Gemini and UK GDPR
Is Gemini safe for client data? A guide for UK firms
Gemini in Google Workspace, signed in with a business account, can be used for client work with the right safeguards in place. Gemini on a personal Google account shouldn't be: there's no contract with your firm, and people may read some conversations.
By Paulo De Sousa, Co-founder of SimpleKPILast checked
Gemini plans at a glance
The same AI tool can be safe or risky, depending on the plan someone is signed in to.
| Plan | Contract with your firm | Trains on what's typed | For client data? |
|---|---|---|---|
| Personal Google account | Consumer terms. No data processing agreement with your firm. | Activity is kept by default for adults, and human reviewers may read some conversations. Reviewed conversations can be kept for up to three years. | No personal data |
| Google Workspace (business account) | Workspace terms with Google's Cloud Data Processing Addendum. | Not used to train models without your permission, and conversations aren't reviewed by people. | Yes, with safeguards |
From Google: Gemini in Workspace privacy, checked 21 October 2026. Check your own plan with the AI plan checker.
Personal Google account vs Gemini in Google Workspace
Which Google account someone is signed in with changes everything about what happens to a prompt.
With a personal Google account, Gemini is a consumer product. Consumer terms apply, and there's no data processing agreement with your firm. Activity is kept by default for adults.
With a Google Workspace business account, Workspace terms and Google's Cloud Data Processing Addendum apply. Conversations aren't used to train models without your permission, and they aren't reviewed by people.
Many staff have both accounts in the same browser, so check which one they're actually using for client work.
The human review point
On a personal Google account, human reviewers may read some Gemini conversations, and reviewed conversations can be kept for up to three years.
Even with activity turned off, chats on a personal account are held for up to 72 hours.
For client data, that settles it. A client's details in a personal Gemini chat could be read by someone outside your firm, and kept for years. In Gemini in Google Workspace, conversations aren't reviewed by people.
What UK GDPR expects if you use Gemini
- Use a business plan that comes with a data processing agreement (the contract that covers your clients' data).
- List Gemini in your records of processing and your privacy notice.
- Do a risk assessment (a DPIA) before you rely on it for client work.
- Check the safeguards if data goes outside the UK.
- Tell your team the rules: which plan to use, and what must never go in.
Before you write your records of processing, check where Google stores your data and whether a UK or EU region is offered on your plan, because it decides which transfer safeguards you need.
What the ICO expects when your team uses AI
Settings to change today
Gemini activity (in your Google account)
On a personal Google account, activity is kept by default for adults. Turning it off still leaves chats held for up to 72 hours, so it reduces the risk without removing it. Personal accounts still aren't the place for client details.
Sign in with your Workspace account
Make sure everyone uses Gemini signed in with the firm's Google Workspace account for anything to do with clients. That's what brings in the Cloud Data Processing Addendum and keeps conversations away from human review.
How Saiela helps
- Approve the business plan your firm pays for.
- Warn people on personal accounts, or block them.
- Swap client details out of prompts before anything is sent.
- See which tools and accounts your team uses, as counts, never content.
Questions
What firms ask about Gemini and client data.
Does Gemini train on my data?
In Google Workspace, conversations aren't used to train models without your permission. On a personal Google account, activity is kept by default, and human reviewers may read some conversations.
Do people read Gemini conversations?
On a personal Google account, human reviewers may read some conversations, and reviewed ones can be kept for up to three years. In Gemini in Google Workspace, conversations aren't reviewed by people.
Is Gemini in Google Workspace GDPR compliant?
No tool makes your firm compliant on its own. Gemini in Workspace gives you the right footing for client work: Google's Cloud Data Processing Addendum applies and conversations aren't used for training without your permission. You still need a risk assessment (a DPIA), an AI policy and to keep unnecessary personal data out of prompts.
Can I use my personal Gemini account for work?
For general questions with no personal data, yes. For anything with client details, no: there's no contract with your firm, some conversations may be read by reviewers, and chats are held for up to 72 hours even with activity off.
Sources
Last checked 21 October 2026. Providers change their plans often. General information, not legal advice.
Paulo De Sousa
Co-founder of SimpleKPI
Paulo has worked in software development and SaaS for over 20 years and leads the engineering behind SimpleKPI and Saiela. He writes about how AI tools handle your data and how Saiela keeps it out of them.
Use Gemini without the client data risk.
Approve the right plan, block personal accounts and keep client details out of every prompt. Try it free for 7 days.