Google Gemini & data protection: what SMEs need to know

Is Google Gemini usable in compliance with data protection law for Swiss companies?

Yes, if you choose the right offering. Swiss firms can use Google’s AI assistant Gemini, provided it runs under the Google Cloud contract, for example in Google’s office suite Workspace or through the API. For professional-secrecy data, an addendum contract and the Enterprise variant of web search are needed on top. This is the assessment of the Zurich law firm VISCHER.

In brief

• Check first which contract your Gemini runs under. VISCHER considers the Gemini apps for individual users and the free Business Edition unsuitable for business use.
• Anyone handling professional-secrecy?Professional and official secrecyThe criminally protected duty of confidentiality of authorities (official secrecy, Art. 320 of the Swiss Criminal Code) and a list of professions named in the law (Art. 321), such as lawyers, doctors and pharmacists. It applies independently of data protection law and reaches further. Banking secrecy sits separately in the Banking Act. data, for example in a law firm or medical practice, should start the process for the professional-secrecy addendum early. Without the right contacts, VISCHER says it is “very cumbersome” to obtain, and smaller firms wait months.
• The addendum does not yet protect the web search. Gemini can search the internet to answer, and the standard search stores queries for up to three days. The Enterprise variant of web search must therefore be active as well.
• Anyone who needs processing in Switzerland must fix the region contractually. Google’s newest models increasingly run in the EU compute pool, that is, on servers somewhere in the EU, even though a Swiss region exists in Zurich.
• Anyone using Gemini as a coding aid in the terminal (Gemini CLI) needs a licensed Code Assist tier since June 2026. Free access for individual users was discontinued.

The Zurich law firm VISCHER (authors Lucian Hunger and Jonas Baeriswyl) has run a market overview of data protection in AI tools for years; the Google section was updated in July 2026. The firm writes that no cloud provider has so far “satisfactorily resolved” the contract for professional-secrecy data together with the Abuse Monitoring opt-out (the waiver of manual review of requests by the provider’s staff). We quote this legal assessment explicitly because Souverana is not a law firm. What we contribute is the architecture question: where your model actually runs, and how you get access to the addendum in practice.

This is the third part of our series “Provider Data-Protection Check”, following the same grid as the others: contracts, data residency, professional secrecy, routes around the gaps.

What VISCHER objects to in Google Gemini

Google has reorganised and partly renamed its offering over the past months. For companies, one single question ultimately matters: does the product run under the “Google Cloud Terms of Service” or under a different contract? VISCHER considers only offerings under the GCP contract fundamentally suitable for business use, such as Gemini in Workspace, Gemini Enterprise Standard/Plus/Frontline, or the API?APIA programming interface through which software addresses a language model directly, without a chat interface. Usually billed per token. through the former Vertex AI platform.

The “Business Edition” sounds like a business-customer version, but in VISCHER’s assessment neither variant is really built for that. The free one lacks the GCP contract, and Google may use the data for its own purposes. The paid one lacks a general confidentiality clause. For offerings that run under the GCP contract, by contrast, a data processing agreement?Data Processing Agreement (DPA)The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law. applies, which Google calls its “Cloud Data Processing Addendum.”

As soon as an AI model is allowed to search the internet, it leaves the protected environment, and this is exactly where VISCHER’s overview shows the biggest difference from Microsoft. In the standard variant, “Grounding with Google Search” (the model bases its answer on a Google search), Google may store search queries for up to three days for its own debugging, contractually declared as part of the service. In the free version of Google AI Studio, this goes further still: there, Google also uses web-search data for testing its own systems.

According to VISCHER, Web Grounding for Enterprise is available in the API through the Agent Platform. For Gemini Enterprise Standard/Plus/Frontline, the documentation is unclear. For companies that need a web search?RAGRetrieval-Augmented Generation: before answering, the model receives matching excerpts from your own documents and answers with evidence instead of from memory. and handle sensitive data, this is the decisive difference from Microsoft and OpenAI: according to the same overview, both so far offer no comparable enterprise web search.

