> Source: https://souverana.ch/insights/google-gemini-datenschutz-en/ > Language: en # Google Gemini & data protection: what SMEs need to know Google is the only large cloud provider with an AI web search usable with professional-secrecy data, but makes access cumbersome. The professional-secrecy addendum alone is not enough while the standard web search stays active. Analysis · Published 21 Jul 2026 · Updated 21 Oct 2026 · Joel Barmettler ## Is Google Gemini usable in compliance with data protection law for Swiss companies? **Swiss firms can use Google’s AI assistant Gemini, provided it runs under the Google Cloud contract, in Workspace or through the API. For professional-secrecy data, according to the Zurich law firm VISCHER, an addendum that is very cumbersome to obtain and the Enterprise variant of web search are needed. VISCHER considers the Gemini apps for individual users unsuitable.** **In brief** - Check first which contract your Gemini runs under. VISCHER considers the Gemini apps for individual users and the free Business Edition unsuitable for business use. - Anyone handling professional-secrecy data, for example in a law firm or medical practice, should start the process for the professional-secrecy addendum early. Without the right contacts, VISCHER says it is “very cumbersome” to obtain, and smaller firms wait months. - The addendum does not yet protect the web search. If Gemini searches the internet to answer, the standard search stores the query for up to three days. The Enterprise variant of web search must therefore be active as well. - Anyone who needs processing in Switzerland must fix the region contractually. Google’s newest models increasingly run on servers somewhere in the EU, even though a Swiss region exists in Zurich. - Anyone using Gemini as a coding aid in the terminal (Gemini CLI) has needed a licensed Code Assist tier since June 2026. Free access for individual users was discontinued. The Zurich law firm VISCHER (authors Lucian Hunger and Jonas Baeriswyl) has maintained a market overview of data protection in AI tools for years; the Google section was updated in July 2026. The firm writes that no cloud provider has so far “satisfactorily resolved” the contract for professional-secrecy data together with the Abuse Monitoring opt-out (the waiver of manual review of requests by the provider’s staff).[1] We quote this legal assessment explicitly because Souverana is not a law firm. What we contribute is the architecture question: where your model actually runs, and how you get access to the addendum in practice. This is the third part of our series “Provider Data-Protection Check”, following the same grid as the others: contracts, data residency, professional secrecy, routes around the gaps. **Series · Provider Data-Protection Check** 1. [Is ChatGPT GDPR-compliant? What OpenAI's contracts cover](https://souverana.ch/en/insights/chatgpt-dsgvo-konform/) 2. [Anthropic Claude and Swiss data protection: what to check](https://souverana.ch/en/insights/anthropic-claude-datenschutz/) 3. Google Gemini & data protection: what SMEs need to know (this part) 4. [Using Microsoft Copilot safely: what data protection allows](https://souverana.ch/en/insights/microsoft-copilot-datenschutz/) 5. [Proton Lumo: what privacy-friendly AI looks like](https://souverana.ch/en/insights/proton-lumo/) ## What VISCHER objects to in Google Gemini Google has reorganised and partly renamed its offering over the past months. For companies, one question ultimately matters: does the product run under the “Google Cloud Terms of Service” or under a different contract? VISCHER considers only offerings under the GCP contract fundamentally suitable for business use, such as Gemini in Workspace, