Is the Gemini API GDPR Compliant? It Depends Which Gemini You Use (2026)

Google's Gemini can be used with personal data in compliance with the GDPR, but only on the appropriate route. With OpenAI and Anthropic the main questions concern configuration. With Gemini, the first question is which route you are using, because Google offers it through three routes with different data terms.

This guide accompanies the guides on the ChatGPT / OpenAI API and the Claude API, and follows the same structure: what the provider handles, and what you need to configure and document yourself. For a side-by-side comparison, see GDPR-compliant LLM APIs: OpenAI vs Anthropic vs Google.

Get articles like this. Compliance Engineering, practical AI compliance for engineers and founders, by a CIPP/E certified practitioner.

Need this checked for your setup? A £500 scoping review covers your provider configuration, data processing agreement, data flows, residency and DPIA, with a written report within one week.

The three routes to Gemini

The unpaid tier (Google AI Studio and the free Gemini API quota). Google's terms state that it uses content submitted on the unpaid tier, and the responses generated, to provide, improve and develop its products and machine learning technologies, and that human reviewers may read and annotate inputs and outputs. That position changes for users in the EEA, Switzerland and the UK: for them, the paid-tier data terms apply to all services, including Google AI Studio and the unpaid quota, even though they are free of charge. Google's terms also require any application offered to users in the EEA, Switzerland or the UK to use Paid Services only, so an EU- or UK-facing product cannot be built on the free quota.

The paid Gemini Developer API. Access is a paid service when it is made through a Cloud project linked to an active billing account. On this route Google does not use your prompts and responses to improve its products. It processes them under its Data Processing Addendum for Products Where Google is a Data Processor, Version 10 of 7 May 2026, which lists Gemini API Paid Services among the services it covers. The route has two limitations for GDPR work. It offers no data residency option, since Google states that the data may be stored transiently or cached in any country where it or its agents have facilities. It also has no zero data retention route.

Vertex AI, now the Gemini Enterprise Agent Platform. Google has renamed Vertex AI the Gemini Enterprise Agent Platform, and the old documentation addresses redirect to the new ones. This is Google Cloud's enterprise route. Google's Service Specific Terms, in Section 18, state that it will not use customer data to train or fine-tune AI models without the customer's permission or instruction. The route also adds the Cloud Data Processing Addendum, contractual data residency and zero data retention subject to conditions.

Because an AI Studio key, a billed Developer API project and an Agent Platform deployment can look similar in code although different terms apply, the first step is to confirm which route your integration uses.

Step 1: The data processing agreement

Article 28 of the GDPR requires a written contract whenever a third party processes personal data on your behalf, and it is likely to be one of the first documents a regulator asks for.

Paid Developer API. Google's Gemini API terms state that paid-tier prompts and responses are processed in accordance with its Data Processing Addendum for Products Where Google is a Data Processor. Version 10 is dated 7 May 2026. For customers in most of the EMEA region the contracting entity is Google Cloud EMEA Limited, with separate entities for France, Italy and Poland. The addendum relies on Google's Data Privacy Framework certification for transfers to certified Google entities in the US, and it includes the Standard Contractual Clauses (Modules Two, Three and Four) with UK and Swiss supplementary terms as the fallback.

Vertex AI. The Google Cloud Terms provide that Google will only process customer data in accordance with the Cloud Data Processing Addendum, which is published openly and was last modified on 8 June 2026. It sets out Google's obligations as processor, covering security, sub-processors, assistance with data subject rights and breaches, deletion and audit, and it contains the Standard Contractual Clauses with UK and Swiss supplementary terms.

On both routes the main terms are governed by California law, while the Standard Contractual Clauses are governed by Irish law. These are the eight clauses to check in a data processing agreement with an AI provider, and CompanyScope's Google Gemini vendor profile sets out the same terms alongside OpenAI and Anthropic.

Step 2: Residency

The paid Developer API offers no residency control, so where a client contract or a DPIA requires processing to stay in a particular jurisdiction, Vertex AI is the route to use.

