GDPR check

Is Google Gemini GDPR compliant? What universities should check

Gemini reaches universities through two doors: the consumer Gemini app on personal Google accounts, and Gemini inside Google Workspace for Education. The data protection terms behind those doors are very different. This page sets out what Google publicly documents for each and what a DPO should check.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Gemini is made by Google. In the EEA, the consumer Gemini app is provided by Google Ireland Limited, while Workspace for Education agreements in most of Europe are with Google Cloud EMEA Limited, also in Dublin (France, Italy and Poland have local Google Cloud entities). With a personal account, chats can be used to train models and some are read by human reviewers unless the user turns off Keep Activity. With a Workspace or Workspace for Education account, Gemini is covered by the Cloud Data Processing Addendum, is not used for training or human review without permission, and on supported editions can be kept in Europe through data regions. Whether a university can use Gemini depends on which account type people use, which Workspace edition the university holds, how admins set retention, age and data region policies, and what personal data goes into prompts.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers an AI assistant for research work with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Google Gemini documents publicly

Everything below comes from Google's own help centres, terms pages and the official Data Privacy Framework List, all read on 7 October 2026. "Workspace" includes Google Workspace for Education unless stated otherwise.

Topic	What the vendor states	Source
Company and establishment	Documented Consumer Gemini Apps are provided by Google Ireland Limited in the EEA and Switzerland and by Google LLC elsewhere. For agreements covering Google Workspace and Workspace for Education, the Google contracting entity for customers billed in EMEA is Google Cloud EMEA Limited (Dublin), except France, Italy and Poland, which have local Google Cloud entities.	[2], [5]
Where data is stored and processed	Plan-dependent Workspace data regions can keep covered data in the United States or Europe. Prompts and responses in the Gemini app and in Google Workspace with Gemini are covered both at rest and during processing, although processing coverage varies by edition. Data regions for Education are available on Education Standard and Education Plus but not on Education Fundamentals. Gemini Notebook data is not subject to the organisation's data region settings.	[1], [4]
Data processing agreement	Plan-dependent Workspace: prompts are customer data under the Cloud Data Processing Addendum (CDPA), and the Gemini app is a core Workspace service subject to the organisation's Workspace agreement. Personal accounts: governed by Google's consumer terms and the Gemini Apps Privacy Notice, not a DPA with the institution.	[1], [2], [6]
Subprocessors	Documented A public Workspace subprocessor page (last modified 23 July 2026) lists Google affiliates and third parties. The third parties listed first, such as Accenture, Cognizant and EPAM, provide customer-initiated technical support from countries including India, the Philippines, Israel and the United States; Google says they only access customer data if the customer grants access in a support case.	[7]
International transfers	Documented The CDPA provides for Standard Contractual Clauses or an "Alternative Transfer Solution" for restricted transfers. Google LLC appears as active on the official Data Privacy Framework List.	[6], [8]
AI model training on customer content	Plan-dependent Workspace: customer data is not used to train or fine-tune the models supporting Workspace generative AI services without the customer's prior permission or instruction, and chats and files are not reviewed by humans for model improvement. Personal accounts: with Keep Activity on, activity is used to improve services including training generative AI models, and a subset of chats is reviewed by humans. Temporary chats and chats with Keep Activity off are kept for 72 hours and not used for training unless the user sends feedback.	[1], [2]
Retention and deletion	Documented Workspace: admins choose whether Gemini app conversations are saved and can auto-delete after 3, 18 or 36 months (default 18); Gemini in Workspace apps supports set periods or indefinite retention. Under the CDPA, deletions are completed within a maximum of 180 days. Personal accounts: default auto-delete of 18 months; chats reviewed by humans are kept for up to three years, disconnected from the account.	[1], [2], [6]
Security certifications	Documented Google lists SOC 1/2/3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018 and 42001 for Gemini, plus FedRAMP High. Gemini Notebook and Gemini in Chrome do not yet support these ISO and SOC certifications, according to the same page.	[1]
Institution and enterprise controls	Documented Admins can turn the Gemini app and Gemini features on or off, access audit logs, and rely on existing Workspace permissions, DLP, Information Rights Management and client-side encryption. Education Fundamentals (no cost) includes Gemini for Education and Gemini Notebook; Education Plus adds Gemini in Docs, Sheets, Gmail and other apps. Google has published a DPIA support guide for Gemini.	[1], [3]

