Google Gemini & data protection: what SMEs need to know

Is Google Gemini usable in compliance with data protection law for Swiss companies?

Yes, though the contract decides compliance, not the product. Only offerings under the Google Cloud contract are suitable for businesses, such as Gemini in Workspace, Gemini Enterprise or the API. For professional and official secrecy data, the addendum alone is not enough: without the Enterprise variant of web search, the gap stays open. This assessment comes from the Zurich law firm VISCHER.

In brief

• Check first which contract your Gemini runs under. VISCHER considers the Gemini apps and the free Business Edition unsuitable for business use.
• Anyone handling professional-secrecy data should initiate the addendum early. Without the right contacts, VISCHER says it is “very cumbersome” to obtain, and smaller firms wait months.
• Switch web search to the Enterprise variant while you are at it. A signed addendum with the standard search still active does not close the gap.
• Anyone who needs processing in Switzerland must fix the region contractually. Google’s newest models increasingly run in the EU compute pool, even though a Swiss region exists in Zurich.
• If you use Gemini for coding, you need the licensed Code Assist variant since June 2026. The individual-user version was discontinued.

The Zurich law firm VISCHER (authors Lucian Hunger and Jonas Baeriswyl) has run a market overview of data protection in AI tools for years; the Google section was updated in July 2026. The firm writes that, for no cloud provider, has the contract for professional-secrecy data together with the Abuse Monitoring opt-out so far been “satisfactorily resolved.” We quote this legal assessment explicitly here, because Souverana is not a law firm. What we contribute is the architecture question: where your model actually runs, and how you get access to the addendum in practice.

This is the third part of our series “Provider Data-Protection Check”, following the same grid as the others: contracts, data residency, professional secrecy, routes around the gaps.

What VISCHER objects to in Google Gemini

Google has reorganised and partly renamed its offering over the past months. For companies, one single fork ultimately matters: does the product run under the “Google Cloud Terms of Service,” or under a different contract? VISCHER considers only offerings under the GCP contract fundamentally suitable for business use, such as Gemini in Workspace, Gemini Enterprise Standard/Plus/Frontline, or the API through the former Vertex AI platform.

The “Business Edition” carries the name of a business-customer version, but in VISCHER’s assessment is not really built for that, neither in its free nor in its paid variant: the free one lacks the GCP contract, and Google may use the data for its own purposes. The paid one lacks a general confidentiality clause. For offerings that run under the GCP contract, by contrast, a data processing agreement?Data Processing Agreement (DPA)The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law. applies, which Google calls its “Cloud Data Processing Addendum.”

As soon as an AI model is allowed to search the internet, it leaves the protected environment, and this is exactly where VISCHER’s overview shows the biggest difference from Microsoft. In the standard variant, “Grounding with Google Search,” Google may store search queries for up to three days for its own debugging, contractually declared as part of the service. In the free version of Google AI Studio, this goes further still: there, Google also uses web-search data for testing its own systems.

According to VISCHER, Web Grounding for Enterprise is available with the API through the Agent Platform, and, ambiguously documented, also with Gemini Enterprise Standard/Plus/Frontline. For companies that need web search?RAGRetrieval-Augmented Generation: before answering, the model receives matching excerpts from your own documents and answers with evidence instead of from memory. and handle sensitive data, this is the decisive difference from the other two hyperscalers: according to the same overview, Microsoft and OpenAI so far offer no comparable enterprise web search.

Anyone procuring through the Google Cloud Platform can also choose other models instead of Gemini, including those from Anthropic. The contract in that case is concluded with Google, not with Anthropic: according to Anthropic’s own contract terms, Anthropic has, in this case, neither access to the customer’s Google Cloud environment nor to the data processed there, with the exception of a few specially regulated models.

Gemini CLI: from free tool to enterprise licence

VISCHER’s overview does not separately cover Gemini CLI, Google’s command-line tool for coding work. What follows is our own research into Google’s public disclosures, as of July 2026, not VISCHER’s assessment, and the picture has shifted considerably since spring.

Companies with a Gemini Code Assist licence (Standard or Enterprise) are not affected by this change: their access to Gemini CLI and the IDE extensions continues, under the same GCP contract that also applies to Gemini Enterprise. For this licence tier, Google makes clear commitments: prompts and responses are stateless, are not stored, and do not flow into training without explicit permission.Google CloudGoogle Cloud · 2026Security, privacy, and compliance for Gemini Code AssistOpen source ↗ The Enterprise tier is certified under, among others, ISO 27001, 27017, 27018 and SOC 1/2/3.Google CloudGoogle Cloud · 2026Compliance certifications and security controls (Gemini Enterprise)Open source ↗ A data residency can also be set, though the same limitation applies as for Gemini itself: Switzerland does not fall under the EU multi-region endpoint, so a region must be deliberately chosen.

For your company, that means: only the licensed Code Assist variant belongs in production use, not a personal Google account with an API key on the free tier.

Professional secrecy: what already works today

For law firms, doctors, trustees and public authorities, Swiss law imposes professional and official secrecy↗Law & Regulation · Part 3Professional secrecy and AI: what may go to the cloud'That does not work for us' is the standard answer to AI in law firms and medical practices. Art. 321 of the Swiss Criminal Code says something narrower, and most of daily work falls outside it entirely.Read article. VISCHER names four conditions for Google Gemini to be usable for this:

1. 01

   Additional contract

   A separate contract for professional and official secrecy data must be in place, in addition to the standard GCP contract.

