If you’re a developer at an EU company using Claude Code, Cursor, or any AI coding tool — your company may be violating GDPR without knowing it. Every prompt you send is data that gets processed on someone else’s servers.
Here’s what you actually need to know.
The core problem
When you use an AI coding tool, your code travels to external servers. If that code contains:
- Personal data (user emails, names, addresses in test fixtures)
- Database schemas with PII fields
- API keys or credentials
- Customer data in config files
…then you’re transferring personal data to a third-party processor. Under GDPR, that requires a legal basis, a Data Processing Agreement (DPA), and potentially a Transfer Impact Assessment if the data leaves the EU.
Which AI tools are GDPR compliant?
| Tool/Provider | DPA available? | EU data residency? | Training on your data? |
|---|---|---|---|
| Mistral API | ✅ Yes | ✅ EU-based | ❌ No |
| Anthropic API (Claude) | ✅ Yes (Team/Enterprise) | ⚠️ US servers | ❌ No (API) |
| OpenAI API | ✅ Yes | ⚠️ US servers (EU option available) | ❌ No (API) |
| Google Vertex AI | ✅ Yes | ✅ EU region available | ❌ No |
| Claude Pro subscription | ❌ Consumer terms | ❌ US | ⚠️ May be used |
| ChatGPT Plus | ❌ Consumer terms | ❌ US | ⚠️ May be used |
| Self-hosted | N/A (your servers) | ✅ You control it | ❌ No |
Key distinction: API access (business terms, DPA available) is different from consumer subscriptions (personal terms, no DPA). If your company uses ChatGPT Plus or Claude Pro for work, that’s a compliance risk.
The safest options for EU developers
Option 1: Self-hosted (zero data transfer)
Run models locally — nothing leaves your machine:
ollama pull devstral-small:24b
aider --model ollama/devstral-small:24bSee our self-hosted AI guide and Ollama guide.
Option 2: Mistral API (EU-native)
Mistral is based in Paris. Data stays in the EU by default. No transatlantic transfers, no Standard Contractual Clauses needed.
from mistralai import Mistral
client = Mistral(api_key="your-key")
# Data processed in EU infrastructureSee our Mistral API guide.
Option 3: US providers with DPA + EU region
Anthropic and OpenAI offer business plans with DPAs. Google Vertex AI lets you specify EU regions. This is compliant but requires paperwork.
What about AI coding tools?
| Tool | GDPR-safe? | Why |
|---|---|---|
| Aider + local model | ✅ | Nothing leaves your machine |
| Continue.dev + Ollama | ✅ | Local inference |
| Aider + Mistral API | ✅ | EU data residency |
| Claude Code (Pro sub) | ❌ | Consumer terms, US servers |
| Cursor | ⚠️ | Business plan has DPA |
| GitHub Copilot Business | ✅ | DPA + no training on code |
Practical steps
- Audit your AI tools — list every AI service your team uses
- Check for DPAs — consumer subscriptions don’t count
- Scrub test data — remove real PII from test fixtures and seed data
- Consider self-hosting for sensitive codebases
- Use Mistral as your default EU-compliant provider
- Document everything — GDPR requires you to demonstrate compliance
FAQ
Do AI tools comply with GDPR?
It depends on the tool and plan. API-based services (OpenAI API, Anthropic API, Google Vertex AI) offer Data Processing Agreements and don’t train on your data. Consumer subscriptions like ChatGPT Plus or Claude Pro use personal terms without DPAs and may not be GDPR-compliant for business use.
Can I use ChatGPT for GDPR-regulated data?
You can use the OpenAI API with a business agreement and DPA in place, but not the consumer ChatGPT Plus subscription. The API doesn’t train on your data and offers EU data residency options, making it suitable for regulated workloads with proper legal agreements.
Do I need a DPA for AI APIs?
Yes, if you’re sending any personal data to the API. Under GDPR, any third-party processing personal data on your behalf requires a Data Processing Agreement. Most major AI providers (OpenAI, Anthropic, Google) offer DPAs on their business and enterprise plans.
Is self-hosted AI GDPR compliant?
Self-hosted AI eliminates data transfer concerns since nothing leaves your infrastructure. However, you still need to comply with other GDPR requirements like data minimization, purpose limitation, and the right to erasure for any personal data the model processes or stores.
Related: Where Does Your Code Go? · Self-Hosted AI for GDPR · EU AI Act for Developers · Best AI Coding Agents for Privacy · Best VPNs for Developers · Uk Ai Regulation After Brexit · Ccpa Ai Developers