Adopting AI in a professional setting raises a fundamental question: is my data safe? With Claude Cowork, Anthropic offers an AI agent that works directly on your machine in a sandboxed environment. But what actually happens with your files? What GDPR guarantees do you have? This article answers all these questions with concrete recommendations for using Claude Cowork securely, even when handling sensitive data.
Is Claude Cowork GDPR compliant?
Claude Cowork can be used in a GDPR-compliant way provided you put the right safeguards in place. Anthropic offers a DPA aligned with the EU Standard Contractual Clauses, has committed since March 2024 not to train on your data without consent, and deletes conversation data after 30 days. You must sign the DPA and apply data minimization. The main limitation: data transfers outside the EU, since servers are primarily US-based.
How Claude Cowork handles your data
Claude Cowork operates on a specific architectural model. When you launch a task, the agent runs in a virtualized sandbox environment on your own machine. Your files — spreadsheets, Word documents, PDFs, databases — are read and manipulated locally.
However, text exchanges between you and Claude pass through Anthropic's servers. Every prompt you send and every response generated goes through the Claude API. This raises the central question: what data leaves your machine, and how is it handled on Anthropic's servers?
What is sent to Anthropic servers
- Your text instructions: every message you type in the Cowork interface.
- Referenced file content: if you ask Claude to analyze a file, relevant content is sent in the conversation context.
- Execution results: when Claude runs code or commands, outputs are sent back to the model so it can continue the task.
What stays on your machine
- Your original files: they are not permanently copied to Anthropic's servers.
- The sandbox environment: all executed code, temporary files, and modifications remain in the local container.
- Your project history: CLAUDE.md files, custom instructions, and project notes stay on your disk.
GDPR compliance: where does Anthropic stand?
Anthropic has published a Data Processing Agreement (DPA) compliant with the European Commission's standard contractual clauses. Key commitments include:
- Purpose limitation: data transmitted via the API is processed solely to deliver the requested service.
- No training on your data: since March 2024, Anthropic commits to not using API and Cowork user data for model training without explicit consent.
- Limited retention: conversation data is kept for 30 days for safety and abuse monitoring, then deleted.
- Identified sub-processors: Anthropic publishes its sub-processor list (primarily AWS) with change notifications.
Key limitations to be aware of: data transfers outside the EU (servers are primarily US-based), the 30-day temporary retention period, and the absence of formal ISO 27001 or SOC 2 Type II certification specific to Cowork at the time of writing.
Data you should never share with Claude Cowork
Even with the best contractual guarantees, data minimization remains the golden rule:
- Never share: Social Security numbers, full bank details, passwords and API keys in plain text, identified medical records, criminal records.
- Always anonymize before sending: client lists (use Client_001 identifiers), payslips (remove names, keep amounts), commercial contracts (mask party names), HR evaluations.
Practical security guide
1. Configure your environment correctly
Verify that sandbox mode is active (it is by default). In Cowork settings, confirm that sandbox_mode is set to true.
2. Use .env files for secrets
Never paste API keys or passwords directly in a conversation. Store them in a .env file added to your .gitignore.
3. Create a CLAUDE.md with security rules
Add explicit instructions that Claude reads at the start of every session: never include personal data in responses, systematically anonymize names, flag any sensitive data detected in source files.
4. Enable zero data retention for sensitive projects
Anthropic offers a zero data retention option for Enterprise accounts. With this enabled, no conversation data is stored on servers after the response. Strongly recommended for regulated sectors.
Sector-specific recommendations
Lawyers: Use Claude only for generic tasks (legal research, template drafting, public case law analysis). Never include identifiable client files. Use fictional facts inspired by your real case.
Accountants: Work with anonymized files. Export accounting data with client names replaced by codes. Claude can analyze a balance sheet without knowing the client's identity.
Healthcare professionals: Health data is classified as sensitive under GDPR Article 9. Never use Claude Cowork with identified patient records. Use it for generic protocols, medical literature analysis, or anonymized aggregate data.
HR managers: Use Claude Cowork for document templates without including real employee data. For salary analysis, work with aggregated statistics rather than nominative files.
What changes with the Enterprise plan
The Enterprise plan adds SSO/SAML integration, centralized audit logging, granular usage policies per user, guaranteed zero data retention, and dedicated security support.
Conclusion: secure usage is possible
Claude Cowork is neither more nor less secure than any SaaS tool processing your data. The major difference is that execution happens locally, significantly reducing the exposure surface. Data sent to Anthropic's servers is limited to conversation text content and is deleted after 30 days (or immediately with zero data retention). The key to GDPR-compliant usage rests on you: minimize personal data in your prompts, anonymize files before analysis, and configure your environment correctly.
Prompt Guide
Founder of Prompt Guide and CEO of Webpulser. Digital and AI entrepreneur since 2006, he shares his field-tested prompt engineering techniques.
Practice what you learned
Interactive exercises to sharpen your prompting skills
Master Claude Cowork in 5 days
Get one email per day for 5 days with practical exercises, ready-to-use prompts and pro tips.
- 1Day 1: Setup and global instructions
- 2Day 2: Skills - customize your assistant
- 3Day 3: Scheduled tasks and automations
- 4Day 4: Plugins, connectors and Computer Use
- 5Day 5: Advanced workflows and business use cases
Claude Code AI Workspace Kit
A kit to structure your context and workspace with Claude Code.
- A workspace for Claude Code
- Ready-to-use context files
- A framework to organise your work
Related Prompts
Developer Resume Prompt
Write a developer resume from your stack, your projects and the target job posting.
Preparing for a Sales Interview: Prompt
Prepare for a sales interview with likely questions, a personal pitch, and a graded sales simulation.
Cover letter for public sector jobs: prompt
A letter addressed to a government agency, local authority or public hospital, written from the job description.
Career change cover letter: prompt
A prompt to write a career change cover letter that explains your switch and connects your background to the target role.