2. 02

   Abuse Monitoring off

   Manual review of requests by Google staff must be switched off. Automated technical filters remain unproblematic.

3. 03

   Web Grounding for Enterprise

   The Enterprise variant must be used instead of the standard web search, or web search stays off entirely.

4. 04

   Zero Data Retention and Access Approval

   Recommended: disable caching for true zero data retention, and set up Access Approval so that Google access requires your consent.

This is technically solvable, VISCHER writes. The bottleneck lies elsewhere: “The ‘ordinary’ GCP contract can be concluded online, but the addendum needs offline billing […], which Google usually offers only to larger customers.” Smaller institutions, such as a law firm, normally only reach this contract through personal contacts, and according to VISCHER that can take months. The firm states it has already brokered several such contracts. Microsoft’s reseller network, by contrast, brokers the comparable addendum considerably more accessibly: any certified Cloud Solution Provider can offer it, independent of Microsoft itself.

The EU compute pool: Zurich exists, but is not guaranteed

VISCHER supplies the contractual assessment. What their overview does not answer: where exactly does the server that actually processes your request stand? A look at Google’s own model catalogue gives a first answer.

Key figure

46 models

Source: Google Cloud, Vertex AI Model Garden, europe-west6 region, as of July 2026

A Swiss cloud region exists, then, and it is well stocked. The newest, flagship Gemini models of the 3-series, however, are mostly reachable in it only through the EU multi-region endpoint, distributed “somewhere in the EU,” not fixed to Zurich. Older single-region endpoints in the EU currently carry Gemini 2.5 Pro and 2.0 Flash, also not the newest generation.

Where Google Gemini stands on the sovereignty scale

The contract question is one layer. The other is the architecture: which legal jurisdiction the processing really falls under, how open the model behind it is, where operation actually runs, and whether you can get back out of the system if in doubt. How we understand sovereignty in general is set out in our foundational article What is sovereign AI?. The same six axes apply concretely to Gemini and the Agent Platform:

less sovereign more sovereign →

Legal jurisdiction

US

EU

Switzerland

Model

closed

open weights

open + training data

Software

proprietary

open code

true open source

Operation

US cloud

Swiss provider

in-house

Data

provider trains on it

contractually prohibited

technically impossible

Integration

proprietary API

open standards

in-house

On legal jurisdiction, Gemini sits in the middle for most companies today: the EU pool as the standard case, a Swiss region as an option, but without a guarantee for the newest models, as the previous section shows. On operation, the axis stays on the left: a hyperscaler, no in-house operation, and the Gemini flagship model itself cannot be self-hosted, more on that in the next section. On integration, Google’s advantage sits in the detail: Web Grounding for Enterprise is not an open interface, but it is the only one of the three hyperscaler web searches compatible with professional-secrecy data.

The escape route: Gemma

There is, after all, one exception to the hyperscaler lock-in: with Gemma, Google publishes its own family of open models?Open weightModels whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in. that you may download and run on your own or Swiss infrastructure, independent of Google’s cloud.Google AI for DevelopersGoogle AI for Developers · 2026Gemma model overviewOpen source ↗ With that, Google too has the escape route that Microsoft offers through Azure AI Foundry and OpenAI through its gpt-oss model.

For the sovereignty calculation, that matters because it detaches the model axis from the other five: legal jurisdiction, operation and integration stay with Google Cloud when you use Gemini, but change completely as soon as you instead run a Gemma model at a Swiss or European host↗Sovereign AI · Part 3Sovereign AI infrastructure: why the model is the easy partThe language model is the most replaceable part of your AI. Why embeddings and OCR decide your lock-in, and which Swiss hosters offer every component.Read article. If an open model’s performance covers the task, operation no longer has to sit with Google.

Where to start

Before your next Google contract or the next extension, clarify four points, starting with access to the professional-secrecy addendum. First, who your actual contact at Google is for this, because without a personal contact, activation takes months according to VISCHER. Second, whether all four conditions from above are implemented: a signed addendum with the standard web search still active does not close the gap. Third, which region your booked model actually runs in, fixed or in the EU pool. Fourth, whether a self-operated Gemma model would give individual use cases more control than the Google Cloud connection.

How OpenAI, Anthropic and Microsoft fare on the same questions is covered in the other parts of the series, along with Proton as the counter-model.

Does your AI assistant search the web? Then what happens to the query belongs on the checklist.

This point is almost always overlooked when comparing providers, even though the query leaves the clean contractual framework right there. With Microsoft's Grounding with Bing, the MCA and DPA no longer apply; Microsoft itself becomes the controller. With Google's Standard Grounding, search queries are stored for up to three days for debugging. At OpenAI, the public contract texts show no exception at all.

Only Google offers a variant without this storage, Web Grounding for Enterprise, making it, according to the Zurich law firm VISCHER, so far the only provider whose web search can also be used with professional-secrecy data. The catch lies elsewhere: the necessary addendum needs offline billing and is, according to VISCHER, "very cumbersome" to obtain; small law firms wait months.

Our conclusion: a signed addendum with the standard search still active does not close the gap. And users notice nothing of it, because they do not control what the system hands to the search.

An assessment, not legal advice. The article covers the four conditions for professional-secrecy data, the question of the Swiss region, and the full offer comparison table. Link in the comments.

#AI #DataProtection #GoogleCloud #Switzerland