What this means for a university

Validemic's analysis

The account type is the first question. The same gemini.google.com address serves both a consumer product and a Workspace service. On a personal Google account, Google acts under its consumer privacy notice, may use chats for training and human review, and the university has no contract covering the processing [2]. On a university Workspace account, Gemini is processed under the CDPA and Google commits not to train on the data or review it without permission [1]. University guidance should tell staff and students to use Gemini only while signed in with their university account.

Credit where it is due. For Workspace customers, Google's documentation is unusually complete: a single privacy hub covers training, human review, retention, certifications and the EU AI Act, Gemini is included in the CDPA, and Google has published a DPIA support guide for public sector and education customers [1]. The Education Fundamentals edition includes Gemini for Education at no cost with what Google calls enterprise-grade data protection [3]. Article 28 GDPR requires a contract with any processor [9], and here the contract is the Workspace agreement many universities already have.

Data location depends on the edition. Data regions can keep Gemini prompts and responses in Europe at rest and in processing, but only on editions that include data regions, and Education Fundamentals is not one of them [4]. A university on Fundamentals should assume Gemini data may be processed outside Europe, under the CDPA's transfer terms [6]. Gemini Notebook copies uploaded Drive files into its own storage, where data region settings do not apply [1]. That matters for researchers who upload interview transcripts or datasets.

Personal data and DPIAs. Prompts in academic use often contain student work, names, emails and research material. With Workspace Intelligence, Gemini can also draw context from Gmail, Drive, Calendar and Chat for the user [1]. Article 35 GDPR requires a DPIA where processing using new technologies is likely to result in a high risk [9]. A campus-wide rollout that reaches students and research data is the kind of processing many DPOs will want to assess before launch.

Students of every age. Google states that with added data protection turned on, Workspace for Education users of any age can use the Gemini app, with some features restricted by default for users designated as under 18 [1]. The university should make sure age groups are set correctly in the Admin console and decide whether younger users get access at all. Article 8 GDPR sets 16 as the default age for consent to information society services where consent is relied on, with Member States able to lower it to 13 [9].

Transfers. Google LLC is listed as an active DPF participant [8], and the European Commission recognises the United States as adequate for organisations in the EU-US Data Privacy Framework [10]. The subprocessor page shows support personnel in several non-EU countries, although Google says they only see customer data when a customer grants access in a support case [7].

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Google before approving it

Which Workspace for Education edition do we hold, and does it include data regions that cover Gemini prompts and responses during processing as well as at rest?
If we stay on Education Fundamentals, where will Gemini prompts and responses be processed and stored?
Can we prevent users from using the consumer Gemini app with personal accounts on university-managed devices and browsers?
Which retention setting will we apply to Gemini conversations, and can it differ between staff and student organisational units?
Which Gemini features are outside the CDPA or data regions (for example third-party apps in Gemini, Gemini in Chrome, Gemini Notebook), and how do we control them?
Can we receive the Gemini DPIA support guide and the ISO/IEC 27001, 27701 and 42001 certificates covering our edition?
How are under-18 users identified, and which features are restricted for them by default?
How will Google notify us of new subprocessors and of changes to the models behind Gemini?

The EU AI Act angle

Regulation (EU) 2024/1689, the AI Act, has applied in stages [11]. Article 4 on AI literacy has applied to deployers since 2 February 2025. The Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, replaced Article 4: providers and deployers must take measures to support the AI literacy of their staff, without guaranteeing a specific level for any individual [12], [13]. A university that enables Gemini is a deployer and should train and guide its users.

