Key Documentation & References

Purpose & Context

This overview evaluates Google NotebookLM for GDPR compliance and data privacy in EU business contexts. NotebookLM is an AI-powered research and note-taking assistant that helps users summarize and extract insights from documents and sources.

Target audience: EU-based procurement, legal, compliance, and IT teams evaluating NotebookLM for processing personal or business-sensitive data.

🏢 Company & Service Overview

Company: Google LLC (Alphabet Inc.)[1]

Headquarters: Mountain View, California, USA with global infrastructure including EU data centers

Key differentiator: Part of Google Cloud ecosystem with enterprise-grade compliance. Explicit "no training on user data" commitment. Cloud Data Processing Addendum extended to all NotebookLM users (December 2024).[2]

Service description:

AI-powered research and note-taking assistant
Upload documents (PDFs, Google Docs, web URLs, audio files)
Generate summaries, insights, and Q&A based on sources
"Audio Overviews" feature: Podcast-style summaries
Powered by Google's Gemini AI models

📊 Service Tiers Comparison

Feature	Free	NotebookLM Plus (Workspace)	NotebookLM Pro	NotebookLM Ultra	NotebookLM Enterprise
Availability	✅ Anyone with Google account	✅ Google Workspace (core service since Feb 2025)	✅ Individual subscription	✅ Individual subscription	✅ Google Cloud customers
Pricing	Free	Included in Workspace (see Workspace pricing)	$19.99/month	$249.99/month	Custom pricing (contact sales)[4]
No Training on Data	✅ Yes	✅ Yes	✅ Yes	✅ Yes	✅ Yes
CDPA Coverage	✅ Yes (since Dec 2024)[2]	✅ Yes	✅ Yes	✅ Yes	✅ Yes
EU Data Residency	🟡 Via Google infrastructure	⚠️ Note: Workspace data-region settings NOT enforced for NotebookLM	🟡 Global	🟡 Global	✅ Full control
Admin Controls	❌	✅ Via Workspace admin + Context-Aware Access (CAA) policies	❌	❌	✅ Advanced
Compliance Certifications	🟡 Google-level	✅ Full (Workspace DPA)	🟡 Google-level	🟡 Google-level	✅ Full + dedicated support
Source Limits	Higher limits (Dec 2024 update)[5]	Higher limits	Higher limits	Highest limits	Highest limits
Audio Overviews	✅ Yes	✅ Yes	✅ Yes	✅ Yes	✅ Yes

✅ GDPR Compliance Assessment

Strengths

🟢 Explicit No-Training Commitment

"NotebookLM never trains on your data"[6]
"Your queries and the model's responses are not logged"[6]
Clear privacy-by-design approach
No data used for AI model improvement

🟢 Cloud Data Processing Addendum (CDPA)

Extended to NotebookLM on December 13, 2024[2]
Covers both free and paid accounts[2]
Standard Google Cloud terms for data processing
GDPR-compliant framework
Transparent data retention and deletion policies

🟢 Google Cloud Compliance Ecosystem

SOC 2 Type II certified[7]
ISO 27001 certified[7]
GDPR compliant by design
Part of Google Cloud's mature compliance program
Regular third-party audits

🟢 EU Data Infrastructure

Google Cloud operates multiple EU data centers
Data residency options available for Enterprise customers
Configurable regional storage
Part of Google's global, compliant infrastructure

🟢 Data Encryption

Encryption in transit (TLS)[8]
Encryption at rest on Google servers[8]
Industry-standard cryptographic protocols

🟢 User Data Control

Uploaded materials stored until user deletes them[9]
Manual deletion available anytime
Queries not saved/logged[9]
Clear data lifecycle management

Transparency & Communication

🟢 Privacy Update (May 2024)

Clarified consumer feedback review practices[10]
Addressed community concerns about human review
Workspace accounts have different (more protective) privacy rules[10]
Demonstrates responsiveness to privacy concerns

Minimal Concerns

⚠️ Workspace Data-Region Settings NOT Enforced for NotebookLM

Even if Workspace data-region policies are configured, these settings do not apply to NotebookLM processing.
Regulated organisations should not rely on data-region controls for NotebookLM compliance.
Consider using NotebookLM Enterprise with dedicated data location controls if EU-only processing is required.

