As of October 26, 2026, Claude Duet cannot be used in the EU, and Duet currently offers no route with a data processing agreement for client or staff data. Duet runs only as a research preview in the consumer plans Pro and Max, with an account in the US. Anthropic offers no data processing addendum (DPA) for these plans, Anthropic is the controller itself, and according to its privacy policy personal data is transferred to the US. On top of that, Duet reads every connected account every few hours, which means mostly other people's data. Whether there could still be a sound legal basis in your individual case is a question for your data protection officer. If you want an agent in your inbox today, use an AI employee on a business plan with a DPA, or an open model running locally or on servers in the EU.
This isn't legal advice, just the operator's perspective I use to run AI employees in my own business. I work in Germany, so I also cover German rules where they add something. I have not tested Duet, because it is not available here. Everything about Duet comes from Anthropic's own pages. What Duet does is covered in Claude Duet: What Anthropic's Agent Does.
Is Claude Duet available in the EU?
No. Anthropic's help center says: “Claude Duet is available in the US only during the research preview.” You need a Pro or Max plan, a Claude account in the US and an invitation from the waitlist. Team and Enterprise are not included yet and, according to the help center, are planned for later. Anthropic gives no date for the EU or for the business plans. Claude itself is available in Germany, but for Duet the US account is what counts. A workaround via such an account would solve nothing, because Duet would still be a consumer plan without a DPA.
Which contract applies: a consumer plan without a DPA
According to the help center, Duet uses your Claude account, its settings and the usage limits of your Pro or Max plan. So the rules of the consumer plans apply:
- No DPA: Anthropic offers its data processing addendum only for the commercial products such as Claude for Work and the API. There, it is automatically part of the Commercial Terms, including standard contractual clauses.
- A different role: On Team and Enterprise, your business is the controller and Anthropic the processor. On Pro and Max, Anthropic is the controller itself, for users in the EEA that is Anthropic Ireland, Limited.
Anthropic has not announced whether Duet on Team and Enterprise will later fall under the Commercial Terms with a DPA. The full overview of training, DPA and role by plan is in Claude Privacy and GDPR: What Applies.
The “Non-commercial use only” clause
The version of the consumer terms that Anthropic serves to consumers in the EEA and Switzerland (effective October 8, 2025) contains this sentence in the section on warranties and liability:
“Non-commercial use only. You agree that you will not use our Services for any commercial or business purposes and we and our Providers have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity.”
By its own text, this version applies to consumers resident in the EEA or Switzerland, meaning people “acting wholly or mainly outside your trade, business, craft or profession”. For Duet it does not matter today, because Duet only runs with a US account. Anthropic does, however, explicitly describe Duet as a tool “for professionals and small business owners”. Which terms apply if you use a Pro or Max account for your business, and what the clause then means, I am not interpreting. That is a question for your lawyer.
What Duet reads: inbox, calendar and other people's data
Duet is built to check things on its own. According to Anthropic, it checks your connected accounts “every few hours” and sends you a brief on your email and calendar every morning. Connections include Gmail, Slack, HubSpot and QuickBooks, and according to the announcement, through “over 6,000 connectors and plugins”, also payroll in Gusto.
A business inbox is mostly other people's data: clients, suppliers, applicants, staff. Anthropic's privacy policy is clear about this. Content from connected services becomes part of your inputs: “Claude may retrieve content and data from Third-Party Services you interact with. This data becomes part of your Inputs.” The responsibility for that is yours. You have to make sure you have “the necessary rights, permissions, or authority”.
Anthropic itself writes that Duet should handle other people's information “with discretion”, and gives an example: a weekly recap to the team should not include “performance review conversations”. That also shows what Duet gets to see. A new classifier checks what goes out. Duet is instructed never to share sign-in credentials, full card and bank account numbers or government ID numbers. It shares health or financial information only with your consent, and according to Anthropic your own request already counts as consent. Toward the person whose data it is, your request does not replace a legal basis. So the protection kicks in when something is sent: an email with a sick note has still been read, and the rule is only the second line of defense.
Training, memory and deletion
On Pro and Max, a switch in the privacy settings decides about training. The privacy policy says: “We may use your Inputs and Outputs to train and improve Anthropic AI models, unless you opt out through your account settings.” Even with the switch off, training remains possible if a conversation is flagged for safety review or if you send feedback.
