If you’re a developer at an EU company using Claude Code, Cursor, or any AI coding tool — your company may be violating GDPR without knowing it. Every prompt you send is data that gets processed on someone else’s servers.

Here’s what you actually need to know.

The core problem

When you use an AI coding tool, your code travels to external servers. If that code contains:

• Personal data (user emails, names, addresses in test fixtures)
• Database schemas with PII fields
• API keys or credentials
• Customer data in config files

…then you’re transferring personal data to a third-party processor. Under GDPR, that requires a legal basis, a Data Processing Agreement (DPA), and potentially a Transfer Impact Assessment if the data leaves the EU.

Which AI tools are GDPR compliant?

Tool/Provider	DPA available?	EU data residency?	Training on your data?
Mistral API	✅ Yes	✅ EU-based	❌ No
Anthropic API (Claude)	✅ Yes (Team/Enterprise)	⚠️ US servers	❌ No (API)
OpenAI API	✅ Yes	⚠️ US servers (EU option available)	❌ No (API)
Google Vertex AI	✅ Yes	✅ EU region available	❌ No
Claude Pro subscription	❌ Consumer terms	❌ US	⚠️ May be used
ChatGPT Plus	❌ Consumer terms	❌ US	⚠️ May be used
Self-hosted	N/A (your servers)	✅ You control it	❌ No

Key distinction: API access (business terms, DPA available) is different from consumer subscriptions (personal terms, no DPA). If your company uses ChatGPT Plus or Claude Pro for work, that’s a compliance risk.

The safest options for EU developers

Option 1: Self-hosted (zero data transfer)

Run models locally — nothing leaves your machine:

ollama pull devstral-small:24b
aider --model ollama/devstral-small:24b

See our self-hosted AI guide and Ollama guide.

Option 2: Mistral API (EU-native)

Mistral is based in Paris. Data stays in the EU by default. No transatlantic transfers, no Standard Contractual Clauses needed.

from mistralai import Mistral
client = Mistral(api_key="your-key")
# Data processed in EU infrastructure

See our Mistral API guide.

Option 3: US providers with DPA + EU region

Anthropic and OpenAI offer business plans with DPAs. Google Vertex AI lets you specify EU regions. This is compliant but requires paperwork.

What about AI coding tools?

Tool	GDPR-safe?	Why
Aider + local model	✅	Nothing leaves your machine
Continue.dev + Ollama	✅	Local inference
Aider + Mistral API	✅	EU data residency
Claude Code (Pro sub)	❌	Consumer terms, US servers
Cursor	⚠️	Business plan has DPA
GitHub Copilot Business	✅	DPA + no training on code

Practical steps

1. Audit your AI tools — list every AI service your team uses
2. Check for DPAs — consumer subscriptions don’t count
3. Scrub test data — remove real PII from test fixtures and seed data
4. Consider self-hosting for sensitive codebases
5. Use Mistral as your default EU-compliant provider
6. Document everything — GDPR requires you to demonstrate compliance

Related: Where Does Your Code Go? · Self-Hosted AI for GDPR · EU AI Act for Developers · Best AI Coding Agents for Privacy