On Vertex AI, Google's data residency terms provide that, where you configure a service to store data at rest and perform machine learning processing in a specific multi-region, Google will do both only in that multi-region. Four points limit that commitment and should be checked against your integration:

• Grounding with Google Search, Web Grounding for Enterprise, Grounding with Google Maps and RAG Engine are excluded from the residency commitment.
• Requests sent to the global endpoint may be processed in any Google Cloud location and carry no residency guarantee, so each request should go to a regional or multi-region endpoint.
• The EU multi-region (eu) covers EU member states only. Google states that geographies outside the EU, including the UK and Switzerland, are excluded from it.
• Google's contractual commitment on machine learning processing covers a specific multi-region, and only the models Google lists for it. Storage at rest can be fixed to a single region, including the UK region (europe-west2), but Google's documentation of in-country ML processing in the UK, for only four models (Gemini 3.5 Flash, Gemini 2.5 Flash with a 128k context and two text embedding models), describes its practice rather than a contractual commitment. Every Gemini model in Google's residency table supports the EU multi-region.

For UK personal data, processing in the EU multi-region is a transfer from the UK to the EU, which the UK's adequacy regulations permit. The EU multi-region is therefore usually acceptable unless a client specifically requires processing in the UK.

Step 3: Retention

Paid Developer API. Google retains certain data for 55 days to detect and prevent violations of its Prohibited Use Policy. That log cannot be switched off, so guaranteed zero data retention is not available on this route. Some features also store data for their own purposes. Grounding with Google Search and Grounding with Google Maps each store data for 30 days, which cannot be disabled. The Interactions API stores interactions by default for 55 days on the paid tier, and files uploaded through the Files API are deleted after 48 hours. Google's documentation states that a workload requiring guaranteed zero data retention should use Vertex AI.

Vertex AI. Zero data retention on Vertex AI is a set of conditions rather than a single setting:

• Prompts flagged by Google's abuse monitoring are stored for up to 90 days in the region or multi-region you selected, unless Google grants an exception for abuse monitoring. Customers with a Google Cloud Master Agreement are exempt from this logging by default.
• Grounding with Google Search stores data for up to 3 days, Grounding with Google Maps for 30 days and the Deep Research agent for 7 days, with no way to disable any of them, so these features must not be used where zero data retention is required. Google recommends Web Grounding for Enterprise in place of Grounding with Google Search.
• Features that store data by design, such as stored Interactions, session resumption and request logging, must be turned off.
• Partner models carry their own terms. For Claude Fable and Mythos models on the platform, Google states that all prompts and responses are logged and stored for up to 30 days.

The Service Specific Terms add a contractual commitment that, without your permission or instruction, Google will not store prompts outside your account for longer than reasonably necessary to generate the output, and will not store the output itself. Set retention to what you can justify, meet the zero data retention conditions where the workload requires it, and record the decision.

Step 4: Minimise the data you send

Data minimisation applies in the same way whichever provider you use, so sending a complete customer record when the model needs only part of it breaches the principle, however favourable the provider's terms.

Remove names, email addresses, account numbers and other identifiers that the model does not need, and build minimisation into how prompts are constructed. Where personal data must be included, record the reason in the DPIA.

Step 5: Carry out a DPIA

A data protection impact assessment records that you assessed the risks before the system went live. For a Gemini integration it should cover the personal data that passes through the API and which Gemini route handles it; the lawful basis, usually legitimate interests or contract; the risks and the safeguards for each; and whether any decisions are automated. The risks to address include a breach at Google, retention, the international transfer and inaccurate output. Where an output is used to make a significant decision about a person by solely automated means, the safeguards in Articles 22A to 22D of the UK GDPR apply, as explained in the guide to automated decisions under Articles 22A to 22D. The DPIA guide for AI systems sets out the structure.

Step 6: Update your privacy notice

Tell individuals that you use an AI processor, explaining what the AI does, that the provider is Google, where the data is processed, how long it is kept and what rights they have. Where the AI is used in a chatbot, also say so at the start of the conversation.

