GDPR check

Is Google Workspace GDPR compliant? What universities should check

Google Workspace for Education is free at the entry level and widely used in teaching, which is exactly why European regulators have looked at it closely. This page sets out what Google documents for Workspace for Education, what the Dutch and Danish authorities and SURF concluded, and the settings a university should check.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Google Workspace for Education comes with a processor agreement (the Cloud Data Processing Addendum), ISO 27001 and SOC 2 commitments, 30 days' notice of new subprocessors and EU data regions on paid editions. Google also offers education customers an optional addendum that makes the institution controller of Service Data. The history matters: a 2021 DPIA by SURF, SIVON and SLM Rijk found eight high risks, which the Dutch government said in 2023 had been resolved, while the Danish regulator has repeatedly criticised municipalities' use of Google products in schools. Whether a university can use Workspace lawfully depends on its edition, accepted addenda and admin settings.

What Google documents publicly

Everything in this table comes from Google's own pages, read on 7 October 2026. It covers Google Workspace for Education used through an institutional domain, not personal Google accounts. Numbers in brackets refer to the sources at the end.

TopicWhat the vendor statesSource
Editions Documented Google's comparison page offers Education Fundamentals at no cost for qualifying institutions and Education Plus as a paid edition, with Google AI Pro for Education and Teaching and Learning as add-ons. The data regions and Service Data help pages also refer to Education Standard. [4], [3], [6]
Data processing agreement Documented The Workspace for Education Terms (last modified 7 October 2025) incorporate the Cloud Data Processing Addendum (last modified 8 June 2026), which takes precedence over the main agreement. Additional Products are governed by their own terms, can be switched on or off in the Admin console, and require parental consent for users under 18. [1], [2]
Service Data Addendum available Account details, settings, usage and error logs and support communications are Service Data, with Google Cloud EMEA Limited as controller. Most Service Data is kept for up to 180 days, longer for security, legal and financial purposes. An optional Service Data Addendum for Education Fundamentals, Standard and Plus lets the institution become controller of Service Data with Google as processor, except for limited Service Data processing Google continues to perform as controller. [5], [6]
Where data is stored Edition-dependent Data regions (United States, Europe or no preference) are supported on Education Standard and Education Plus. A setting to process data in the selected region is listed only for Frontline Plus, Enterprise Plus and Enterprise Essentials Plus. [3]
Subprocessors Documented Google gives at least 30 days' notice before a new subprocessor starts processing customer data, with an opportunity to object. [2]
International transfers Documented The DPA uses the Standard Contractual Clauses where no adequacy decision applies. Google states that Google LLC and its US subsidiaries are certified under the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF. The official DPF List search service returned errors on the check date, so we rely on Google's statement. [2], [8]
Retention and deletion Documented Deleted customer data is removed within a maximum of 180 days; at the end of the term there is a recovery period of up to 30 days, then deletion within 180 days. [2]
Gemini and AI training Documented The Gemini app and Gemini Notebook are core Workspace services under the Workspace agreement and the DPA. Content is "not human reviewed or otherwise used for Generative AI model training outside your domain without permission". Some Gemini app features are restricted by default for users designated under 18. File sharing and data region settings do not apply to Gemini Notebook data. [7]
Security certifications Documented The DPA commits Google to maintain ISO 27001 certification and annual SOC 2 and SOC 3 reports for the audited services. [2]

Google deserves credit for documenting generally available options: a Service Data Addendum open to all education editions, a 30-day subprocessor notice, and a Gemini privacy hub that states plainly which settings do not apply to which AI product.

What regulators and sector bodies have said

Netherlands. In 2021 SURF (for universities and vocational colleges), SIVON (for schools) and SLM Rijk carried out a DPIA on Google Workspace for Education. On 31 May 2021 the Autoriteit Persoonsgegevens advised that use in education should not continue if the risks could not be reduced [9]. On 5 July 2023 the Minister of Education told parliament that the eight high risks found in 2021 had been addressed, that the government's lawyer agreed with that conclusion, and that five new findings would be handled in a continuing process with Google [10]. SURF and SIVON concluded that institutions could continue to use Workspace, subject to accepting the amended agreement, applying recommended settings and carrying out a local DPIA [11]. The AP said it expected the new findings and the data transfer impact assessment to be resolved promptly [9], [10].

