The document identifies Nutun, located in South Africa, as a subprocessor providing user support functions across all Anthropic Claude products except Claude for Government. South Africa is not the subject of an EU adequacy decision under GDPR.
This analysis describes what Anthropic's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The use of a South Africa-based subprocessor for user support functions creates international data transfer obligations under GDPR Chapter V for EU and UK personal data, requiring either Standard Contractual Clauses, Binding Corporate Rules, or another recognized transfer mechanism. Enterprise customers with GDPR obligations should verify that Anthropic's DPA addresses this transfer adequately.
Interpretive note: The document does not specify the transfer mechanism Anthropic uses for South Africa data flows, creating uncertainty about GDPR compliance posture for this subprocessor.
Under this provision, user support interactions for EU and UK residents may involve data processing by Nutun, a South Africa-based subprocessor. Users in the EU and UK should be aware that their support-related data may be processed in a jurisdiction without an EU adequacy decision, subject to whatever transfer mechanisms Anthropic has implemented.
Cross-platform context
See how other platforms handle International Subprocessor: Nutun (South Africa) for User Support and similar clauses.
Compare across platforms →"Nutun • User support South Africa Products: All Products except Claude for Government More InformationExcerpt from Anthropic's Sub-Processors
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V international transfer requirements, enforced by EU member state data protection authorities and coordinated by the European Data Protection Board.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The use of a South Africa-based subprocessor for user support functions creates international data transfer obligations under GDPR Chapter V for EU and UK personal data, requiring either Standard Contractual Clauses, Binding Corporate Rules, or another recognized transfer mechanism. Enterprise customers with GDPR obligations should verify that Anthropic's DPA addresses this transfer adequately.
Under this provision, user support interactions for EU and UK residents may involve data processing by Nutun, a South Africa-based subprocessor. Users in the EU and UK should be aware that their support-related data may be processed in a jurisdiction without an EU adequacy decision, subject to whatever transfer mechanisms Anthropic has implemented.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Anthropic.