Is Gemini GDPR Compliant? Workspace, the Gemini App and the API Compared

An account manager in Rotterdam has a client spreadsheet open: forty names, phone numbers and contract values. He wants a summary of which renewals are at risk and asks Gemini. On his work Google account, that request falls under his company's Workspace contract. On his personal Gmail account in the next browser tab, the same request falls under Google's consumer terms, where a sample of chats is read by human reviewers.

Same model family, same interface, very different GDPR position. That's the whole story of Gemini and GDPR, so it's worth getting the details right.

Is Gemini GDPR compliant?

No AI product is compliant by itself. GDPR applies to processing, and when staff use Gemini for work, your company is normally the controller. What changes between Gemini products is Google's role. In Google Workspace, Google processes Gemini prompts as your processor under the Cloud Data Processing Addendum. In the consumer Gemini app, Google is a separate controller dealing with the individual user. On the Gemini API, the answer depends on whether you use paid services, with a special rule for Europe.

Which Gemini are your staff actually using?

Gemini in Google Workspace

Google's Generative AI in Google Workspace Privacy Hub says that Workspace doesn't use customer data to train models without the customer's prior permission or instruction, that prompts count as customer data under the Cloud Data Processing Addendum, and that chats and uploaded files in the Gemini app on a work account aren't reviewed by human reviewers. The Gemini app is now a core Workspace service for most editions, so it sits under the same agreement as Gmail and Drive.

On location, Google announced in June 2025 that Gemini features in Workspace follow data region settings, and in June 2026 extended this to the Gemini app, with in-region processing and storage on Enterprise Plus and Frontline Plus. If EU processing matters to you, check which edition you're on before assuming it applies.

The consumer Gemini app

Google's Gemini Apps Privacy Hub is open about the trade-off. A subset of chats is reviewed by human reviewers, including trained service providers, after being disconnected from the account. Chats that have been reviewed are kept for up to three years, even if the user deletes their activity. With the Keep Activity setting off, or in a temporary chat, conversations are still kept for 72 hours to respond and protect the service, but aren't used to improve Google's AI. Google's own advice is not to enter information you wouldn't want a reviewer to see.

The Gemini API

The Gemini API terms split unpaid and paid services. On unpaid services, Google may use content to improve its products and human reviewers may read it. On paid services, prompts and responses aren't used to improve Google's products and are processed under Google's data processing addendum. There's a rule specifically for Europe: apps made available to users in the EEA, Switzerland or the UK must use paid services, and the paid-service data terms apply to all services, including Google AI Studio and the unpaid quota, for those users.

Have regulators looked at Gemini?

Google's EU lead authority is the Irish Data Protection Commission. In September 2024 the DPC opened a cross-border inquiry into whether Google should have carried out a DPIA under Article 35 before processing EU personal data to develop its PaLM 2 model. As with the ChatGPT cases, that concerns Google as the controller of its training data. It doesn't decide whether your use of Gemini is lawful. We haven't found a published outcome as of October 2026.

What does GDPR ask of you when staff use Gemini?

1. A lawful basis (Art. 6) for each use involving personal data, plus an Art. 9 condition for special categories such as health or union membership.
2. A processor agreement (Art. 28). Workspace and paid API use are covered by Google's processing terms. A personal Google account isn't, and no admin setting can change that.
3. A transfer assessment (Chapter V). Check which mechanism Google's processing terms use for your contract, such as standard contractual clauses or the EU-US Data Privacy Framework. Workspace data regions can reduce what leaves the EU, depending on edition.
4. Data minimization (Art. 5(1)(c)). A renewal-risk summary needs contract values and dates, not forty phone numbers.
5. Transparency and records (Art. 13, 14 and 30). Say in your notices and records that Gemini processes customer or employee data, if it does.
6. A DPIA (Art. 35) for high-risk uses, such as Gemini reading HR files or large mailboxes in Workspace.

How do you set up Gemini for GDPR?

• Use Gemini through Workspace for work. Make sure staff sign in with their work account, and review Gemini settings and conversation retention in the admin console.
• Check your data region settings and edition if EU processing is a requirement, and decide whether to allow features that process data across regions.
• For API projects, use paid services and make sure every key in use belongs to a billed project, especially for anything that serves EU users.
• Mask before it leaves. In applications, point the Gemini SDK at the Maskflare gateway (/v1/gemini) so personal data and secrets become tokens before the request reaches Google and come back in the answer.
• Cover the browser. Browser protection and the desktop agent mask text typed into Gemini on the web, which matters most for the personal-account tab you can't otherwise control.

In the Rotterdam example, the masked prompt still gives Gemini the contract values and renewal dates it needs, but each name and phone number arrives as a token. The summary comes back with the real names restored for the account manager. Google never receives the contact list, on either account.

Where masking stops helping

• Gemini inside Workspace apps reads documents and mail that already sit in Google's systems. Masking a prompt doesn't change what Gemini can see in your Drive; your Workspace permissions and settings do.
• Pseudonymized data is still personal data for your company (Recital 26), so lawful basis and records still apply.
• Images and audio: Maskflare masks text. Image uploads in the browser can be allowed, blocked or scanned by policy; audio isn't masked.
• Context can identify people even without a name, which no detector can fully judge.

What about the EU AI Act?

The EU AI Act doesn't replace GDPR. As a deployer of Gemini, your main duties are AI literacy for staff (Article 4, applying since February 2025) and transparency where people interact with an AI system you put in front of them. Google carries the general-purpose model provider obligations, in force since August 2025. Uses such as screening job applicants with AI may be high-risk under the Act; get legal advice before you build them.

This article is general information, not legal advice. Facts are as of October 2026; check Google's current terms before relying on them.