🟡 Free Tier Data Residency

Free users cannot explicitly control data residency
Data stored on Google’s multi-region infrastructure
Not a compliance issue but less granular control than Enterprise

🟡 Shared Google Infrastructure

Uses broader Google Cloud infrastructure
Inherits any Google-wide considerations
Subject to Google's privacy policy and terms

🔐 Data Protection Framework

Legal Basis

Google Privacy Policy: Applies to all Google services[11]
NotebookLM-specific privacy rules: Additional protections[1]
Cloud Data Processing Addendum (CDPA): Since December 2024[2]
Google Cloud Terms: For Enterprise customers
Privacy update: May 2024[10]

Data Processing

Controller: Google LLC (for consumer accounts) / Customer organisation (for Enterprise)
Processor role: Google acts as processor for Enterprise customers
Sub-processors: Google Cloud infrastructure providers
Transfer mechanism: Standard Contractual Clauses (SCCs) for EU-US transfers
GDPR basis: CDPA ensures GDPR Article 28 compliance

User Rights (GDPR Articles 15-22)

Access: Full access to uploaded sources and notebooks
Rectification: Edit or update sources anytime
Erasure: Delete notebooks, sources, and audio overviews anytime[9]
Data portability: Download sources (native formats)
Objection: Contact Google privacy team
Automated decision-making: Not applicable (user-driven tool)

🌍 Infrastructure & Data Residency

Google Cloud Infrastructure

Global network: 30+ regions worldwide
EU regions: Multiple data centers in EU (Germany, Belgium, Finland, Netherlands, etc.)
Data residency: Configurable for Enterprise and Workspace customers
Redundancy: Multi-zone and multi-region options

NotebookLM-Specific Storage

Uploaded sources: Stored until user deletion[9]
Saved notes: Stored until user deletion
Audio overviews: Stored until user deletion
Queries: Not logged/saved[6]
Model responses: Not logged/saved[6]

Enterprise Data Control

Full admin visibility and control
Data location policies configurable
Integration with Google Cloud organisation policies
Audit logging available

📝 Training Data Policy

Crystal Clear: No Training

✅ Official commitment:[6]

"NotebookLM never trains on your data"
"Your queries and the model's responses are not logged"
No user data used for AI model improvement
Applies to all tiers (Free, Plus, Enterprise)

✅ What this means:

Uploaded documents: NOT used for training
User queries: NOT logged or used for training
AI-generated summaries: NOT logged or used for training
Audio overviews: NOT used for training
All interactions remain private

✅ Distinction from other Google AI products:

NotebookLM has stricter privacy than consumer-facing AI tools
Designed for sensitive research and business use
Privacy-by-design architecture

🔒 Security & Compliance

Security Features

Encryption in transit: TLS 1.3[8]
Encryption at rest: AES-256[8]
Access controls: Google account authentication
SSO/SAML: Available for Workspace/Enterprise (via Google identity)
Audit logging: Enterprise tier[7]
DLP (Data Loss Prevention): Via Google Workspace/Cloud policies
Admin controls: Enterprise tier for organisation management

Compliance Certifications (NotebookLM Enterprise)

✅ Confirmed certifications:[7]

SOC 2 Type II (Security)
ISO 27001 (Information Security Management)
GDPR (EU data protection)
Additional Google Cloud certifications inherit to Enterprise tier

🟡 Free/Plus tier:

Benefits from Google Cloud security posture
Not independently certified but follows same standards
CDPA provides GDPR framework[2]

Security Incidents

✅ No known security incidents specific to NotebookLM as of March 2026

Benefits from Google's global security operations
Part of mature, battle-tested infrastructure
Google Security Team oversight

⚖️ Legal & Regulatory Context

GDPR Alignment

✅ Cloud Data Processing Addendum (December 2024)[2]

Major step toward GDPR compliance
Extended to all users (free and paid)
Provides clear data processing framework
Aligns with GDPR Article 28 requirements
Ensures transparency and user empowerment

Google Cloud Heritage

NotebookLM Enterprise part of Google Cloud ecosystem
Inherits decades of compliance experience
Regular regulatory audits and certifications
Proactive engagement with EU regulators

Privacy-First Design

No training commitment differentiates from consumer AI tools
Built for sensitive business and research use
Responsive to privacy feedback (May 2024 update)[10]

💰 Pricing for Business Use

Plan	Price	Access	CDPA	Best For
Free	€0	Google account	✅ Yes (since Dec 2024)	Personal research, students, basic use
NotebookLM Plus	Included in Google Workspace (core service since Feb 2025)	Google Workspace	✅ Yes (Workspace DPA)	Business teams using Workspace
NotebookLM Pro	$19.99/month	Individual Google account	✅ Yes	Power users needing more capacity
NotebookLM Ultra	$249.99/month	Individual Google account	✅ Yes	Heavy users; 50% first-year discount via Google One AI Pro
NotebookLM Enterprise	Custom pricing (contact sales)[4]	Google Cloud organisation	✅ Yes	Large enterprises, regulated industries

