> Source: https://souverana.ch/insights/anthropic-claude-datenschutz-en/ > Language: en # Anthropic Claude and Swiss data protection: what to check Claude, Anthropic's AI assistant, works for business data, not for professional secrecy, according to the law firm VISCHER. The promise not to store inputs and outputs has not held for two models since June 2026. Analysis · Published 21 Jul 2026 · Updated 21 Oct 2026 · Joel Barmettler ## Can Swiss businesses use Anthropic’s Claude in compliance with data protection law? **Fine for ordinary business data, not for professional secrecy: Swiss businesses can use Claude, Anthropic’s AI assistant, through Team, Enterprise or the API. Lawyers, doctors and others bound to secrecy need access via a cloud provider such as Google, according to the Zurich law firm VISCHER (July 2026), because the data processing agreement excludes especially sensitive personal data.** **In brief** - The private plans Claude Free, Pro and Max are unsuitable for enterprise use. On these plans, Anthropic has trained on conversations and code by default since 28 August 2025, unless the user opts out. - Anthropic promises not to store inputs and outputs after the response (“Zero Data Retention”). Since June 2026, this no longer holds for two Claude models, whose data is retained for 30 days. Check regularly which models the promise still covers. - If you must keep data in Switzerland or the EU, the direct contract offers no solution. Anthropic offers no dedicated EU or Swiss region. Only access via a large cloud provider such as Microsoft, AWS or Google shifts where processing happens. - Plan your exit before you commit. Anthropic publishes no open models that you could download and run on your own servers. Anyone who leaves Claude therefore switches to a different provider. - For Claude Code, Anthropic’s programming tool, the same contracts apply as for Claude itself. Through Team, Enterprise or the API, Anthropic does not train on your code. The Zurich law firm VISCHER (authors Lucian Hunger and Jonas Baeriswyl) regularly updates a public market overview of AI providers; the July 2026 edition gives Anthropic its own section for the first time, as the “most important new player” alongside the three established hyperscalers Microsoft, AWS and Google.[1] Souverana is not a law firm: what follows is VISCHER’s legal assessment, quoted and commented on, together with the architecture questions that a legal review does not address. This article is the second part of our series Provider Data-Protection Check, following the same structure as the other parts: contracts, data residency, professional secrecy, ways out. **Series · Provider Data-Protection Check** 1. [Is ChatGPT GDPR-compliant? What OpenAI's contracts cover](https://souverana.ch/en/insights/chatgpt-dsgvo-konform/) 2. Anthropic Claude and Swiss data protection: what to check (this part) 3. [Google Gemini & data protection: what SMEs need to know](https://souverana.ch/en/insights/google-gemini-datenschutz/) 4. [Using Microsoft Copilot safely: what data protection allows](https://souverana.ch/en/insights/microsoft-copilot-datenschutz/) 5. [Proton Lumo: what privacy-friendly AI looks like](https://souverana.ch/en/insights/proton-lumo/) ## What VISCHER criticises about Anthropic With this edition, VISCHER has added the Anthropic models to its overview for the first time: on one side various consumer offerings, on the other the three business offerings Team, Enterprise and API. As with every other provider, the consumer offerings are not suitable for enterprise use. The business offerings come with a data processing agreement (Anthropic DPA), which regulates how Anthropic processes personal data on behalf of the customer. They also include a confidentiality obligation and the assurance that data is not used for training or service improvement. According to VISCHER, that makes enterprise use possible. One caveat is the same as at OpenAI: the Anthropic DPA only covers personal data that does not qualify as especially sensitive. For especially sensitive personal data within the meaning of the revFADP, the Claude models are therefore not suitable under the publicly available DPA, even where staff are clearly instructed not to enter such data. > **Evidence** > > VISCHER’s assessment is the same for both large newcomers: “Here too, OpenAI and Anthropic both show, in our view, the lower maturity of the ‘newcomers’ in data protection and data security compared with the hyperscalers Microsoft, AWS and Google.” For sensitive applications, the firm recommends sourcing Anthropic models via a hyperscaler, not directly. According to VISCHER, Anthropic has so far been unwilling to discuss professional secrecy when asked. ## Claude Code: the same contract logic, one shortened deadline VISCHER’s overview does not cover Claude Code, Anthropic’s agentic command-line tool for programming work, separately. What follows is our own research into Anthropic’s public data protection disclosures, as of July 2026, not VISCHER’s assessment. Contractually, the same applies to Claude Code as to Claude itself. Anyone using it through Claude for Work (Team or Enterprise) or the API is subject to the same Commercial Terms (Anthropic’s general business terms) and the same DPA covered in the previous section. There is no separate Claude Code DPA. > **Risk** > > On the personal tiers Claude Free, Pro and Max, Anthropic states that it has trained on conversations and code by default since 28 August 2025, unless someone actively opts out; for those who consent, data is retained for up to five years.[2] Under the business terms for Team, Enterprise, API and via AWS Bedrock and Google Cloud, Anthropic states that it does not train on code or conversations.