The same letter reported a parallel DPIA on the Chrome browser and ChromeOS on managed devices. Its findings had been resolved, a new browser version with the fixes was due in August 2023, and SIVON and SURF would tell institutions how to use this processor version of Chrome and ChromeOS [10]. Universities that manage Chromebooks or Chrome for staff should treat the browser as part of the same assessment.

Denmark. The Chromebook case concerns municipalities and public schools rather than universities, but the issues overlap. On 30 January 2024 Datatilsynet found no legal basis for passing pupils' data to Google for purposes such as maintaining and improving Workspace for Education, and ordered 53 municipalities to bring processing into line by 1 August 2024 [12]. On 29 January 2026 it expressed serious criticism of 51 municipalities over how they had handled Google's chain of subprocessors, including subprocessors outside the EU. It also warned them that processing would likely breach the GDPR if their setup was not configured to the requirements specified by KL, or if further processing in a third country could not be given an essentially equivalent level of protection [13].

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

What this means for a university

Validemic's analysis

The Dutch outcome came with conditions. SURF's conclusion depends on the institution accepting the amended terms and applying the settings [11]. A university outside the Netherlands that has not done the same should not assume the 2023 position applies to its tenant. The Service Data Addendum [6] is the clearest example: unless it is accepted, Google remains controller of Service Data under the Cloud Privacy Notice [5].

Purpose limitation is the recurring theme. The 2021 Dutch DPIA found Google insufficiently transparent about what data it collects and what it does with it [10], and the Danish 2024 decision turned on passing pupils' data to Google for its own purposes [12]. Article 5(1)(b) and Article 28 GDPR require the institution to know and control those purposes [15]. Check which purposes remain with Google as controller after the addendum, and document them.

EU storage costs money. Data regions are not listed for Education Fundamentals [3], and the setting to keep processing in the selected region is not listed for any education edition. If a research project requires EU storage, confirm the edition and the data region policy for the relevant organisational unit.

Additional Products need their own decision. YouTube, Maps and other Additional Products fall outside the DPA and need parental consent for under-18 users [1]. Universities usually have few minors, but many have some, and staff often turn these services on by habit.

Gemini is on by default as a core service. Google says access to the Gemini app is turned on by default; it and Gemini Notebook sit under the DPA, which is a strength, but admins should note that data region settings do not apply to Gemini Notebook [7]. See our pages on Gemini, NotebookLM and Google Forms.

Personal accounts are a different service. Everything above applies to the institutional domain. Staff and students who create files or forms in a personal Google account are outside the Workspace agreement and the DPA, so guidance should tell them to use their university account for teaching and research data.

Transfers. Google relies on the SCCs and on its DPF certification [2], [8]; the European Commission lists the United States as adequate for DPF participants [14]. The Danish 2026 decision is a reminder to map subprocessor countries, not only the main provider [13].

Questions to ask before approving Google Workspace

  1. Which edition do we have, and does it support data regions for the organisational units holding research or student data?
  2. Have we accepted the Service Data Addendum, and which processing remains with Google as controller?
  3. Which Additional Products are switched on, for whom, and how do we handle users under 18?
  4. Are Gemini and Gemini Notebook enabled, and does our DPIA cover data that falls outside our data region settings?
  5. Which subprocessors and countries are involved in support and operations, and how do we receive the 30-day notices?
  6. Have we applied the admin settings recommended by SURF and SIVON, or an equivalent national baseline?
  7. How do we delete accounts and Drive content of students who leave, given the 180-day deletion window?
  8. Can we obtain the current ISO 27001 certificate and SOC 2 report for our own records?

The EU AI Act angle

A university that enables Gemini in Workspace is a deployer under Regulation (EU) 2024/1689 [16]. Article 4 on AI literacy has applied since 2 February 2025; the Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, reworded it as a duty to take measures to support staff AI literacy [17]. Drafting and summarising are not Annex III high-risk uses. Using Gemini or Classroom features to evaluate learning outcomes or steer admissions could be, and those Annex III rules apply from 2 December 2027 under the Omnibus [16], [17].