Pricing notes:

NotebookLM Plus is now a Workspace core service (Feb 2025) - covered by standard Workspace DPA.
⚠️ Important: Workspace data-region settings are NOT enforced for NotebookLM even when enabled. Do not rely on data-region controls for NotebookLM in regulated contexts.
Context-Aware Access (CAA) policies can be applied via Workspace admin to restrict NotebookLM access by device/location.
Google One AI Pro 50% first-year discount applies to NotebookLM Ultra.
Enterprise pricing varies by organisation size and requirements

❓ EU Procurement Q&A

Q1: Can we use NotebookLM for processing personal data under GDPR?

A: Yes, across all tiers.

Free tier: ✅ CDPA since December 2024 provides GDPR framework[2]
Plus tier: ✅ Full Google Workspace compliance + CDPA
Enterprise tier: ✅ Complete compliance with dedicated controls

Recommendation: For sensitive personal data, use Plus or Enterprise tiers for added admin controls and organisational visibility.

Q2: Where is our data stored and processed?

Storage: Google Cloud infrastructure, multi-region by default
EU options: Available for Workspace/Enterprise customers via data residency policies
Processing: On Google infrastructure, can be configured for EU-only processing (Enterprise)
Uploaded sources: Stored until you delete them[9]
Queries/responses: Not stored/logged[6]

Q3: Is there a Data Processing Agreement?

A: Yes - Cloud Data Processing Addendum (CDPA).[2]

Extended to NotebookLM December 13, 2024
Covers all users (free, Plus, Enterprise)
Standard Google Cloud data processing terms
GDPR Article 28 compliant
Includes Standard Contractual Clauses (SCCs)

Q4: Will our documents be used to train AI models?

A: Absolutely not.[6]

Explicit "never trains on your data" commitment
Applies to all tiers equally
No queries logged
No responses logged
Complete privacy for uploaded sources

Q5: How does NotebookLM compare to ChatGPT for GDPR?

NotebookLM advantages:
- ✅ No training on data (explicit, all tiers)
- ✅ CDPA for all users (even free)
- ✅ Part of Google Cloud compliance ecosystem
- ✅ Queries not logged
- ✅ Built for business/research from day one
ChatGPT advantages:
- ✅ More mature enterprise features (longer track record)
- ✅ ChatGPT Enterprise has comparable compliance
Verdict: NotebookLM equal or superior for GDPR, especially considering free tier CDPA coverage.

Q6: What about human review of data?

A: Clarified in May 2024 privacy update:[10]

Consumer accounts (free): Limited human review for feedback/abuse only
Workspace accounts: Stronger privacy protections, no routine human review
Enterprise accounts: Full organisational control
Transparent about review practices after community feedback

✅ EU Business Rollout Checklist

Before Deployment

Choose appropriate tier (Plus for teams, Enterprise for large orgs)
Review Cloud Data Processing Addendum (CDPA)[2]
Configure data residency (if Workspace/Enterprise)
Set up Google Workspace/Cloud organisation (if needed)
Conduct DPIA if processing special category data
Review Google Cloud compliance documentation[7]
Configure admin controls (Enterprise tier)
Enable audit logging (Enterprise tier)
Train users on data handling and deletion practices

During Deployment

Set data upload guidelines (what can/cannot be uploaded)
Configure SSO (if Workspace/Enterprise)
Test data deletion (verify sources/notebooks removed)
Document data flows for GDPR Article 30 records
Establish retention policy (when to delete notebooks/sources)
Create user guidance on privacy features

Post-Deployment

Regular compliance review (quarterly)
Monitor Google compliance updates (certifications, features)
User training refresh (annually)
Audit notebook usage (what data is being uploaded)
Review and delete old notebooks (data minimisation)
Stay informed on NotebookLM updates and privacy changes

🔄 Recommended Alternatives

If NotebookLM doesn't meet specific requirements:

For Similar AI Note-Taking Tools

Microsoft Copilot in OneNote - Microsoft 365 ecosystem, EU data residency
Notion AI - GDPR-compliant, EU hosting options
Obsidian with local AI plugins - Full local control, zero cloud dependency

For Document Q&A with Strict EU Requirements

Aleph Alpha (Germany) - German AI company, explicit EU sovereignty
Mistral AI (France) - French AI, EU-based infrastructure
Self-hosted RAG solutions - OpenSource on EU cloud (e.g., Langchain + EU servers)

For Enterprise Document Intelligence

Google Vertex AI Search - Full Google Cloud enterprise control
Azure OpenAI Service - Microsoft enterprise offering, EU regions
AWS Bedrock - Amazon enterprise AI, EU regions available

Note: NotebookLM's combination of strong GDPR compliance, no-training commitment, and CDPA coverage (even for free tier) makes it highly competitive for EU use.