[3] You should check two details before rollout. For commercial API use, Anthropic currently states a standard retention period of 30 days: inputs and outputs are then automatically deleted and not used for training.[4] Claude Code is also eligible for Zero Data Retention, either through a commercial API key or through Claude Enterprise.[5] The section “Zero Data Retention: no longer for every model” explains what that assurance has meant since June 2026. ## Professional secrecy: why Anthropic falls short For law firms, medical practices, trustees and banks, the question of [professional secrecy](https://souverana.ch/en/insights/berufsgeheimnis-cloud/) is often more pressing than general GDPR or revFADP compliance. At Anthropic, VISCHER’s answer is short. > **Evidence** > > VISCHER’s conclusion, paraphrased: even Anthropic’s business contracts are not sufficient for data covered by professional or official secrecy. The firm is not aware of any contract addenda or other solutions that would permit use with such data, despite high demand for the Anthropic models. Unlike at Microsoft or Google, no route to using professional-secrecy data directly with Anthropic is known (as of July 2026). VISCHER clearly recommends sourcing Claude models for professional- or official-secrecy data from one of the three hyperscalers, Microsoft, AWS or Google. More on that further below. ## Zero Data Retention: no longer for every model VISCHER’s overview was finished shortly before a change that matters for customers with Zero Data Retention (ZDR). On 9 June 2026, Anthropic classified two new models, Claude Fable 5 and Claude Mythos 5, as “Covered Models”, that is, particularly capable models with heightened risk potential. > **Risk** > > Zero Data Retention still means that Anthropic does not permanently store inputs and outputs after the response. For the two new Covered Models (Fable 5 and Mythos 5), that no longer holds: they require 30 days of retention and are not available under ZDR. Anyone who wants to use them under a ZDR agreement must explicitly enable the 30-day retention per workspace.[6] Independently of that, ZDR does not mean entirely without storage. Anthropic states that content flagged as a possible violation of its usage policies may be retained for up to two years, even under ZDR.[5] For businesses that chose ZDR precisely for the “no storage” assurance, it follows that they should check which model they use and keep reading the current terms regularly, long after the contract is signed. ## Where Claude stands on the sovereignty scale The contract question is one layer. The other is the architecture: which jurisdiction does processing actually fall under, how open is the model behind it, where does operation run, and can you get out of the system again if you need to? How we understand sovereignty is set out in our foundational article, [What is sovereign AI?](https://souverana.ch/en/insights/was-ist-souveraene-ki/). Applied to Claude, the same six axes look like this: less sovereign more sovereign → Legal jurisdiction US EU Switzerland Model closed open weights open + training data Software proprietary open code true open source Operation US cloud Swiss provider in-house Data provider trains on it contractually forbidden technically impossible Integration proprietary API open standards in-house On legal jurisdiction, Claude sits at the far left, at “US”, when accessed directly from Anthropic: processing runs on US infrastructure, and Anthropic offers no dedicated EU or Swiss region. Only access via a hyperscaler shifts this axis (more on that in the next section). On the model axis, Claude also sits at the far left: unlike OpenAI with gpt-oss or Google with Gemma, Anthropic publishes no open models. Every use therefore runs through a provider. On integration, Claude likewise remains a proprietary API, even though it can be reached through three different contract partners. ## The escape route: Claude via the hyperscalers Anthropic offers no open models [that could be self-hosted](https://souverana.ch/en/insights/llm-selbst-hosten/). The escape route out of direct Anthropic lock-in therefore leads to another contract partner. All three hyperscalers, Microsoft, AWS and Google, offer Claude models under their own contracts. > **3 hyperscalers** Microsoft Azure, AWS Bedrock and Google Cloud offer Claude models under their own, hyperscaler-typical contract terms. For professional- and official-secrecy data, VISCHER has so far only reviewed the route via Google with the necessary add-ons and found it suitable. > > Source: VISCHER, AI tools market overview part 31, as of July 2026 At Google, for instance, the contractual relationship is formed with Google itself. The customer additionally agrees to follow the Anthropic Terms of Service. According to its own Service Specific Terms, Anthropic in this case has neither access to the customer’s Google Cloud environment nor to the data processed there; abuse monitoring (checking for misuse) is then carried out by Google. One exception remains: for the Covered Models, Anthropic reserves access to customer data even via a hyperscaler and in doing so commits to complying with the Anthropic DPA.[3] At Microsoft, processing of Anthropic models, for instance as an alternative to GPT in Copilot, currently still runs in the US; for professional secrecy, this route is therefore ruled out for now. VISCHER has, however, learned that Anthropic plans to also run its models on data centres in Europe towards the end of 2026. VISCHER itself has not yet carried out an in-depth review of the situation at AWS.