General use for writing, summarising and search is normally not high-risk. It becomes high-risk if the university uses Gemini for the purposes in Annex III point 3: admission, evaluating learning outcomes, assessing the appropriate level of education, or monitoring students during tests [11]. After the Omnibus, the Annex III high-risk rules apply from 2 December 2027 [12], [13]. Chapter V obligations for general-purpose AI models have applied since 2 August 2025 and sit with Google as model provider [11]. Google appears on the European Commission's list of signatories of the General-Purpose AI Code of Practice [14].

Sources

Google Workspace Help, Generative AI in Google Workspace Privacy Hub, retrieved 7 October 2026.
Gemini Apps Help, Gemini Apps Privacy Hub, retrieved 7 October 2026.
Google for Education, Compare Editions, retrieved 7 October 2026.
Google Workspace Help, Data covered by data regions, retrieved 7 October 2026.
Google Cloud, Google Contracting Entity, retrieved 7 October 2026.
Google Cloud, Cloud Data Processing Addendum (data deletion and transfer terms), retrieved 7 October 2026.
Google Workspace, Subprocessors (last modified 23 July 2026), retrieved 7 October 2026.
U.S. Department of Commerce, Data Privacy Framework List (entry for Google LLC), retrieved 7 October 2026.
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 8, 28 and 35, retrieved 7 October 2026.
European Commission, Data protection adequacy for non-EU countries, retrieved 7 October 2026.
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal L, 12 July 2024, Articles 4 and 113 and Annex III, retrieved 7 October 2026.
Regulation (EU) 2026/1744 (Digital Omnibus on AI), Official Journal L, 24 July 2026, retrieved 7 October 2026.
European Commission, AI Act (application timeline), retrieved 7 October 2026.
European Commission, The General-Purpose AI Code of Practice (signatories), retrieved 7 October 2026.

About this page

We read Google's public Workspace and Gemini help pages, the Cloud Data Processing Addendum, the Google contracting entity table, the Workspace subprocessor page, the official Data Privacy Framework List and the EU legal texts on 7 October 2026. We did not test a Workspace tenant or review any institution's agreement, and features differ between editions and regions. Check the linked pages before relying on them. This page is not legal advice and is not a verdict on whether any organisation's use of Gemini complies with the GDPR. If you work at Google or spot an error, please contact us and we will correct it.

Frequently asked questions

Does Gemini train on my data?

With a personal Google account, Google says it uses Gemini activity to improve its services, including training generative AI models, while the Keep Activity setting is on, and some chats are read by human reviewers. With a Google Workspace or Workspace for Education account, Google says prompts and content are not used to train generative AI models or reviewed by humans without the customer's permission (checked 7 October 2026).

Where does Gemini store data?

For Workspace customers on supported editions, Google's data regions feature can keep Gemini app and Gemini in Workspace prompts and responses in Europe, at rest and during processing. Data regions for Education are available on Education Standard and Education Plus, not on the free Education Fundamentals edition. Gemini Notebook data is not covered by data region settings.

Does Google sign a DPA for Gemini?

For Workspace and Workspace for Education, Google says Gemini prompts are customer data under the Cloud Data Processing Addendum, which applies as part of the Workspace agreement. Personal Gemini app use is governed by Google's consumer terms and the Gemini Apps Privacy Notice instead.

Can students use Gemini under GDPR?

Google says that if a Workspace for Education admin turns on Gemini with added data protection, users of any age can access the Gemini app, with some features restricted by default for users marked as under 18. The university remains the controller and should decide which users get access, set retention and assess the processing.

Is NotebookLM covered by the same terms?

Google now calls it Gemini Notebook and describes it as a core Workspace service covered by the Cloud Data Processing Addendum. Google also states that Gemini Notebook does not yet support its ISO or SOC compliance and that organisational data region settings do not apply to it.