For Duet this means: if the switch is on, other people's data from your inbox can end up in training too. Anthropic's privacy notice for people without an account explicitly lists user inputs and outputs as a training source, “where the user has opted into the use of inputs and outputs for model training”. The client whose email sits in your inbox is not asked.
Anthropic's general retention periods apply to consumer plans: deleted chats leave the back end within 30 days, with the training switch on data is kept de-identified for up to 5 years, and for up to 2 years if a chat is flagged as violating the usage policy. The details are in the article on Claude privacy.
Duet also has its own memory. It keeps its history and memory until you delete or reset them. If you disconnect an app, Anthropic says: “what Claude Duet already learned from it stays until you reset its memory”. Only deleting the account “wipes everything Claude Duet has stored”. Anthropic gives no retention periods for files, downloads and browser data on Duet's cloud computer. Anyone using Duet in a business would therefore have to plan the memory reset as a fixed deletion routine.
Where the data is processed
According to the help center, Duet works “on its own computer in the cloud”, and according to the security article its browser runs in its own virtual machine, “separate from the model”. Anthropic does not say where these machines are located. The privacy policy says in general that personal data is transferred “to our servers in the US, or to other countries outside the European Economic Area”, covered by adequacy decisions and standard contractual clauses.
Anthropic names no EU data residency for Duet. Even for the API, Anthropic's data residency docs only list “global” and “us” for processing, and only “us” for storage. If you want Claude to run in EU regions, today you go through Amazon Bedrock, described in Claude on AWS Bedrock: EU, GDPR and Cost. For businesses whose clients require EU processing by contract, Duet is therefore out.
Proactive means Duet reads along. What the GDPR asks
The GDPR applies as the regulation of April 27, 2016, published on May 4, 2016, with three corrigenda. The Digital Omnibus changes are proposed, not adopted. The household exemption does not help in a business, it only covers processing “in the course of a purely personal or household activity” (Art. 2(2)(c) GDPR). The following checks apply to any agent that looks into the inbox on its own, not only to Duet.
My assessment: the hard part is not the technology but the onward transfer. For reading your own business inbox, legitimate interest is conceivable, while passing the data to a provider without a DPA that may also use it itself is much harder to justify. That belongs with your data protection officer.
Staff and works councils
Duet sees team communication: Slack channels, emails from and about staff, calendars and, depending on the connection, payroll. German law adds the following checks, and similar questions come up in other countries.
- § 26 BDSG (German Federal Data Protection Act): You may process employee data insofar as it is necessary for the employment relationship. Since the CJEU ruling of 30 March 2023 on the comparable § 23 HDSIG, § 26(1) sentence 1 BDSG is contested. How I assessed this in another case is in Transcribing Calls: What German Law Says.
- § 87(1) no. 6 of the Works Constitution Act: If there is a works council, it has a say in the “introduction and use of technical equipment intended to monitor the conduct or performance of employees” (my translation). An agent that reads team communication and reports what needs attention is a point to check. What else a works council has a say in when it comes to AI is in Do I Need an AI Officer?.
- Business accounts: The DSK recommends that employers provide devices and accounts for the professional use of AI. Unless the application runs on your own servers, the accounts should not carry the names of individual employees, and the email address should be a functional address. Duet, by contrast, is tied to a Pro or Max account, and according to the help center access is tied to the email address you gave for the waitlist. In practice, that is one person's account.
What Anthropic builds in for protection
Being fair is part of this. Before sending, paying, signing or deleting, Duet waits for your approval, and a separate check runs “outside the model”. There were red teams, an external penetration test and a bug bounty program, and Anthropic itself writes that against manipulated content “no defense is perfect”. That counts toward the security of processing under Art. 32 GDPR, but it solves neither the missing contract nor the amount of data Duet reads. The approvals in detail are in Claude Duet: What Anthropic's Agent Does.
And OpenAI Dots?
OpenAI's counterpart to Duet is called Dots. According to OpenAI's docs, Dots on the Pro plans is only available “outside the European Economic Area, United Kingdom, and Switzerland”. For Business Premium and Enterprise, the docs say “Rolling out worldwide”. On Enterprise, Dots is off by default until a workspace admin enables it, and according to the docs OpenAI does not use Enterprise data for training by default. If you need data or inference residency, OpenAI says to confirm support for Dots with your account team first. I have not checked whether a DPA applies to Dots on Business Premium.
