Version: 10 September 2026 - prepared by WAIMAKERS B.V.

Executive summary

Gemini is delivered through materially different routes. Gemini in a qualifying Google Workspace edition can support a GDPR-compliant deployment under Google's commercial terms. A personal Gemini Apps account, Google AI subscription, Vertex AI deployment and Gemini API use must not be treated as the same product or contract.

Tiers at a glance (EU focus)

Route	Training and contract	Retention	EU data residency	Practical assessment
Gemini in qualifying Google Workspace / Education	✅ Google states that Customer Data is not used to train or fine-tune Workspace generative-AI models without the customer's permission or instruction. The Workspace agreement and Cloud Data Processing Addendum apply.	Gemini in Workspace prompts and responses can be retained from 90 days to indefinitely, as set by administrators. Inserted content follows the Workspace/CDPA and applicable Vault controls.	✅ Eligible customers can confine supported storage and processing to the EU or US. Confirm edition and feature coverage.	Potentially suitable after configuration, purpose and feature review.
Gemini app with a qualifying work/school account	✅ For qualifying editions, content is not human-reviewed or used to train generative-AI models outside the customer's domain without permission.	Admins can set conversation history up to 36 months. With history off, new chats can still be stored for up to 72 hours to provide the service and process feedback.	⚠️ Do not infer location from the account address. Verify edition and admin controls.	Treat separately from Gemini embedded in Workspace apps.
Personal Gemini Apps / Google AI plan	⚠️ Consumer terms apply. Activity and feedback can be used to improve services and may be reviewed by humans, subject to settings.	Default activity auto-deletion is 18 months; users can choose 3 months, 36 months or indefinite. Reviewed chats and related feedback can be retained for up to three years. With Keep Activity off, future chats are retained for up to 72 hours.	❌ No organisational EU-residency commitment.	Do not substitute this for a managed Workspace route for sensitive business data.
Vertex AI / Gemini API	⚠️ Google Cloud or API terms and endpoint-specific controls apply.	Product, logging and feature specific.	⚠️ Region availability and processing depend on the selected service, endpoint, model and feature.	Perform a separate cloud architecture and DPA assessment.

Public prices and included AI capabilities vary by country and Workspace edition. Verify Google's live pricing and edition matrix immediately before purchase.

Details by offering

1) Personal Gemini Apps and Google AI plans

⚠️ Consumer privacy terms apply.
⚠️ Keep Activity, feedback and human-review settings affect training and retention.
❌ There is no organisational EU-residency commitment.
⚠️ Connected Apps and browser context can introduce separate data flows.

2) Gemini in qualifying Google Workspace

✅ The Workspace agreement and CDPA apply to qualifying editions.
✅ Customer Data is not used to train or fine-tune Workspace generative-AI models without permission or instruction.
✅ Existing Workspace permissions carry through to supported Gemini features.
✅ Inserted Workspace content follows applicable CDPA and Vault controls.
⚠️ Supported DLP can apply to inserted output, but coverage depends on service and licence.
⚠️ Gemini in Workspace retention and Gemini app conversation history are separate admin settings.

3) Vertex AI and Gemini API

✅ Regional endpoints can support a controlled Google Cloud deployment.
⚠️ Storage, policy logging, model availability and grounding features are service-specific.
⚠️ An EU region for one component does not prove that every connected service remains in-region.

Important boundaries

⚠️ A no-training commitment does not remove the customer's GDPR duties or mean that no data is retained.
⚠️ Over-broad Drive, Gmail or shared-space permissions remain an exposure risk.
⚠️ Connected Apps, extensions, third-party tools and feedback can create different terms and data flows.
⚠️ Data-region controls are feature- and edition-specific. Do not generalise Workspace statements to consumer Gemini, Gemini Notebook or every Cloud service.
⚠️ Personal-data decisions and other consequential uses require validation and appropriate human oversight.

EU rollout checklist

Record the exact Google account type, Workspace edition, Gemini surface and contract.
Confirm that the Cloud Data Processing Addendum applies to the intended service.
Set and document conversation history, Vault retention, deletion and feedback controls.
Verify the selected data region and the specific features covered by it.
Review Drive and Gmail permissions and restrict Connected Apps and extensions.
Establish lawful purpose, data-minimisation rules, user notice and human review.
Complete a DPIA and transfer assessment where the risk or data categories require them.

Sources

Disclaimer

This overview is an informational procurement aid, not legal advice or certification of a deployment. Verify the current edition, contract, settings and data flows before production use. The customer remains responsible for its GDPR obligations.

Prepared and issued by WAIMAKERS B.V. - 10 September 2026.

Gemini (Google)

Compare related tools

Need help navigating AI?

Gemini (Google)

Compare related tools

Need help navigating AI?