[1] ## How to get started Before your next Claude contract or the next expansion, clarify these four points: 1. Is a personal tier (Free, Pro, Max) running in business use at your organisation? On these tiers, training has been enabled by default since August 2025.[2] 2. Do Claude or Claude Code process particularly sensitive personal data or even data covered by professional secrecy? According to VISCHER, neither the direct Anthropic contract nor the consumer tiers are sufficient for that. 3. Since the June 2026 change, does an arrangement labelled “Zero Data Retention” at your organisation still deliver what the name promises?[4, 6] 4. Would access via a hyperscaler be the better fit for your use case than the direct Anthropic contract? Want to know which contract or architecture fits your data: Claude directly, via a hyperscaler, or Claude Code in your development team? [AI architecture and platform selection](https://souverana.ch/en/leistungen/ki-architektur/) The other parts of the series review OpenAI, Google and Microsoft against the same structure, plus Proton, a provider that does it differently. ## Sources [1] Anthropic. «Zero data retention agreement: what products it applies to». Anthropic Privacy Center. June 2026. [privacy.claude.com/en/articles/8956058-i-have-a-zero-data-retention-agreement-with-anthropic-what-products-does-it-apply-to](https://privacy.claude.com/en/articles/8956058-i-have-a-zero-data-retention-agreement-with-anthropic-what-products-does-it-apply-to). Herstellerangabe, Primärquelle. [2] Anthropic. «How long do you store my organization’s data?». Anthropic Privacy Center. 2026. [privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data). Herstellerangabe, Primärquelle. The author Joel Barmettler AI Architect · Souverana, Zurich Joel Barmettler guides Swiss companies from AI strategy to integration: sovereign, confidential and production-ready. He built the Swiss AI Hub as its architect and today co-owns its architecture; he personally leads every Souverana mandate. Mandates from one-person firms to Fortune 500 corporations. [Book an intro call](https://meet.brevo.com/joel-barmettler/30-minute-meeting) [More about Souverana](https://souverana.ch/en/) [LinkedIn](https://www.linkedin.com/in/joel-barmettler-b9ab361b7) ## Frequently asked questions Is Anthropic's Claude GDPR compliant? For the business tiers Team, Enterprise and API, in principle yes: a data processing agreement is in place, together with an assurance that data is not used for training. For especially sensitive personal data, such as health data, however, the contract is not sufficient according to the Zurich law firm VISCHER. The company has to assess the risk itself and decide. Can I use Claude for sensitive business data? For ordinary business data on a business tier, in principle yes, with contractual protection in place. For especially sensitive personal data or professional secrecy, such as attorney-client or medical confidentiality, the law firm VISCHER explicitly advises against it. In its assessment, Anthropic's own contract is not designed for it, and Anthropic has so far been unwilling to discuss the matter. Is Claude Code safe for enterprise use? Claude Code is Anthropic's programming tool for the command line. Through Team, Enterprise or the API, it can be used under the same conditions as Claude itself: no training on your code, but no especially sensitive personal data. Through the personal tiers Free, Pro or Max, Anthropic has trained on your inputs by default since August 2025. Can Claude be used by professionals bound to secrecy, such as lawyers or doctors? Not directly at Anthropic, according to the law firm VISCHER: it is not aware of any contract addenda that would permit use with data covered by professional or official secrecy. One route runs via a hyperscaler, meaning a large cloud provider such as Microsoft, AWS or Google. They offer Claude models under their own contracts, which are better suited to sensitive data. Does Anthropic offer Swiss or European data residency? No, not directly from Anthropic. Processing runs on US infrastructure by default, and Anthropic offers no dedicated EU or Swiss region. European processing can currently only be reached via AWS Bedrock or Google Vertex AI, the AI platforms of Amazon and Google, at correspondingly higher cost. ## Glossary - **API**: A programming interface through which software addresses a language model directly, without a chat interface. Usually billed per token. - **Professional and official secrecy**: The criminally protected duty of confidentiality of authorities (official secrecy, Art. 320 of the Swiss Criminal Code) and a list of professions named in the law (Art. 321), such as lawyers, doctors and pharmacists. It applies independently of data protection law and reaches further. Banking secrecy sits separately in the Banking Act. - **Data Processing Agreement (DPA)**: The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law. - **Personal data**: Any information relating to an identified or identifiable person, so customer records, HR files or even an email address. As soon as such data is involved, the revFADP applies. - **revFADP (revDSG)**: Switzerland's revised Federal Act on Data Protection, in force since 1 September 2023. It governs how companies may process personal data, and applies to AI use exactly as it does to any other processing. - **Agentic**: AI applications that work in multiple steps, on their own: they plan, call tools and repeat steps until the task is done. In doing so they send the same context many times over. - **Open weight**: Models whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in.