Is Google Gemini GDPR compliant?

Google Gemini for Workspace is GDPR compliant when used on a paid Workspace subscription (Business, Enterprise, or Education tiers). Google provides a Data Processing Amendment (DPA) as part of the Workspace agreement. Gemini processes data under the same DPA as other Workspace services. Consumer Gmail with Gemini enabled does not include GDPR-compliant data processing terms. You must be on a paid Workspace plan and have the DPA in effect.

Does Google Gemini train on your data?

For Workspace customers on paid plans, Google does not use your prompts or Gemini outputs to train its models by default. The Workspace DPA covers Gemini features as a core service. For the Gemini API via Google AI Studio, training behavior depends on whether you have opted out via the API terms. Gemini Advanced (personal) uses different terms and should not be used for work data containing personal information.

What SOC 2 controls apply when using Google Gemini?

Using Gemini triggers SOC 2 requirements under CC9.1 (vendor management, Gemini must be in your vendor inventory), CC6 (access controls, who can use Gemini and with what data), and CC1 (acceptable use policy, you need a written policy covering Gemini use). If Gemini processes customer personal data, your auditor will trace that data flow and require evidence of DPA and risk assessment.

Where does Google Gemini store data?

For Workspace customers, Gemini data residency follows your Workspace data region settings. If you have a US or EU data region configured, Gemini for Workspace respects that. For the Gemini API, data is processed in Google's US infrastructure by default. EU-based Workspace customers can configure data residency via the Admin console for supported services.

Do I need a DPA with Google for Gemini?

Yes, if Gemini processes personal data of EU residents (GDPR) or if your SOC 2 scope includes vendor management for AI tools. Google's Workspace Data Processing Amendment covers Gemini as a Workspace service for paid subscribers. For the Gemini API used outside of Workspace, the Google APIs Terms of Service and the API-specific data processing terms apply. Review which agreement covers your specific Gemini usage.

Google Gemini GDPR and SOC 2 compliance: what you need to know

Google Gemini is now embedded across the Google Workspace suite, Docs, Gmail, Meet, Drive, Sheets, and available as a standalone API for developers. If your company uses Google Workspace, your employees are almost certainly using Gemini features, whether you have formally approved that use or not.

Google Gemini may retain prompts for 90 days: check admin settings before your audit

This guide covers what GDPR and SOC 2 actually require when your organization uses Google Gemini, and what the compliance differences are between Gemini for Workspace and the Gemini API.

The three versions of Gemini you need to know

Not all Gemini access is the same from a compliance standpoint. The three main surfaces have different data processing terms:

Gemini for Workspace: Embedded features in Gmail, Docs, Meet, Slides, Drive, and other Workspace apps. For paid Workspace subscribers (Business Starter and above), these features are covered by the Google Workspace Data Processing Amendment. This is the version most organizations should be using for work data.

Gemini API (via Google AI Studio): Direct API access to Gemini models for developers. Governed by the Google APIs Terms of Service and the Gemini API Additional Terms of Service. Data handling is different from Workspace, review these terms carefully if you use the API with customer data.

Gemini Advanced (personal): Consumer subscription bundled with Google One. Uses consumer terms. Not appropriate for work data containing personal information. Should be blocked from use on managed devices if your employees might use it for work.

The compliance answer for any question about Gemini depends heavily on which version you are using.

GDPR requirements for Google Gemini

Data Processing Agreement

Under GDPR Article 28, any tool that processes personal data on your behalf requires a written DPA before processing begins. For Gemini for Workspace, the Google Workspace Data Processing Amendment serves as your DPA. You do not need to negotiate a separate agreement, it is incorporated into the paid Workspace terms.

For the Gemini API, the applicable data processing terms are the Google APIs Terms of Service combined with any API-specific addenda. If you are using the Gemini API to process personal data of EU residents, verify that these terms include GDPR-compliant processing commitments and Standard Contractual Clauses for data transfer.

For Gemini Advanced (personal): no GDPR-compliant DPA is available. This version should not be used for personal data.

Training opt-out

For Workspace customers, Google does not use data from paid Workspace services to train its models by default. This applies to Gemini for Workspace as a covered service. You do not need to take additional steps to opt out.

