Is Gemini GDPR-Compliant? Examples, Costs and How to Start

“Is Gemini GDPR-compliant?” is what the data protection officer asks the Monday after someone in sales pastes a customer list into gemini.google.com to draft a follow-up email. Half the team is already using it, some signed in with a work Google account, some with a private one. This article answers the question plainly, as of October 2026: which Gemini is which, what Google commits to, where the open points are, what it costs and what a compliant setup needs. Many companies can use Gemini compliantly with the right setup. This is not legal advice - confirm the details with your own data protection officer.

Is Gemini GDPR-compliant?

Google Gemini is not GDPR-compliant or non-compliant on its own: used with the right account under the right Google contract, with region settings and documentation in place, it can be used in a GDPR-compliant way. Google states that Gemini for Workspace is covered by the Workspace Data Processing Amendment, that Workspace customer data is not used to train generative models for other customers, and that Vertex AI inputs and outputs on Google Cloud are not used for training either¹²⁵. What remains is your part: the right product, the right region and the paperwork.

The European way across Outlook, Teams and Slack: Superkind

If you want an AI employee that works where your team already works, hosted and processed in Europe, you do not have to pick a US suite. Superkind is the AI employee for your team: you write to Superkind in Outlook or any email, Microsoft Teams, Slack or the Superkind web app like you would to a colleague, and it does the task in your programs through 1,500+ integrations such as SharePoint, Excel, HubSpot and DATEV. Superkind is hosted and processed in Europe, GDPR compliant, aligned with the EU AI Act and never trains models on your data. It uses AI models from OpenAI, Anthropic, Mistral and Google - including Gemini - but all inference happens in European regions, and the data processing agreement comes through the Trust Center. The difference to Gemini is the job: Gemini helps each person draft and summarise, Superkind takes over whole tasks.

1. 1

   You write the task

   In Outlook, Teams, Slack or the web app, in plain words: “Answer Ms Berger about her delivery date and log the call in HubSpot.”

2. 2

   Superkind does it in your systems

   It reads the email, looks up the order in your ERP, uses your company knowledge (prices, delivery times, tone) and follows your rules, such as “Credit notes over EUR 200 need sign-off from the team lead”.

3. 3

   Superkind asks before anything goes out

   You get the draft reply and the CRM entry with Approve or Reject. Nothing is sent or changed without your OK, and a colleague can approve in Teams or Slack.

4. 4

   Next time it runs as a routine

   What you explain once keeps running, for example “Every delivery question - draft the reply, log it, ask me”. Every task adds to your Company Brain, which stays in Europe.

How Gemini and the GDPR fit together

The GDPR does not ban Gemini. Six parts decide whether your use is compliant.

1. The account and the contract - Gemini for Workspace is covered by the Google Workspace Data Processing Amendment (DPA), with Google as processor under Art. 28 GDPR. Vertex AI on Google Cloud is covered by the Google Cloud DPA. The consumer Gemini app with a personal Google account runs under consumer terms and is not covered by either business DPA²⁵.
2. No training on your data - for Workspace, Google states that customer data in Gmail, Docs and Drive and prompts and responses in Gemini for Workspace are not used to train generative models for other customers. The same is true for Vertex AI inputs and outputs. For the consumer app, Google may use conversations and may sample them for human review to improve services unless the user turns Gemini Apps Activity off¹⁴⁵.
3. Where the data is processed - Google Workspace offers a data regions policy that lets eligible customers pin covered customer data at rest to Europe. Some processing may still happen outside the chosen region, including some Gemini for Workspace inference. On Vertex AI you set the processing region explicitly, including europe-west³⁶.
4. International transfer (Art. 44) - Google is a US company under the US CLOUD Act. Transfers of personal data to Google are documented under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), which the European Commission considers to provide an adequate level of protection, with Standard Contractual Clauses as the fallback⁷¹².
5. Human review in the consumer app - for the consumer Gemini app, Google documents that a sample of conversations is reviewed by trained reviewers to improve the service, and advises users not to enter confidential information. Workspace Gemini and Vertex AI do not include this human review of customer prompts⁴.
6. Your own paperwork - a lawful basis under Art. 6 (and Art. 9 for health or other special categories), an entry in your record of processing (Art. 30) and a data protection impact assessment (Art. 35) where the use is likely to be high risk. Under the EU AI Act (Regulation (EU) 2024/1689), Art. 4 requires AI literacy for staff from February 2025, and Art. 50 adds transparency duties from 2 August 2026, including labelling AI-generated text published to inform the public unless a person reviewed it¹⁰¹¹.

The three Geminis and the GDPR compared

As of October 2026. Where each version stands on the points that decide GDPR fit, with Superkind for comparison, based on the vendors’ own statements¹²³⁴⁵⁶. Not a compliance sign-off.

In short: the consumer Gemini app is the wrong place for customer or employee data; with a Workspace account you get the contract and a data region, and the open points are the CLOUD Act and where inference may route; on Vertex AI you get full region control for the API. For the Microsoft side of this question, see Is Microsoft Copilot GDPR-compliant?, and for ChatGPT, Is ChatGPT GDPR-compliant?. For teams looking to switch away from Gemini entirely, see 8 GDPR-compliant Gemini alternatives.

Examples: Gemini and the GDPR in practice

Five realistic situations and what each needs to stay compliant.

1. Superkind handles customer requests in Outlook and Teams

Nadine forwards a customer email in Outlook to Superkind. Superkind looks up the order in SAP Business One, drafts the reply, logs the call note in HubSpot and asks her for approval before anything goes out. The data is processed in Europe, with no training on it and the DPA through the Trust Center. It connects through 1,500+ integrations such as SharePoint, Excel, DATEV and Zendesk. See email inbox triage for how this runs day to day.