Anyone procuring through the Google Cloud Platform can also choose other models instead of Gemini, including those from Anthropic. The contracting party is Google. According to Anthropic’s own contract terms, Anthropic has, in this case, no access to the customer’s Google Cloud environment or to the data processed there, with the exception of a few specially regulated models.

Gemini CLI: from free tool to enterprise licence

VISCHER’s overview does not separately cover Gemini CLI, Google’s command-line tool for coding work. What follows is our own research into Google’s public disclosures, as of July 2026, and is not an assessment by VISCHER. The picture has changed since spring.

Companies with a Gemini Code Assist licence (Standard or Enterprise) are not affected by this change: their access to Gemini CLI and the IDE extensions continues, under the same GCP contract that also applies to Gemini Enterprise. For this licence tier, Google makes clear commitments: prompts?PromptThe input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost. and responses are processed statelessly, that is, not stored, and do not flow into training without explicit permission.Google CloudGoogle Cloud · 2026Security, privacy, and compliance for Gemini Code AssistOpen source ↗ The Enterprise tier is certified under, among others, ISO 27001, 27017, 27018 and SOC 1/2/3.Google CloudGoogle Cloud · 2026Compliance certifications and security controls (Gemini Enterprise)Open source ↗ Data residency, that is, the country in which the data is stored, can also be set. The same limitation applies as for Gemini itself: Switzerland is not part of the EU multi-region endpoint, so a region must be deliberately chosen.

For your company, that means: in production use, only the licensed Code Assist variant belongs. A personal Google account with an API key from the free offering is unsuitable for this.

Professional secrecy: what already works today

For law firms, doctors, trustees and public authorities, Swiss law imposes professional and official secrecy↗Law & Regulation · Part 3Professional secrecy and AI: what may go to the cloud'That does not work for us' is often the answer to AI in law firms and medical practices. The criminal-law article on professional secrecy (Art. 321 of the Swiss Criminal Code) is drawn more narrowly, and most of daily work falls outside it entirely.Read article. VISCHER names four conditions for Google Gemini to be usable for this:

1. 01

   Additional contract

   A separate contract for professional and official secrecy data must be in place, in addition to the standard GCP contract.

2. 02

   Abuse Monitoring off

   Manual review of requests by Google staff must be switched off. Automated technical filters remain unproblematic.

3. 03

   Web Grounding for Enterprise

   The Enterprise variant must be used instead of the standard web search, or web search stays off entirely.

4. 04

   Zero Data Retention and Access Approval

   Recommended: disable caching so that Google retains no data (zero data retention), and set up Access Approval so that Google access requires your consent.

This is technically solvable, VISCHER writes. The bottleneck lies elsewhere: “The ‘ordinary’ GCP contract can be concluded online, but the addendum needs offline billing […], which Google usually offers only to larger customers.” Smaller institutions, such as a law firm, normally only reach this contract through personal contacts, and according to VISCHER that can take months. The firm states it has already brokered several such contracts. At Microsoft, the comparable addendum is easier to obtain: any certified Cloud Solution Provider (a reseller of Microsoft services) can offer it, independent of Microsoft itself.

The EU compute pool: Zurich exists, but is not guaranteed

VISCHER supplies the contractual assessment. What their overview does not answer: where exactly does the server that actually processes your request stand? A look at Google’s own model catalogue gives a first answer.

Key figure

46 models

Source: Google Cloud, Vertex AI Model Garden, europe-west6 region, as of July 2026

A Swiss cloud region exists, then, and it offers many models. The newest, flagship Gemini models of the 3-series, however, are mostly reachable in it only through the EU multi-region endpoint, a shared access point for several EU locations. The request is then processed “somewhere in the EU,” with no fixed location such as Zurich assigned to it. Older endpoints bound to a single EU region (single-region) currently offer Gemini 2.5 Pro and 2.0 Flash, that is, models of an older generation.

