Regulatory Compliance for AI Systems (GDPR, HIPAA, FedRAMP)
Audience: professionals who use Claude at work, no coding or API knowledge needed. Verified = checked against Anthropic's documentation or help center on 2026-10-16. General background = standard regulatory or industry knowledge, not an Anthropic statement. Design guidance = widely taught practice.
This is education, not legal advice. Your organisation's policy and your legal and compliance teams decide what is permitted.
Classify the data first (design guidance)
| Class | Examples | Default stance |
|---|---|---|
| Public | Published articles, marketing copy | Generally fine |
| Internal | Meeting notes, plans, draft documents | Only in approved tools and accounts |
| Confidential | Contracts, source code, unreleased financials, client data | Only if explicitly approved for this tool and use |
| Personal data | Names, contact details, IDs, employee or customer records | Minimise, anonymise, and only with a lawful, approved basis |
| Special or regulated | Health information, financial account data, children's data, government or classified data | Do not use unless an approved, compliant arrangement exists |
Ask: Do I need this data at all? Can I remove names and identifiers? Is this account and tool approved for this class of data?
Three regimes you should recognise (general background)
| Regime | What it is about | What it means for your use |
|---|---|---|
| GDPR (EU personal data) | Lawful basis, purpose limits, data minimisation, individuals' rights, controls on transferring data across borders, security, rules on solely automated decisions with significant effects | Do not paste personal data without an approved basis; prefer anonymised or minimal data; have a human involved in consequential decisions |
| HIPAA (US health data) | Protection of identifiable health information; a business associate agreement (BAA) is needed with vendors handling it; "minimum necessary" access | Do not enter patient information into a tool that is not covered by your organisation's HIPAA arrangement |
| FedRAMP (US federal cloud) | A government security authorisation program with impact levels | Federal work generally needs an authorised service at the right level; follow your agency's rules |
What Anthropic documents (verified)
- For the Claude API, Anthropic offers zero data retention (ZDR) (per organisation, eligibility by feature) and HIPAA readiness with a signed BAA; the API and Claude Code have specific HIPAA configurations; on Amazon Bedrock and Google Cloud the cloud provider is the data processor.
- Anthropic keeps separate commercial and consumer data retention policies; which applies depends on whether you use a work (commercial) account or a personal plan.
- Public sources (not verified here) report that personal plans may use conversations for model improvement unless you opt out, while commercial plans such as Team, Enterprise and API are excluded by default. Check the current Anthropic privacy settings and your organisation's terms before relying on this.
Do not assume your personal account is acceptable for work data. Use the account your organisation provides.
Checklist before pasting data
- Is this data allowed in this tool, under my organisation's policy?
- Am I using the approved account (not a personal one)?
- Have I removed names, ids and anything not needed?
- Is the purpose consistent with why the data was collected?
- Will the output contain personal or confidential data, and where will I store it?
- If unsure: ask before you paste.
Exam traps
- Pasting client or patient data to "just get a quick summary".
- Using a personal account for work material.
- Assuming "AI tool" means approved.
- Forgetting that outputs can contain sensitive data.
- Believing anonymisation is automatic.
References
- API and data retention — checked Oct 16, 2026
- Legal and compliance (Claude Code) — checked Oct 16, 2026
Check your understanding
Data contains patient names. First question?Show answerHide answer
Answer
Is this tool and account covered by our organisation's approved health-data arrangement? If not, do not use it.Which account for work data?Show answerHide answer
Answer
The one your organisation provides and approves.Best way to reduce privacy risk?Show answerHide answer
Answer
Minimise and remove identifiers before using the data.