Yes, on the right tier. Gemini for Google Workspace can be used in line with UK GDPR: prompts count as customer data under Google’s Cloud Data Processing Addendum, are not used for training outside your domain, and admins set retention. The free Gemini app trains on chats by default and a sample is human reviewed, so keep client data off it. Your duties remain: a lawful basis, records, a DPIA where the use is high risk, and a staff policy.
- Workspace tier
- No training on your data, CDPA applies
- Consumer app default
- Trains on chats, human review of a sample
- UK consumer provider
- Google LLC, not Google Ireland
Three Geminis, three different answers
Google sells three things under one name, and the GDPR answer is different for each. The consumer Gemini app, free or with a personal subscription, is governed by Google’s consumer privacy terms. Gemini for Google Workspace, the version switched on inside Gmail, Docs, Drive and Meet on a business domain, is governed by the Cloud Data Processing Addendum, the same contract that covers the rest of Workspace. And Gemini for Google Cloud and Vertex AI, the developer route, has its own data governance terms again.
Most of the risk we see in UK firms comes from mixing them up: a business that pays for Workspace but whose staff use the free Gemini app in a personal browser profile has bought the compliant tier and is using the non-compliant one. The checks below sort the tiers out in order of how much trouble each can cause.
The consumer app: training on by default, humans in the loop
Google’s own privacy hub for the Gemini apps is admirably direct. With the Keep Activity setting on, which is the default, your activity is used to “provide, develop, and improve its services (including training generative AI models)”. A subset of chats is “reviewed by human reviewers (including Google’s trained service providers)”, and reviewed chats are retained for up to three years. Standard retention is auto-deleted after 18 months by default, adjustable to 3 or 36 months or indefinite.
Switching Keep Activity off helps but does not end the story: chats are then kept for 72 hours, are not used to train models unless you send feedback, and Google still processes them, with human review possible for safety purposes. Temporary chats are not used for training and are kept 72 hours. One more detail that matters for UK GDPR: Google states the Gemini apps are provided by Google Ireland Limited in the EEA and Switzerland, and by Google LLC everywhere else. The UK is “everywhere else”, so a UK consumer’s counterparty is the US company.
The employment consequence is the same one we describe for Claude and ChatGPT: every member of staff using a free Gemini account for work is a data protection decision the firm has not made. Either provision Gemini through Workspace, or put the consumer settings into the acceptable-use policy and check them.
| Tier | Training on your content | Human review | Retention |
|---|---|---|---|
| Consumer app, Keep Activity on (default) | Yes | A sample, kept up to 3 years | 18 months by default, user-adjustable |
| Consumer app, Keep Activity off | No, unless you send feedback | Possible for safety | 72 hours |
| Gemini for Google Workspace | No, outside your domain, without permission | No, outside your domain, without permission | 90 days to indefinite, set by admins |
| Gemini for Google Cloud | No | Not stated | Per the Cloud terms |
The Workspace tier: customer data under the CDPA
Gemini for Google Workspace is the tier a UK business should actually be assessing. Google’s Workspace privacy hub states that user prompts are customer data under the Cloud Data Processing Addendum, that your content is not used for generative AI model training outside your domain without permission, and that it is not human reviewed outside your domain without permission. Google’s Workspace AI page puts it more plainly still: “Your company data is not used for AI model training or ads.”
The CDPA is where the GDPR mechanics live: it is Google’s standing data processing contract for Workspace and Cloud, covering sub-processors, security measures and international transfers. If your firm already runs on Workspace, your existing CDPA position extends to Gemini, and the job is to record that Gemini is in scope, not to negotiate anything new. If a client or regulator asks for your transfer mechanism, the answer comes from the CDPA’s transfer terms rather than from any Gemini-specific document, and the ICO’s guidance on the UK Addendum is the reference for what a valid UK transfer mechanism looks like.
One honest gap to note: in the Gemini pages we reviewed, Google does not make a UK-specific residency commitment, and Workspace data region settings do not apply to every Gemini surface (Google names Gemini Notebook as an exception). If a client contract requires UK or EU processing, treat that as a question for the CDPA and your Google reseller, and see our guide to data residency for the general picture.
The admin controls that make it defensible
A UK admin can make the Workspace tier behave. The controls Google documents, and the ones we set when we deploy Gemini for clients, are these.
- 01
Service control: turn the Gemini app and the Gemini features in Gmail, Drive, Docs, Meet and Chat on or off per organisational unit, so a pilot group goes first and the firm follows.
- 02
Retention: conversation history retention is set by admins, from 90 days to indefinite for Workspace prompts and responses, and up to 36 months for the Gemini app on a managed account. Match it to your document retention schedule, not to the default.
- 03
Access boundaries: Information Rights Management and client-side encryption keep Gemini away from files it should not read, and cross-app grounding is disabled by default for externally shared files.