📚 Key Documentation & References

Official NotebookLM Resources

https://support.google.com/notebooklm/answer/15724963?hl=en - Learn How NotebookLM Protects Your Data (Google Official)
https://notebooklm.in/google-privacy-data-security-policies-for-notebooklm/ - Google Privacy and Data Security Policies for NotebookLM
https://notebooklm.in/deleting-data-from-google-notebooklm/ - Cloud Data Processing Addendum Extended to NotebookLM (December 2024)
https://cloud.google.com/terms/data-processing-addendum - Google Cloud Data Processing Addendum

Disclaimer

This overview is intended solely as an informative tool. We strongly advise customers to thoroughly review all Data Processing Agreements (DPAs) and privacy documentation before deploying Google NotebookLM in production environments - especially when personal data or sensitive research materials are processed. WAIMAKERS applies this same principle internally; all tools we use have been thoroughly assessed and included in our own privacy and security documentation. Customers should always carefully evaluate the official documentation, terms, and DPAs of each AI provider they use. WAIMAKERS cannot be held legally liable for any mistakes, errors, inaccuracies, or for the accuracy, currency, or completeness of the information in this document; the ultimate responsibility for GDPR compliance rests with the customer.

Prepared and issued by WAIMAKERS B.V. - March 2026.

https://gospech.com/2024/12/26/securing-data-with-notebooklm-a-detailed-exploration-of-privacy-measures/ - Securing Data with NotebookLM Privacy Measures

📋 Verdict Summary

Overall GDPR Rating: ✅ Compliant

Best for:

✅ Research teams needing document analysis with strong privacy
✅ EU businesses requiring GDPR-compliant note-taking/AI assistant
✅ Organisations already using Google Workspace
✅ Teams wanting explicit "no training" guarantees
✅ Projects requiring document summarisation with EU compliance
✅ Budget-conscious teams (free tier has CDPA coverage!)

Potentially not ideal for:

⚠️ Organisations requiring 100% EU-only infrastructure on free tier (use Enterprise for full control)
⚠️ Teams needing on-premises deployment (cloud-only service)
⚠️ Use cases requiring integration with non-Google ecosystems

Key Decision Factors

Factor	Status	Impact
DPA/CDPA Availability	✅ Yes (all tiers)	High
No Training Commitment	✅ Explicit	High
EU Data Residency	✅ Available (Workspace/Enterprise)	High
Compliance Certifications	✅ SOC 2, ISO 27001	High
Queries Not Logged	✅ Yes	High
Data Deletion Control	✅ User-controlled	Medium
Free Tier GDPR Coverage	✅ CDPA included	Medium
Security Incident History	✅ None known	Low

Final Recommendation

For EU business use:

NotebookLM Plus (Workspace): ✅ Recommended for Google Workspace teams (core service since Feb 2025)
NotebookLM Enterprise: ✅ Highly recommended for large organisations and regulated industries
NotebookLM Pro ($19.99/mo): ✅ Good for individual power users needing more capacity
NotebookLM Ultra ($249.99/mo): ✅ For heavy users; 50% first-year Google One AI Pro discount available
NotebookLM Free: ✅ Acceptable even for personal business data (CDPA coverage since Dec 2024)
⚠️ Reminder: Workspace data-region settings are not enforced for NotebookLM - verify processing location via Enterprise controls.

What Sets NotebookLM Apart

🌟 Unique strengths:

CDPA for free users - Unprecedented for a free AI tool
Explicit no-training commitment - Clear and unambiguous
Queries not logged - True privacy by design
Part of Google Cloud - Mature compliance ecosystem
Recent privacy responsiveness - May 2024 update shows user feedback matters

Bottom line: NotebookLM is one of the most GDPR-friendly AI tools available, especially considering the free tier includes full CDPA coverage. The explicit "no training" commitment and "queries not logged" policy make it exceptional for sensitive business use.

Last updated: March 2026

Next review: May 2026 (quarterly)

Document owner: Wouter van Haaften | WAIMAKERS B.V.

Google NotebookLM

Need help navigating AI?

Google NotebookLM

Need help navigating AI?