Sources

  1. Google Workspace for Education Terms of Service (last modified 7 October 2025), retrieved 7 October 2026.
  2. Cloud Data Processing Addendum (Customers) (last modified 8 June 2026), retrieved 7 October 2026.
  3. Choose a geographic location for your data, Google Workspace Admin Help, retrieved 7 October 2026.
  4. Compare Google Workspace for Education editions, retrieved 7 October 2026.
  5. Google Cloud Privacy Notice (effective 28 September 2026), retrieved 7 October 2026.
  6. Optional Service Data Addendum for Google Workspace for Education, Admin Help, retrieved 7 October 2026.
  7. Generative AI in Google Workspace Privacy Hub, retrieved 7 October 2026.
  8. Data transfer frameworks, Google Privacy & Terms, retrieved 7 October 2026.
  9. Autoriteit Persoonsgegevens, Advies AP Google-producten in het onderwijs, retrieved 7 October 2026.
  10. Ministry of Education, Culture and Science, Kamerbrief resultaten DPIA op Google Workspace for Education en Chromebooks (5 July 2023), retrieved 7 October 2026.
  11. SURF, Google Workspace (vendor compliance), retrieved 7 October 2026.
  12. Datatilsynet, Datatilsynet giver påbud i Chromebook-sag (30 January 2024), retrieved 7 October 2026.
  13. Datatilsynet, Datatilsynet giver 51 kommuner alvorlig kritik i Chromebook-sag (29 January 2026), retrieved 7 October 2026.
  14. European Commission, Adequacy decisions, retrieved 7 October 2026.
  15. Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 5 and 28, retrieved 7 October 2026.
  16. Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 4 and Annex III, retrieved 7 October 2026.
  17. Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026.

About this page

We read Google's Workspace for Education terms, the Cloud Data Processing Addendum, the Cloud Privacy Notice, Admin Help pages, the Gemini privacy hub and Google's edition pages, together with Dutch and Danish official documents and SURF's vendor compliance page, on 7 October 2026. The official Data Privacy Framework List could not be queried on that date. We did not test a tenant or review any customer-specific agreement. "Not found" means we could not find information in public documentation; it does not mean it does not exist.

This page is not legal advice and is not a statement that Google Workspace is or is not GDPR compliant, which depends on your contract, configuration and use. If you work at Google or spot an error, please contact us and we will correct it.

Frequently asked questions

Does Google sign a DPA for Google Workspace for Education?

Yes. The Google Workspace for Education Terms incorporate the Cloud Data Processing Addendum, under which Google processes customer data as processor. The version we read was last modified on 8 June 2026. Additional Products such as YouTube fall under separate terms.

Can Google Workspace for Education keep data in the EU?

Data regions let admins choose the United States, Europe or no preference for data at rest. Google's help page lists Education Standard and Education Plus as supported education editions; Education Fundamentals is not listed. A separate setting to keep processing in the selected region is listed only for some Enterprise and Frontline editions.

What is Service Data in Google Workspace?

Service Data is personal information Google collects or generates while providing Workspace, such as account details, settings, usage and error logs and support communications. By default Google Cloud EMEA Limited is controller for it. Education customers can accept an optional Service Data Addendum to become controller of Service Data, with Google as processor.

Did the Dutch regulator ban Google Workspace in schools?

No ban was issued. On 31 May 2021 the Autoriteit Persoonsgegevens advised that use in education should not continue if the risks could not be reduced. After agreements with SURF, SIVON and SLM Rijk, the Dutch education minister told parliament on 5 July 2023 that there were no longer known high risks and that use could continue.

Does Google use Workspace for Education data to train Gemini?

Google's Workspace privacy hub says content is not human reviewed or used for generative AI model training outside your domain without permission, that the Gemini app is a core Workspace service subject to the Workspace agreement, including the Cloud Data Processing Addendum, and that user prompts are customer data under that addendum.

Related reading