For the Gemini API, check the current API terms. Google has changed default training behavior for the API multiple times. Verify the current status and confirm you are not on a tier or configuration that enables training on your prompts.

Data residency

Workspace customers who have configured data regions (EU, US, or global) have those regions honored for covered services. Gemini for Workspace respects your Workspace data region configuration for supported data at rest. Data in transit and some processing may occur outside your configured region even with data residency enabled.

If EU data residency is a requirement, for example, due to a data processing agreement with your own customers, or national data sovereignty requirements, verify the current state of Gemini's data residency support in the Workspace Admin console.

EU AI Act considerations

Gemini is a general-purpose AI system. Under the EU AI Act, Google as the provider of a general-purpose AI system has obligations that apply to them, not to you as a user. However, if you integrate Gemini API into your own product and deploy it for high-risk use cases (healthcare decisions, HR, credit scoring, etc.), your obligations as a deployer apply. For internal productivity use, Gemini falls into limited-risk categories and your obligations are primarily documentation.

SOC 2 requirements for Google Gemini

CC9.1, Vendor management

Gemini belongs in your vendor inventory alongside AWS, GitHub, Okta, and your other service providers. The entry should include:

Service: Google Gemini for Workspace / Gemini API
Data accessed: specify what data types flow to Gemini (email content, documents, code, customer data, etc.)
Risk tier: typically High if customer personal data is involved, Medium if internal data only
DPA: Google Workspace Data Processing Amendment (for Workspace), API terms (for API)
Security documentation: Google's SOC 2 report and ISO 27001 certificate are publicly available
Review cadence: annual

CC6, Logical access controls

Your access controls for Gemini include:

Who has Gemini features enabled in your Workspace admin console
Whether Gemini is available to contractors and temporary staff
Whether employees can connect personal Google accounts with Gemini features on managed devices
Whether Gemini for Workspace features are enabled for specific org units or globally

For SOC 2, auditors will ask whether you have reviewed and configured Gemini access appropriately. Blanket enablement for all users without a policy review is a finding waiting to happen.

CC1, Acceptable use policy

You need a written policy that covers Gemini specifically or AI tools generally. At minimum, the policy should address:

Which Gemini products and tiers are approved for use
What data classifications are permitted in Gemini prompts (public, internal, confidential, restricted)
Whether employees may use personal Gemini Advanced for work purposes
Consequences for policy violations

Auditors regularly ask to see AI tool policies in 2026. If yours does not mention AI tools at all, that is a gap.

Configuring Gemini for Workspace compliance

Key admin settings to review:

Gemini for Workspace features: In the Admin console under Apps → Google Workspace → Gemini for Workspace, review which features are enabled and for which org units. Consider whether all features are appropriate for all users.

Data processing settings: Review your Workspace data processing configuration under Admin console → Account → Legal → Data Processing Amendment. Confirm the DPA is active.

Data regions: If you have EU data residency requirements, verify your data region policy under Admin console → Account → Data regions.

Supplemental AI terms: Some Gemini features require accepting supplemental terms. Review what additional agreements are in effect for your organization.

Gemini API compliance checklist

Tip

If you are using the Gemini API in your product:

Review current Google AI API Terms of Service for data processing commitments
Verify training opt-out status for your API usage
Add Google as a vendor in your vendor inventory for API data processing
Implement per-customer rate limiting to prevent runaway API costs
Strip PII from prompts before sending to the API if your prompts may contain personal data
Log API calls to your audit log (model used, token count, timestamp, not raw prompts)
Document your AI system under EU AI Act obligations if applicable to your use case

Getting Google Gemini audit-ready comes down to mapping its data flows to your SOC 2 and GDPR controls, confirming Google's DPA and sub-processors, and keeping that evidence current as the service changes. If you would rather a security leader owned that work than track it in a spreadsheet, book a call.

Want a security leader to run this?

Xorabyte is a fractional CISO for startups who can review your cloud for the gaps found first, so a blocked deal or an audit stops being your problem to carry alone. Book a call and you will leave with a clear path, not a sales pitch.