manages the accounts, has a DPA, and can see centrally who uses the tool and which settings are on.
A business version does not answer every GDPR question on its own. But it gives the company a setup it can control. We will compare the business versions of both providers in a separate article.
Transparency note: Dtech Bilişim is an Anthropic Registered Partner.
GDPR Is Not the Only Question: Customer Contracts and Trade Secrets
GDPR only protects personal data. But much of what companies put into AI tools is not personal data: quote prices, cost tables, product drawings, correspondence with customers.
For these, ask two separate questions:
- Customer contracts: Many contracts and non-disclosure agreements (NDAs) say "information may not be shared with third parties". Uploading a customer's technical drawing to an AI service may break this clause, even if it is fine under GDPR.
- Information security certifications: If you hold a certification such as ISO 27001, every external service you use is within the scope of your information security management system. Unrecorded AI use can turn into a finding at your next audit.
So "Is it GDPR-compliant?" is only part of a bigger question: "Are we allowed to give this information to this service?" How to tell whether a "data must not leave" rule comes from law, a contract or internal preference is covered in our article on where to start with AI.
5 Steps You Can Take Today
1. See your current use. Which team uses which AI tool, with which account? Without this inventory, every other step is guesswork. To see where you stand today across six dimensions, you can use our AI Readiness Assessment (16 questions, about 4 minutes).
2. Put the personal data rule in writing. Don't put names, contact details, ID numbers or information about third parties into AI tools unless the use is approved and covered by a DPA. Where possible, use general descriptions instead of names, dates and locations.
3. Move to business accounts. Instead of employees working with personal accounts, use a company-managed version with a DPA in place. Settings and access are then controlled centrally.
4. Write a usage policy. Which tool can be used, with which data, for which work? A policy gives employees clarity and is evidence of the measures you have taken, for both GDPR and ISO 27001.
5. Train your employees. Since 2 February 2025, the EU AI Act requires organisations that use AI systems to take measures to ensure a sufficient level of AI literacy among their staff6. An employee who doesn't know the rule will break it without noticing.
If You Need to Work With Personal Data
In some work, avoiding personal data is not possible: classifying customer requests, HR processes, after-sales support. Here you have more options: masking personal data before it reaches the AI, setting up solutions where data stays inside the company (when does local AI make sense?), or making sure the AI can only reach data the person asking can already see. We explain the last one, with the example of an employee who can't open the cost screen in the ERP but gets the number by asking the AI, in our article on AI access limits.
Which option is right depends on the work itself. To answer that, you first need to know where AI actually pays off. Our AI Discovery service starts with exactly this question: together, we find which process AI creates value in, without your company data leaving your control.
Sources
Numbers match the markers in the text. Provider terms change often; information as of October 2026.
- GDPR, Article 4(1): "personal data" means any information relating to an identified or identifiable natural person. ↩
- GDPR, Article 4(7): the "controller" is the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data. ↩
- GDPR, Article 28(3): processing by a processor must be governed by a contract or other legal act that sets out, among other things, the subject matter, duration, nature and purpose of the processing, and requires the processor to act only on the controller's documented instructions. ↩
- GDPR, Chapter V (Articles 44–49): transfers on the basis of an adequacy decision (Article 45), subject to appropriate safeguards such as standard data protection clauses (Article 46), or under derogations for specific situations (Article 49). The European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework on 10 July 2023; it covers US companies that have certified under the framework. ↩
- Anthropic, Data Processing Addendum: part of Anthropic's Commercial Terms and includes the EU Standard Contractual Clauses. OpenAI offers a Data Processing Addendum with Standard Contractual Clauses for its business products; check that it is in place for your account. ↩ ↩
- EU AI Act (Regulation (EU) 2024/1689), Article 4: providers and deployers of AI systems shall take measures to ensure, to their best extent, a sufficient level of AI literacy of their staff and other persons dealing with AI systems on their behalf. Applies from 2 February 2025. ↩
🗓️Let's map your personalised roadmap in a free 30-minute strategy call.
Book a Free Call🧭Let's find where AI pays off in your business — without your data leaving your control.
Talk to Us About AI DiscoveryFound this useful? Share it with your team.