Anthropic Data Processing Addendum

This Data Processing Addendum (“DPA”) is incorporated into and forms part of the Anthropic Commercial Terms of Service or other agreement between Customer and Anthropic that references this DPA and governs Customer’s use of the Services (the “Agreement”), and applies to Anthropic’s processing of Customer Data (defined below). Capitalized terms used but not otherwise defined in this DPA will have the meaning set forth in the Agreement. Anthropic may amend this DPA from time to time on reasonable notice to Customer to the extent such changes are required due to changes in Applicable Data Protection Laws. If there is any conflict between the terms of this DPA and the Agreement, the conflicting terms in this DPA will govern.

A. Definitions

A.1. "Applicable Data Protection Laws" means all applicable privacy or data protection laws and regulations relating to the processing of personal data, as may be amended from time to time.

A.2. "Customer Personal Data" means personal data submitted through the Services by or for Customer or a Customer Affiliate.

A.3. "Customer Affiliate" means an affiliate of Customer that (a) is permitted to use the Services pursuant to the Agreement between Anthropic and Customer, and (b) directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control,” for purposes of this definition, means direct or indirect ownership or control of more than 50% of voting interests.

A.4. “Customer Data” means all data or other information submitted through the Services by or for Customer or a Customer Affiliate.

A.5. “Data Subject Request” means a request from a data subject to exercise their personal data-related rights under Applicable Data Protection Laws, such as rights to access, correct, or delete their personal data.

A.6. "GDPR" means Regulation (EU) 2016/679.

A.7. "Security Breach" means a breach of Anthropic’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Data.

A.8. "Standard Contractual Clauses" or “SCCs” means Module Two (controller to processor) or Module Three (processor to processor) of the Standard Contractual Clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and the Council approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, available at https://eurlex.europa.eu/eli/dec_impl/2021/914/oj.

A.9. "Subprocessor" means an entity engaged by Anthropic to process Customer Personal Data.

A.10. “UK Addendum” means the International Data Transfer Addendum to the SCCs, issued by the Information Commissioner under S119A(1) Data Protection Act 2018, available at https://ico.org.uk/media2/migrated/4019538/international-data-transfer-agreement.pdf).

A.11. The terms “personal data”, “data subject”, “processing”, “controller”, and “processor” as used in this DPA have the meanings given by Applicable Data Protection Laws or, absent any such meaning or law, by GDPR.

A.12. The terms “controller” and “processor” include “business”, and “service provider”, respectively, as required by Applicable Data Protection Laws.

B. Processing of Customer Data

B.1. With respect to Customer Personal Data, Customer is the controller and Anthropic is Customer’s processor. Each party will comply with its respective obligations under Applicable Data Protection Laws in connection with the Services and the Customer Personal Data.