2. Gemini for Workspace drafts a reply inside Gmail

Signed in with a Workspace work account, the sales lead uses the Gemini side panel in Gmail to draft a quote reply. Prompts and responses fall under the Workspace DPA and are not used to train models¹². The open point is where inference routes; eligible customers can turn on data regions to pin covered data at rest to Europe³. The draft still has to leave the Gemini pane and get into your CRM by hand.

3. The consumer Gemini app with a private account

A colleague pastes a prospect list into gemini.google.com while signed in with a personal account to write an outreach email. That chat is not covered by any business DPA, and Google may sample it for human review and use it to improve services unless the user turned Gemini Apps Activity off⁴. Make the rule explicit: company data only with the Workspace account.

4. Vertex AI powers a vendor’s product

A software vendor builds a feature on Vertex AI with Gemini, with region set to europe-west4 in Belgium. Inputs and outputs stay in that region, and content is not used for training⁵⁶. The vendor still has to flow the Google Cloud DPA through to its customers and record the processing itself.

5. HR summaries with health data

An HR lead wants Gemini to summarise sick notes and return-to-work talks. Health data is a special category under Art. 9 GDPR; here a DPIA under Art. 35 is likely due¹⁰. Keep the use on Workspace or Vertex AI with a DPIA, or stay with an EU-first vendor like Superkind where the processing is in Europe end to end.

What a compliant Gemini setup needs (and what it costs)

Short, but none of it happens by itself.

• Workspace accounts only - company data only with the Google Workspace work account, where the DPA applies².
• A decision on data regions - for Workspace, turn on data regions and choose Europe; for Vertex AI, set the processing region to europe-west³⁶.
• Turn off Gemini Apps Activity on consumer accounts - or ban the consumer app outright for anything work-related⁴.
• Document the Art. 44 transfer - cite the EU-US Data Privacy Framework adequacy decision and keep SCCs on file as a fallback¹².
• Record of processing and DPIA - add Gemini to your record (Art. 30) and run a DPIA (Art. 35) where the risk is high¹⁰.
• AI literacy and transparency - train staff and set rules under Art. 4 EU AI Act; from 2 August 2026, Art. 50 adds transparency duties for some AI-generated content¹¹.

What Gemini costs

As of October 2026. Google list prices for Germany, per user per month, excl. VAT. Gemini is bundled into Workspace rather than sold as a separate add-on⁹.

The honest reading: for a Workspace team, Gemini is included in the plan you already pay for, so the real question is not price but whether a per-seat generative assistant inside Gmail is what you need, or a cross-system AI employee that does the task. Ten Workspace Business Standard seats are roughly EUR 115 per month before VAT; ten Business Plus seats, EUR 172.

Data protection and EU hosting

Safe by default

Your data stays in Europe, under a DPA, with no training on your data.

• Hosted and processed in Europe
• GDPR compliant
• Aligned with the EU AI Act
• No training on your data
• DPA through the Trust Center

For a customer email in Outlook, a contact in HubSpot or a file in SharePoint, the personal data Superkind works with is processed in Europe from the first task, with approval before anything leaves the team.

What Superkind costs

As of October 2026. Prices excl. VAT, for the whole company with unlimited users.

• Free - EUR 0 with a one-off up to EUR 150 in credits to start. No credit card, no sales call, every feature and connection.
• Business - from EUR 50 per month for 25,000 credits. EUR 100 for 50,000 credits is the popular step, then EUR 200 and EUR 500. No price per seat, unused credits carry over one month, custom apps included, cancel monthly.
• Enterprise - custom price for your volume, dedicated support with SLA, SSO/SCIM and audit log, a DPA and help with the security review, payment by invoice.
• What credits buy - a question uses 10-50 credits, a task 50-500 credits and a run of your own agent 1,000-5,000 credits. EUR 100 covers up to 1,000 tasks or 5,000 questions.

How to start

Start with one real task this week and get your Gemini situation in order at the same time. Three steps:

From the first task to your own app

A real example from the field: a sales team wanted to use the consumer Gemini app to answer customer emails faster, the data protection officer said stop, and the team switched to Superkind. The data stayed in Europe from the first task to the custom app the company later built. Four stages, on that customer-request example:

1. 1

   Ready in minutes

   Sign up for free, forward the first customer email in Outlook and watch Superkind draft the reply, pull the order from the ERP and log it in HubSpot.

2. 2

   Tasks become routines

   What you explain once keeps running as a routine, for example every delivery question answered and logged. Before anything goes out, Superkind asks for approval.

3. 3

   Learns from day one

   Every task makes Superkind smarter. Customers, prices and processes end up in your Company Brain, and that knowledge is never lost, even when people leave.

4. 4

   Your own app, without starting over

   When it gets more complex, you build custom solutions, apps and integrations on top of what Superkind already knows, for example a customer-service app for your team: your Super App. Built yourself or together with us. It all belongs to you.

Conclusion

Gemini can be used in a GDPR-compliant way: with a Workspace account it runs under Google’s DPA, with data regions it stays in Europe at rest, and Vertex AI with Gemini gives you full region control for the API. The work is in the details: the consumer app is a different product, the CLOUD Act is a documented risk you manage, and the paperwork stays with you. For an AI employee that does whole tasks in Outlook, Teams and Slack, hosted and processed in Europe with approval before anything goes out, Superkind connects to SharePoint, Excel, HubSpot, DATEV and 1,500+ integrations from EUR 50 per month for unlimited users (as of October 2026). Check your Workspace region settings this week, then send Superkind one real task and compare.

Frequently Asked Questions

Henri Jung

Co-founder of Superkind, the AI employee teams write to in Outlook, Teams and Slack. Henri helps companies, from small teams to the Mittelstand, hand their routine work to AI - without new tools, consultants or an in-house AI team.