Claude privacy & compliance: Individual, Team & Enterprise

Not through a casual admin dashboard. On the Team plan, regular admins have no feature to browse your conversations — but the organisation's Primary Owner can request access to your user data through a data export, which may contain your conversations, uploaded files, and usage patterns. On Enterprise, the organisation can additionally access conversation content programmatically through the Compliance API and set data-retention rules. So on a company plan, treat Claude like work email: it is not casually monitored, but the company can access it when it has a legitimate reason. On a personal Free, Pro, or Max plan there is no admin — only you can see your chats.

On Team, Enterprise, and the API (including Amazon Bedrock and Google Vertex AI), no — customer prompts and responses are not used to train Anthropic's models by default. On individual Free, Pro, and Max plans the rule changed on 8 October 2025: you now choose. Allow your chats to improve Claude and retention extends to 5 years; decline and the standard 30-day retention applies.

On individual plans, 30 days if you decline model training, or up to 5 years if you allow it; deleting a chat removes it from your history and it is then removed from Anthropic's back-end systems per their retention policy. On Team, standard retention applies and deleted chats are removed. On Enterprise, a Primary Owner or Owner sets a custom retention period (minimum 30 days; data is retained indefinitely unless a period is set), and all retention changes and deletions are recorded in audit logs.

For its commercial products — Claude for Work (Team and Enterprise) and the Anthropic API — Anthropic maintains SOC 2 Type I and Type II, ISO/IEC 27001:2022, and ISO/IEC 42001:2023, plus a HIPAA-ready configuration with a Business Associate Agreement (BAA) available on sales-assisted Enterprise and the first-party API. Consumer Free/Pro/Max plans are not the vehicle for these commitments. Current certifications and the sub-processor list are published in Anthropic's Trust Center.

Yes, with the right plan and setup. Commercial plans do not train on your data and support retention controls; Enterprise adds audit logs, role-based access, a Compliance API, and a BAA/data-processing-agreement path. But PDPA compliance is mostly about how you deploy and govern Claude — data minimisation, access control, a processor agreement, and where inference runs — not the model alone. Treat this page as a starting point for your DPO or counsel, not legal advice.

Yes. Your individual chats are private to you unless you explicitly share a Project or conversation. Sharing a Project gives the people you choose 'Can view' or 'Can edit' access to that project's chats, knowledge, and instructions — but your other personal chats stay private and are not exposed to teammates.

Both keep your data out of model training and give you central admin and SSO. Enterprise adds SCIM provisioning, fine-grained role-based access control, audit logs, the Compliance API for programmatic access to usage data and content, custom data-retention timelines, and options such as customer-managed encryption keys, US-only inference, and a HIPAA BAA — the governance controls regulated organisations typically need.