Where Google Gemini stands on the sovereignty scale

The contract question is one layer. The other is the architecture: which legal jurisdiction the processing really falls under, how open the model behind it is, where operation actually runs, and whether you can get back out of the system if in doubt. How we understand sovereignty in general is set out in our foundational article What is sovereign AI?. The same six axes apply concretely to Gemini and the Agent Platform:

less sovereign more sovereign →

Legal jurisdiction

US

EU

Switzerland

Model

closed

open weights

open + training data

Software

proprietary

open code

true open source

Operation

US cloud

Swiss provider

in-house

Data

provider trains on it

contractually prohibited

technically impossible

Integration

proprietary API

open standards

in-house

On legal jurisdiction, Gemini sits in the middle for most companies today: the EU pool as the standard case, a Swiss region as an option, but without a guarantee for the newest models, as the previous section shows. On operation, Gemini sits fully on the left: it runs at a hyperscaler, a large cloud provider. The flagship model cannot be self-hosted, more on that in the next section. On integration, Google’s advantage lies in a single point: Web Grounding for Enterprise is not an open interface, but it is the only one of the three large providers’ web searches that can be used with professional-secrecy data.

The escape route: Gemma

There is one exception to the lock-in to the cloud provider: with Gemma, Google publishes its own family of open models?Open weightModels whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in. that you may download and run on your own or Swiss infrastructure, independent of Google’s cloud.Google AI for DevelopersGoogle AI for Developers · 2026Gemma model overviewOpen source ↗ That gives Google the same escape route that Microsoft offers through Azure AI Foundry and OpenAI through its gpt-oss model.

This counts for the sovereignty assessment because it separates the model axis from the other five. Anyone who uses Gemini stays tied to Google Cloud for legal jurisdiction, operation and integration. If you instead run a Gemma model at a Swiss or European host↗Sovereign AI · Part 3Sovereign AI infrastructure: why the model is the easy partThe language model is the easiest part of your AI to swap. What ties you to one provider are the models that read your documents and make them searchable (OCR and embeddings). Which Swiss hosters offer every component.Read article, all three change completely. If an open model’s performance covers the task, operation no longer has to sit with Google.

Where to start

Before your next Google contract or the next extension, clarify these four points. The most important is access to the professional-secrecy addendum.

1. Who is your contact at Google for the addendum? Without a personal contact, activation takes months according to VISCHER.
2. Are all four conditions from the section “Professional secrecy: what already works today” implemented? A signed addendum with the standard web search still active does not close the gap.
3. Which region does your booked model run in, fixed or in the EU pool?
4. Would a self-operated Gemma model give individual use cases more control than the Google Cloud connection?

How OpenAI, Anthropic and Microsoft fare on the same questions is covered in the other parts of the series, along with Proton as the counter-model.

Does your AI assistant search the web? Then what happens to the query belongs on your checklist.

This point is almost always overlooked when comparing providers, even though the query leaves the clean contractual framework right there. With Microsoft's web search for AI (Grounding with Bing), the contracts MCA and DPA no longer apply; Microsoft itself becomes the controller. With Google's standard search (Grounding with Google Search), search queries are stored for up to three days for debugging. At OpenAI, the public contract texts show no exception at all.

Only Google offers a variant without this storage, Web Grounding for Enterprise, making it, according to the Zurich law firm VISCHER, so far the only provider whose web search can also be used with professional-secrecy data. The catch lies in access: the necessary addendum requires a special form of billing (offline billing) and is, according to VISCHER, "very cumbersome" to obtain; small law firms wait months.

Our conclusion: a signed addendum with the standard search still active does not close the gap. And users notice nothing, because they do not control what the system hands to the search.

An assessment, not legal advice. The article covers the four conditions for professional-secrecy data, the question of the Swiss region, and the full offer comparison table. Link in the comments.

#AI #DataProtection #GoogleCloud #Switzerland