On memory, the two are similar. With Dots, too, disconnecting a connection only stops future access, “it doesn’t remove information the dot has retained”. The difference is the contract route: Dots is meant to reach the EU through business plans, as the docs say it is rolling out worldwide, with an admin switch on Enterprise. Duet currently exists only in US consumer plans. That is the state as of October 26, 2026 and can change quickly for both.
Duet or an AI employee: the comparison
An AI employee is a role with a fixed process: its own rules, its own knowledge, clearly separated access, and every task that leaves the house ends at an approval. The table puts Duet next to the two routes that exist in Germany today.
So the main difference is not “cloud or local” but contract and scope. An AI employee on a business plan with Anthropic also runs in the US. But it has a DPA, reads only its own process and leaves a log. If you also need the data to stay in the EU or in-house, use Bedrock with the EU profile or an open model for that role.
How an inbox agent and a bookkeeping agent split the work is shown in AI Agent for Bookkeeping and Inbox.
This is how I do it myself: my AI employees run on Claude Team, so under the Commercial Terms with a data processing addendum. Some also run on open models or via the API and Amazon Bedrock. I use my private plan only for my own writing, such as these blog posts.
AI employees with an open model: what that solves and what it doesn't
The German data protection conference distinguishes open and closed AI systems and writes that technically closed systems are preferable from a data protection perspective (“Technisch geschlossene Systeme sind daher aus datenschutzrechtlicher Sicht vorzugswürdig”). This is not about open source, but about whether processing runs in a closed environment under your control. An open model on your own hardware comes closest to that. No model provider receives your inputs, no third party trains on them, and the logs stay in-house. If a provider hosts the open model in a data center in the EU, it does run in the EU, but the provider is a service provider again. Then you need a DPA with them and check training and retention in the contract.
What an open model does not solve are the other obligations. Access control, retention periods, informing the people concerned, the works council where staff are involved, and the question of which data the agent may read at all stay exactly the same. That is covered in detail in Local AI and Privacy: Cloud or Server?.
In my setup, individual roles run locally with Pi against Qwen 3.8, and the team runs with approval gates on Claude. Pi has no approval system, so the gate sits outside the tool. How that is built is in Running AI Agents Locally: What Works. Which open models exist and under which licenses is covered in Open Source AI Models 2026 Compared.
Frequently asked questions
Is Claude Duet GDPR compliant?
What gets assessed is always the processing in your business, not the tool. But Duet currently lacks the basis you need for client and staff data: it only runs on Pro and Max without a DPA, Anthropic is the controller itself there, and Duet is not available in the EU at all. For your individual case, ask your data protection officer.
Will Claude Duet come to Team and Enterprise with a DPA?
Anthropic says Duet is planned for Team and Enterprise later, without a date. Whether the Commercial Terms with a DPA will apply then has not been announced.
Do I need a data protection impact assessment for an AI agent in the inbox?
Often, yes. The DSK writes that an assessment is required “in many cases” when AI applications are used. Its mandatory list includes AI that steers interaction with the people concerned or evaluates personal aspects. Whether your agent falls under it depends on how you use it.
May an AI agent read my employees' emails?
Only on a sound legal basis, and that is narrow here. In Germany, § 26 BDSG has been contested since the CJEU ruling of 30 March 2023, and if there is a works council, § 87(1) no. 6 of the Works Constitution Act is a point to check. The DSK recommends business devices and accounts instead of private ones. Have this checked professionally before the agent starts.
Is there an alternative to Claude Duet in Europe?
According to OpenAI's docs, Dots is rolling out worldwide on Business Premium and Enterprise, while the Pro plans exclude the EEA. Whether a DPA applies there and whether Dots meets your data residency requirements is something to clarify with OpenAI before using it. The other route is an AI employee for the inbox, on a business plan with a DPA, via Bedrock in EU regions or with an open model run locally. What such a role looks like is in AI Email Triage: Agent or Tool?.
Where to go from here
If you want an agent in your inbox without waiting for Duet: start with one role for a single inbox, on a business plan with a DPA, that prepares drafts and sends nothing on its own. Decide beforehand which folders it may read and when its memory is deleted. Which data it should see at all, you check with the three questions from AI and Privacy: What the AI Gets to See. How I set up such roles for other businesses is on my page AI Employees.
