How Safe Is Your Data with Google Gemini? Privacy Risks, Storage Policies & Compliance Tips

How safe is your data with Google Gemini?

It depends on how you use Gemini. With a personal Google account, your data is not safe enough for company information: by default, Google stores your chats for 18 months, uses them to improve its AI models and has some of them reviewed by humans. With a Google Workspace licence, things look different: your prompts are neither used for training nor read by humans.

For trade secrets, customer data or other personal data, this means they do not belong in personal Gemini accounts. Here you can find out what Google stores, who reads along and how to use Gemini safely in your business.

What is Google Gemini?

Gemini is Google's AI assistant and the successor to Google Bard. It writes and edits texts, summarises documents, analyses images and helps with programming. Gemini comes in two versions that differ significantly in terms of data protection:

• Gemini with a personal Google account (free or paid): Google's general Terms of Service and the Gemini Apps Privacy Notice apply.
• Gemini in Google Workspace (with a business licence): the Workspace terms apply, with additional protections for businesses.

The following sections on storage and human reviewers refer to the personal version. You can read what changes with Workspace further below.

What data does Google store and for how long?

Google stores your chats, uploaded files, location data and feedback in your Google account. Whether and for how long is controlled by the “Keep Activity” setting (formerly “Gemini Apps Activity”):

• Default: For adults, the setting is turned on automatically. Your activity is deleted after 18 months.
• Adjust: You can change auto-delete to 3 or 36 months or turn saving off completely.
• Off does not mean deleted: Even with saving turned off, Google keeps your chats for up to 72 hours to respond to you and process feedback. These chats do not appear in your activity history.

You can find the setting in the Gemini app via your profile picture under “Keep Activity”.

Who reads along? Human reviewers at Gemini

To improve the quality of its AI, Google has some chats read and rated by humans. Before that, Google disconnects the chats from your account and automatically removes details such as email addresses or phone numbers.

The problem: reviewed chats are not deleted when you delete your history. Google keeps them separately, together with related data such as language, device type and location, for up to three years. Google itself therefore advises against entering confidential information into Gemini.

If you turn off “Keep Activity”, future chats will no longer be selected for human review. Chats that have already been reviewed are not affected.

Gemini and third-party data

Gemini can be connected to other Google services such as Gmail, Google Drive or Maps. Gemini then accesses content from these services, and the services process your data according to their own rules and the Google Privacy Policy. If you use third-party services via Gemini, their privacy policies apply.

Also keep an eye on other account settings: even if “Keep Activity” is turned off, settings such as “Web & App Activity” or Location History may continue to store data.

Gemini in your business: personal account vs. Google Workspace

For businesses, the key question is not whether to use Gemini, but with which account. With a qualifying Google Workspace licence, much stricter rules apply:

The consequence: as soon as employees use Gemini with personal accounts for work, company data ends up with Google under consumer terms. There is no data processing agreement for this, and your company has no control over the data. Under the GDPR, this is not permitted when personal data is involved.

How to use Gemini in a GDPR-compliant way

With these steps, your team can use Gemini without putting company and customer data at risk:

1. Workspace instead of personal accounts: Provide Gemini through a Google Workspace licence and prohibit the use of personal accounts for company data.
2. Check the contracts: Accept Google Workspace's data processing terms in the Admin console as your data processing agreement and review the rules for data transfers to the US.
3. Configure admin settings: Set the data region to the EU, enable data protection rules such as DLP and decide which extensions (e.g. Gmail, Drive) Gemini may use.
4. Create an AI policy: Set out in writing which data may be entered into Gemini and which is off-limits, such as health data, trade secrets or confidential customer data. Our guide How to make AI agents GDPR-compliant shows what this looks like for AI agents.
5. Train your employees: Since February 2025, the EU AI Act requires employees who use AI to have sufficient AI literacy (Art. 4). Compliance trainings on data protection and AI lay the foundation for this.
6. Assess the risks: If you process sensitive or large amounts of personal data with Gemini, check whether a data protection impact assessment is required and add Gemini to your record of processing activities.

To see how Gemini compares with other AI assistants, read our article on ChatGPT and data protection.

Conclusion

Gemini is a powerful tool for everyday work, but not every version is suitable for company data. With personal accounts, Google stores chats for 18 months by default (adjustable to 3 or 36 months), uses them for AI training and has some of them reviewed by humans. With a Google Workspace licence, the right admin settings and a clear AI policy, however, your company can use Gemini in a privacy-compliant way.

What matters is knowing which AI tools are used in your company and under which terms. With heyData's vendor risk management, you keep track of all service providers and AI vendors, review their contracts and data protection standards in a structured way and document your assessment in line with the GDPR.

Take the first step and secure the use of AI in your company. Book a demo now!