Not all AI APIs are equal under GDPR. Here’s the compliance status of every major provider.
The comparison
| Provider | EU data residency | DPA available | No training on data | GDPR verdict |
|---|---|---|---|---|
| Mistral | ✅ Native (France) | ✅ | ✅ | ✅ Best for EU |
| Google Vertex AI | ✅ EU region option | ✅ | ✅ | ✅ Good |
| Azure OpenAI | ✅ EU region option | ✅ | ✅ | ✅ Good |
| Anthropic API | ❌ US only | ✅ (Business) | ✅ | ⚠️ Needs SCCs |
| OpenAI API | ⚠️ EU option available | ✅ (Business) | ✅ | ⚠️ Check config |
| DeepSeek | ❌ China | ❌ Unknown | ❌ Unknown | ❌ Avoid for PII |
| OpenRouter | ❌ US | ⚠️ Limited | Varies by model | ⚠️ Check per model |
What “GDPR compliant” actually means
For an AI API to be GDPR compliant, you need:
- Legal basis for processing (legitimate interest or consent)
- Data Processing Agreement (DPA) with the provider
- Transfer mechanism if data leaves the EU (SCCs, adequacy decision)
- No training on your data (or explicit consent for it)
- Data retention limits that match your privacy policy
The safest path for EU companies
Tier 1 — Zero risk:
- Self-hosted models via Ollama
- No data transfer, no DPA needed, automatic compliance
Tier 2 — Low risk:
- Mistral API — EU-native, DPA included
- Google Vertex AI with EU region — established GDPR framework
Tier 3 — Medium risk (needs paperwork):
- Anthropic API with Business DPA + SCCs
- Azure OpenAI with EU region + DPA
Tier 4 — High risk (avoid for sensitive data):
- Consumer subscriptions (ChatGPT Plus, Claude Pro)
- Chinese providers without clear data policies
- Free tiers without business terms
For AI coding tools specifically
| Tool | Safest configuration |
|---|---|
| Aider | + Ollama (local) or + Mistral API |
| Continue.dev | + Ollama (local) |
| Claude Code | Enterprise plan with DPA |
| Cursor | Business plan with DPA |
| GitHub Copilot | Business plan (no code retention) |
Related: AI and GDPR for Developers · Where Does Your Code Go? · Self-Hosted AI for GDPR · What is Mistral AI?