Skip to content

Claude and UK GDPR

Is Claude safe for client data? A guide for UK firms

Claude Team, Claude Enterprise and Anthropic's API can be used for client work, with the right safeguards in place. The Free, Pro and Max plans shouldn't be, because they're consumer plans with no contract with your firm.

By Paulo De Sousa, Co-founder of SimpleKPILast checked

Claude plans at a glance

The same AI tool can be safe or risky, depending on the plan someone is signed in to.

Claude plans: contract, training and use for client data
PlanContract with your firmTrains on what's typedFor client data?
Free, Pro or MaxConsumer terms. No data processing agreement with your firm.Used for training only if the user allows it. Allowing it means chats can be kept for up to five years instead of 30 days.No personal data
Team or EnterpriseAnthropic's commercial terms, with a data processing agreement.Not used for training.Yes, with safeguards

From Anthropic: updates to consumer terms, checked 21 October 2026. Check your own plan with the AI plan checker.

Consumer plans vs commercial plans

Anthropic splits Claude into two kinds of plan, and the split is what matters for client data.

Claude Free, Pro and Max are consumer plans. Consumer terms apply, and there's no data processing agreement between Anthropic and your firm. Each person chooses their own training setting.

Claude Team and Claude Enterprise (sold as Claude for Work), and Anthropic's API, are under Anthropic's commercial terms, with a data processing agreement. What's typed isn't used for training.

Pro and Max are paid, but they're still consumer plans. Paying for Claude doesn't, on its own, make it a business plan.

The 2025 change to Claude's consumer terms

In 2025 Anthropic changed its consumer terms. Since then, chats on Free, Pro and Max are used for training only if the user allows it.

Allowing it has a second effect people often miss: chats can then be kept for up to five years, instead of 30 days. That's one person's choice, made in their own settings, which your firm can't see or control.

For law firms and other firms handling confidential client files, that's the deciding point. Client work belongs on Claude Team or Enterprise, where the firm's commercial terms apply and nothing is used for training.

What UK GDPR expects if you use Claude

  • Use a business plan that comes with a data processing agreement (the contract that covers your clients' data).
  • List Claude in your records of processing and your privacy notice.
  • Do a risk assessment (a DPIA) before you rely on it for client work.
  • Check the safeguards if data goes outside the UK.
  • Tell your team the rules: which plan to use, and what must never go in.

Before you write your records of processing, check where Anthropic stores your data and whether a UK or EU region is offered on your plan, because it decides which transfer safeguards you need.

What the ICO expects when your team uses AI

Settings to change today

  • Training on your chats (in Claude's privacy settings)

    On Free, Pro or Max, chats are used for training only if the user allows it, and allowing it means they can be kept for up to five years. If anyone uses a consumer plan at all, ask them to leave training off. It doesn't add a contract, so consumer plans still aren't the place for client details.

  • Sign in to your firm's Team or Enterprise organisation

    Make sure everyone doing client work is signed in to the firm's Claude Team or Enterprise account, not a personal Free, Pro or Max login in the same browser.

How Saiela helps

  • Approve the business plan your firm pays for.
  • Warn people on personal accounts, or block them.
  • Swap client details out of prompts before anything is sent.
  • See which tools and accounts your team uses, as counts, never content.

See how approved AI tools work

Questions

What firms ask about Claude and client data.

Does Claude train on my data?

On Claude Team, Enterprise and the API, no. On Free, Pro and Max, only if the user allows it, and allowing it means chats can be kept for up to five years instead of 30 days.

Is Claude safe for law firms?

Claude Team or Enterprise is the right plan for client work: Anthropic's commercial terms and a data processing agreement apply, and nothing is used for training. You still need the other safeguards, such as a risk assessment (a DPIA), an AI policy and keeping unnecessary client details out of prompts. Solicitors should also read the SRA's warning notice on the misuse of AI.

Is Claude Pro a business plan?

No. Pro, like Max, is a paid consumer plan. It has consumer terms and no data processing agreement with your firm. Claude Team and Enterprise are the business plans.

Can I use my personal Claude account for work?

For general questions with no personal data, yes. For anything with client details, no: consumer plans have no contract with your firm, and training depends on each person's own setting.

Do I need a DPIA to use Claude?

Usually. The Information Commission (ICO) says that in the vast majority of cases, using AI involves processing likely to result in a high risk, which calls for a risk assessment (a DPIA). Do it before you rely on Claude for client work.

Sources

Last checked 21 October 2026. Providers change their plans often. General information, not legal advice.

Paulo De Sousa

Paulo De Sousa

Co-founder of SimpleKPI

Paulo has worked in software development and SaaS for over 20 years and leads the engineering behind SimpleKPI and Saiela. He writes about how AI tools handle your data and how Saiela keeps it out of them.

Paulo on LinkedIn

Use Claude without the client data risk.

Approve the right plan, block personal accounts and keep client details out of every prompt. Try it free for 7 days.

Start free trialSee pricing