Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document identifies Nutun, located in South Africa, as a subprocessor providing user support functions across all Anthropic Claude products except Claude for Government. South Africa is not the subject of an EU adequacy decision under GDPR.
This analysis describes what Anthropic's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The use of a South Africa-based subprocessor for user support functions creates international data transfer obligations under GDPR Chapter V for EU and UK personal data, requiring either Standard Contractual Clauses, Binding Corporate Rules, or another recognized transfer mechanism. Enterprise customers with GDPR obligations should verify that Anthropic's DPA addresses this transfer adequately.
Interpretive note: The document does not specify the transfer mechanism Anthropic uses for South Africa data flows, creating uncertainty about GDPR compliance posture for this subprocessor.
Under this provision, user support interactions for EU and UK residents may involve data processing by Nutun, a South Africa-based subprocessor. Users in the EU and UK should be aware that their support-related data may be processed in a jurisdiction without an EU adequacy decision, subject to whatever transfer mechanisms Anthropic has implemented.
Cross-platform context
See how other platforms handle International Subprocessor: Nutun (South Africa) for User Support and similar clauses.
Compare across platforms →Monitoring
Anthropic has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Nutun • User support South Africa Products: All Products except Claude for Government More InformationExcerpt from Anthropic's Sub-Processors
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V international transfer requirements, enforced by EU member state data protection authorities and coordinated by the European Data Protection Board. South Africa is not covered by an EU adequacy decision, meaning Anthropic must rely on Standard Contractual Clauses (SCCs), Binding Corporate Rules, or another GDPR-compliant mechanism to authorize transfers. UK GDPR imposes parallel requirements for UK personal data transfers to South Africa. (2) GOVERNANCE EXPOSURE: Medium. User support functions typically involve processing of names, contact information, account details, and support ticket content, including potentially sensitive query content. The absence of an adequacy decision for South Africa means transfer documentation is required and must be maintained for regulatory audit purposes. (3) JURISDICTION FLAGS: EU and UK data subjects have heightened exposure under this provision. Organizations subject to GDPR or UK GDPR that process employee or customer data through Anthropic's products must confirm that Anthropic's transfer mechanisms for Nutun are documented and accessible. California-resident users may have CCPA-related vendor disclosure rights but do not face the same transfer mechanism requirements. (4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers with GDPR-compliant DPAs should verify that their agreements with Anthropic include a current subprocessor list incorporating Nutun and document the applicable transfer mechanism. If customers have notification rights for subprocessor changes, Nutun's presence on this list should be validated against prior versions to determine whether it represents a new or longstanding subprocessor engagement. (5) COMPLIANCE CONSIDERATIONS: Legal teams should request confirmation from Anthropic of the transfer mechanism in place for Nutun data flows, assess whether a Transfer Impact Assessment (TIA) is required under GDPR for South Africa as a destination country, and confirm that internal records of processing activities under GDPR Article 30 reflect this subprocessor relationship.
The use of a South Africa-based subprocessor for user support functions creates international data transfer obligations under GDPR Chapter V for EU and UK personal data, requiring either Standard Contractual Clauses, Binding Corporate Rules, or another recognized transfer mechanism. Enterprise customers with GDPR obligations should verify that Anthropic's DPA addresses this transfer adequately.
Under this provision, user support interactions for EU and UK residents may involve data processing by Nutun, a South Africa-based subprocessor. Users in the EU and UK should be aware that their support-related data may be processed in a jurisdiction without an EU adequacy decision, subject to whatever transfer mechanisms Anthropic has implemented.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Anthropic.