- 04
Audit: Gemini activity reaches the audit logs through the Reporting API, and Vault retention applies to Workspace data.
- 05
Data loss prevention: on the enterprise tiers, DLP rules apply to what Gemini can surface, which is the control that catches a prompt about to leak a spreadsheet of salaries.
What the ICO expects you to do, in order
The regulator’s expectations do not change because the vendor is Google. The sequence is the same one we walk through in our Claude and ChatGPT GDPR guides, and for a firm already on Workspace most of it is a day’s work: decide the tasks staff will use Gemini for and whether personal data is involved; put users on the Workspace tier so training is off and retention is yours; record Google as a processor in your record of processing activities with the CDPA reference; settle the lawful basis per task; run a DPIA where the use is high risk under the ICO’s screening criteria; update the privacy notices; and write the one-page acceptable-use policy, including the consumer-app settings for anyone who insists on a personal account.
The one Gemini-specific item: because the consumer app defaults to training and the UK counterparty is Google LLC, the policy should say plainly that the free app is not for client work. That sentence costs nothing and closes the biggest gap.
RelatedIs Claude GDPR compliant? A UK guide Is ChatGPT GDPR compliant? A UK guide AI acceptable-use policy template
How Gemini compares with Claude, ChatGPT and Copilot on this
On the business tiers, all four vendors have converged on the same baseline: no training on your content by default, a data processing contract, and admin-controlled retention. The differences are at the edges. Gemini’s advantage is that if you live in Google Workspace, there is no new processor to onboard, because the CDPA you already signed covers it. Its disadvantages are the consumer app’s training default, which is more aggressive than Claude’s or ChatGPT’s business-tier postures, and the thinner public story on UK-specific residency.
The buying decision is covered in our comparison guides; the compliance point is simpler: whichever assistant you choose, the business tier is the product, and the consumer tier is a staff-policy problem to manage.
RelatedCopilot, ChatGPT or Claude for a Microsoft 365 firm Claude or ChatGPT for a UK business Gemini for Google Workspace: a UK business guide Shadow AI in a UK small business
Common questions
Is Google Gemini GDPR compliant?
Gemini can be used in line with UK GDPR on the Google Workspace tier, where prompts are customer data under the Cloud Data Processing Addendum, are not used to train models outside your domain without permission, and sit under admin retention controls. The free consumer app trains on chats by default and a sample is human reviewed, so it needs settings changed and is a poor fit for client data.
Does Gemini train on my data?
The consumer app does by default: with Keep Activity on, chats are used to train generative AI models, per Google’s own privacy hub. Gemini for Google Workspace does not use your content for model training outside your domain without permission, and Gemini for Google Cloud states it does not use prompts or responses to train its models.
Do humans read Gemini conversations?
On the consumer app, yes: Google states a subset of chats is reviewed by human reviewers, including trained service providers, and reviewed chats are kept up to three years. On Workspace, content is not human reviewed outside your domain without permission.
Who do UK users contract with for Gemini?
For the consumer Gemini apps, Google Ireland Limited serves the EEA and Switzerland, and Google LLC serves everyone else, which includes the UK. Business use through Workspace sits under your Workspace agreement and the Cloud Data Processing Addendum.
Is Gemini in Google Workspace safe for client data?
It is the right tier for it: no training outside your domain, admin-set retention from 90 days to indefinite, IRM and DLP controls, and audit logging. You still need a lawful basis, a processor record and a staff policy, which is your work rather than Google’s.
Where does Gemini process data? Can I require UK or EU processing?
The Gemini pages we reviewed make no UK-specific residency commitment, and Workspace data region settings do not cover every Gemini surface. If residency is a contractual requirement, put the question to the CDPA and your Google account team, and read our data residency guide for the options across vendors.
Do I need a DPIA to use Gemini?
Only where the processing is likely to be high risk under the ICO’s screening criteria: systematic profiling, special-category data at scale, or automated decisions about individuals. Everyday drafting and summarising on the Workspace tier usually does not need one.
What should go in a staff policy about Gemini?
Which tier staff may use (Workspace accounts, not the free app, for client work), what may and may not be pasted in, the consumer-app settings for any personal use, and who checks. Our acceptable-use policy template covers it in a page.
How long does Gemini keep conversations?
Consumer app: 18 months by default, adjustable to 3 or 36 months or indefinite, with reviewed chats kept up to three years and Keep-Activity-off chats kept 72 hours. Workspace: 90 days to indefinite for Gemini in Workspace, as your admins decide, and up to 36 months for the Gemini app on managed accounts.
Is the free Gemini app banned under GDPR?
No tool is banned. But using it for client personal data with default settings means training and human review you have not told anyone about, which is indefensible. Fix the settings for personal use and buy the Workspace tier for work.