Anthropic Claude and Swiss data protection: what to check

Can Swiss businesses use Anthropic’s Claude in compliance with data protection law?

For ordinary business data, yes, if Claude, Anthropic’s AI assistant, is accessed through Team, Enterprise or the API. Anthropic’s data processing agreement does not cover especially sensitive personal data, such as health data. For lawyers, doctors and other professionals bound to secrecy, Anthropic is not an option as of July 2026, according to the Zurich law firm VISCHER. This group needs access via a cloud provider such as Google.

In brief

• The private plans Claude Free, Pro and Max are unsuitable for enterprise use. There, Anthropic has trained on conversations and code by default since 28 August 2025, unless someone opts out.
• The promise “Zero Data Retention” means that Anthropic does not store inputs and outputs after the response. Since June 2026, it no longer holds for two Claude models, whose data is retained for 30 days. Check regularly which models the promise still covers.
• If you must keep data in Switzerland or the EU, the direct contract offers no solution. Anthropic offers no dedicated EU or Swiss region. Only access via a hyperscaler, meaning a large cloud provider such as Microsoft, AWS or Google, shifts where processing happens.
• Plan your exit before you commit. Anthropic publishes no open models that you could download and run on your own servers. Anyone who leaves Claude therefore switches to a different provider.
• Claude Code, Anthropic’s programming tool for the command line, is subject to the same contracts as Claude itself. Through Team, Enterprise or the API?APIA programming interface through which software addresses a language model directly, without a chat interface. Usually billed per token., Anthropic does not train on your code.

The Zurich law firm VISCHER (authors Lucian Hunger and Jonas Baeriswyl) regularly updates a public market overview of AI providers; the July 2026 edition gives Anthropic its own section for the first time, as the “most important new player” alongside the three established hyperscalers Microsoft, AWS and Google. Souverana is not a law firm: what follows is VISCHER’s legal assessment, quoted and put in context, along with the architecture questions that a legal review naturally does not answer.

This article is the second part of our series Provider Data-Protection Check, following the same structure as the other parts: contracts, data residency, professional secrecy?Professional and official secrecyThe criminally protected duty of confidentiality of authorities (official secrecy, Art. 320 of the Swiss Criminal Code) and a list of professions named in the law (Art. 321), such as lawyers, doctors and pharmacists. It applies independently of data protection law and reaches further. Banking secrecy sits separately in the Banking Act., ways out.

What VISCHER criticises about Anthropic

With this edition, VISCHER newly added the Anthropic models to its overview: on one side various consumer offerings, on the other the three business offerings Team, Enterprise and API. As with every other provider, the consumer offerings are not suitable for enterprise use.

The business offerings come with a data processing agreement?Data Processing Agreement (DPA)The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law. (Anthropic DPA), which regulates how Anthropic processes personal data?Personal dataAny information relating to an identified or identifiable person, so customer records, HR files or even an email address. As soon as such data is involved, the revFADP applies. on behalf of the customer. They also include a confidentiality obligation and the assurance that data is not used for training or service improvement. According to VISCHER, that makes enterprise use possible. One caveat remains the same as at OpenAI: the Anthropic DPA only covers personal data that does not qualify as especially sensitive. For especially sensitive personal data within the meaning of the revFADP?revFADP (revDSG)Switzerland's revised Federal Act on Data Protection, in force since 1 September 2023. It governs how companies may process personal data, and applies to AI use exactly as it does to any other processing., the Claude models are therefore not suitable under the publicly available DPA, even where staff are clearly instructed not to enter such data.

On an inquiry about professional secrecy, Anthropic has so far, according to VISCHER, not been willing to hold discussions.

Claude Code: the same contract logic, one shortened deadline

VISCHER’s overview does not cover Claude Code, Anthropic’s agentic?AgenticAI applications that work in multiple steps, on their own: they plan, call tools and repeat steps until the task is done. In doing so they send the same context many times over. command-line tool for programming work, separately. What follows is our own research into Anthropic’s public data protection disclosures, as of July 2026, not VISCHER’s assessment.

Contractually, the same applies to Claude Code as to Claude itself. Anyone using it through Claude for Work (Team or Enterprise) or the API is subject to the same Commercial Terms (Anthropic’s general business terms) and the same DPA criticised in the previous section. There is no separate Claude Code DPA.

You should check two details before rollout. For commercial API use, Anthropic currently states a standard retention period of 30 days: inputs and outputs are then automatically deleted and not used for training.Anthropic Privacy CenterAnthropic Privacy Center · 2026How long do you store my organization's data?Open source ↗ Claude Code is also eligible for Zero Data Retention, either through a commercial API key or through Claude Enterprise.Anthropic DocsAnthropic Docs · 2026API and data retentionOpen source ↗ What that assurance has meant since June 2026 is explained in the section “Zero Data Retention: no longer for every model”.

Professional secrecy: why Anthropic falls short

For law firms, medical practices, trustees and banks, the question of professional secrecy↗Law & Regulation · Part 3Professional secrecy and AI: what may go to the cloud'That does not work for us' is often the answer to AI in law firms and medical practices. The criminal-law article on professional secrecy (Art. 321 of the Swiss Criminal Code) is drawn more narrowly, and most of daily work falls outside it entirely.Read article is often more pressing than general GDPR or revFADP compliance. At Anthropic, VISCHER’s answer is short.