Step 7: International transfers

Google is a US company, so processing EU or UK personal data through Gemini involves an international transfer, the extent of which a residency commitment can reduce. Of the three major AI providers covered in these guides, Google is the only one certified under the EU-US Data Privacy Framework. When the official register was checked on 4 October 2026, Google LLC's EU-US certification, UK Extension and Swiss-US certification were all shown as active, with the current period running to 13 September 2027. Both of Google's processing addenda rely on that certification for transfers to the US and provide the Standard Contractual Clauses as a fallback.

Check the register by legal entity name rather than assuming a certification exists, because OpenAI and Anthropic have no entry. Record the transfer mechanism in your records of processing activities. Using the EU multi-region on Vertex AI reduces the extent of the transfer by keeping eligible processing in Europe.

The EU AI Act

Data protection and the EU AI Act are separate regimes. Under the AI Act, Google is the provider of a general-purpose AI model (Gemini) and is subject to the obligations in Articles 51 to 55, which have applied since 2 August 2025. As the provider and deployer of the system you build on Gemini, you have obligations of your own, which include the Article 50 transparency duties that have applied since 2 August 2026, and under the Digital Omnibus the high-risk obligations for Annex III systems apply from 2 December 2027. Meeting the GDPR requirements does not satisfy the AI Act obligations.

Checklist before going live

Before using Gemini with personal data in production:

• A paid route is used (the paid Developer API or Vertex AI), and any product offered to users in the EEA, Switzerland or the UK uses Paid Services only
• Vertex AI is used where you need data residency or zero data retention
• The applicable processing addendum is identified and filed (Google's Data Processing Addendum for the paid Developer API, or the Cloud Data Processing Addendum for Vertex AI)
• On Vertex AI, requests go to the EU multi-region or another regional endpoint, never the global endpoint, and grounding and RAG Engine are assessed separately because they fall outside the residency commitment
• Where UK-only processing is required, the client accepts that Google's commitment is contractual for storage in europe-west2 but only documented practice for ML processing there, and one of the four listed models is used
• Retention is recorded: 55 days for abuse monitoring on the paid Developer API, or the zero data retention conditions met on Vertex AI
• Data minimisation is built into prompt construction
• The DPIA is completed and recorded, including the automated decision check
• The privacy notice names Google as a processor
• The transfer mechanism is recorded (Google LLC's Data Privacy Framework certification, including the UK Extension, with the Standard Contractual Clauses as fallback)

The documents on this checklist, as templates. The £49 AI API GDPR Compliance Pack contains editable Word templates for the contract review, which covers the Gemini Developer API and Vertex AI separately, the retention record, the DPIA, the automated decision-making assessment, the privacy notice wording and the transfer assessment. Google's position is recorded as published on 4 October 2026, alongside OpenAI's and Anthropic's, each with its source.

Summary

Gemini can be used in compliance with the GDPR, but the choice of route matters more than with other providers. The paid Developer API keeps your data out of training and is covered by Google's processing addendum, but it offers no residency control and keeps abuse-monitoring data for 55 days. Vertex AI, now the Gemini Enterprise Agent Platform, adds residency and zero data retention, each subject to conditions that need to be checked against the features you use. Confirm which route you are using, then complete your own minimisation, DPIA, privacy notice and transfer record.

---

Michael K. Onyekwere is a CIPP/E certified data protection professional at Janus Compliance. For a review of your provider setup, transfers, DPIA and retention, start with a £500 scoping review.

Google's Gemini API terms, processing addenda, retention, residency and training terms were re-checked on 4 October 2026, and Google LLC's certifications were shown as active on the Data Privacy Framework participant register the same day, with the current period running to 13 September 2027. This page is general information, not legal advice. Provider terms change, so check Google's current data processing terms, the route you use and its certifications before relying on them. See also: ChatGPT / OpenAI API and GDPR, Is the Claude API GDPR compliant?, AI vendor due diligence.