Unlike at Microsoft or Google, there is, as of July 2026, no known route to professional-secrecy data directly at Anthropic. VISCHER clearly recommends sourcing Claude models for professional- or official-secrecy data from one of the three hyperscalers, Microsoft, AWS or Google. More on that further below.

Zero Data Retention: no longer for every model

VISCHER’s overview was finished shortly before a change that matters for customers with Zero Data Retention (ZDR). On 9 June 2026, Anthropic classified two new models, Claude Fable 5 and Claude Mythos 5, as “Covered Models”, that is, particularly capable models with heightened risk potential.

Independently of that, ZDR does not mean entirely without storage. Anthropic states that content flagged as a possible violation of its usage policies may be retained for up to two years, even under ZDR.Anthropic DocsAnthropic Docs · 2026API and data retentionOpen source ↗ For businesses that chose ZDR precisely for the “no storage” assurance, it follows that you should check which model you are using, and keep reading the current terms regularly, long after the contract is signed.

Where Claude stands on the sovereignty scale

The contract question is one layer. The other is the architecture: which jurisdiction does processing actually fall under, how open is the model behind it, where does operation run, and can you get out of the system again if you need to? How we understand sovereignty is set out in our foundational article, What is sovereign AI?. Applied to Claude, the same six axes look like this:

less sovereign more sovereign →

Legal jurisdiction

US

EU

Switzerland

Model

closed

open weights

open + training data

Software

proprietary

open code

true open source

Operation

US cloud

Swiss provider

in-house

Data

provider trains on it

contractually forbidden

technically impossible

Integration

proprietary API

open standards

in-house

On legal jurisdiction, Claude sits at the far left, at “US”, when accessed directly from Anthropic: processing runs on US infrastructure, and Anthropic offers no dedicated EU or Swiss region. Only access via a hyperscaler shifts this axis, more on that in the next section. On the model axis, Claude also sits at the far left: unlike OpenAI with gpt-oss or Google with Gemma, Anthropic publishes no open models?Open weightModels whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in.. Every use therefore runs through a provider. On integration, it likewise remains a proprietary API, even though it can be reached through three different contract partners.

The escape route: Claude via the hyperscalers

Anthropic offers no open models that could be self-hosted↗Local Inference · Part 1Self-hosting an LLM: GPT-5 performance for CHF 8’500A machine with two graphics cards (RTX 4090), around CHF 8’500, three weeks of measurements. Which tasks a machine of your own handles, which it does not, and where the limit sits.Read article. The escape route out of direct Anthropic lock-in therefore leads to another contract partner. All three hyperscalers, Microsoft, AWS and Google, offer Claude models under their own contracts.

Key figure

3 hyperscalers

Source: VISCHER, AI tools market overview part 31, as of July 2026

At Google, for instance, the contractual relationship is formed with Google itself. The customer additionally agrees to follow the Anthropic Terms of Service. According to its own Service Specific Terms, Anthropic in this case has neither access to the customer’s Google Cloud environment nor to the data processed there; abuse monitoring, that is, checking for misuse, is then carried out by Google. One exception remains: for the Covered Models, Anthropic reserves access to customer data even via a hyperscaler. In doing so, Anthropic commits to complying with the Anthropic DPA.

At Microsoft, processing of Anthropic models, for instance as an alternative to GPT in Copilot, currently still runs in the US; for professional secrecy, this route is therefore ruled out for now. VISCHER has, however, learned that Anthropic plans to also run its models on data centres in Europe towards the end of 2026. VISCHER itself has not yet carried out an in-depth review of the situation at AWS.

How to get started

Before your next Claude contract or the next expansion, clarify these four points:

1. Is a personal tier (Free, Pro, Max) running in business use at your organisation? There, training has been enabled by default since August 2025.
2. Do Claude or Claude Code process especially sensitive personal data or even professional-secrecy data? According to VISCHER, neither the direct Anthropic contract nor the consumer tiers are sufficient for that.
3. Does an arrangement labelled “Zero Data Retention” at your organisation still deliver what the name promises since the June 2026 change?
4. Would access via a hyperscaler be the better fit for your use case than the direct Anthropic contract?

The other parts of the series review OpenAI, Google and Microsoft against the same structure, plus Proton, a provider that does it differently.

Does your team work with Claude? Then it is worth asking who your contract partner actually is.

Directly with Anthropic, the data processing agreement excludes especially sensitive personal data, such as health data. Processing runs on US infrastructure. None of the business contracts covers professional or official secrecy, according to the Zurich law firm VISCHER. There is no dedicated EU or Swiss region.

The way out therefore leads to a different contract partner. Via Google Vertex AI, Google's AI platform, use is possible with the necessary add-ons, according to VISCHER. Microsoft Azure, Microsoft's cloud, processes Anthropic models in the US for now. OpenAI (gpt-oss) and Google (Gemma) publish open models that anyone can download, Anthropic does not. Self-hosting is ruled out.

Our conclusion: before you commit, check how you would get out again. How quickly assurances change is shown by Zero Data Retention, the promise not to store your inputs and responses: since June 2026, two Claude models are excluded from it and require 30 days of storage, without the promise's name changing at all.

Our own assessment, not legal advice. The article covers the four routes to access, where Claude Code stands and six questions to ask before your next contract. Link in the comments.

#AI #DataProtection #Anthropic #Switzerland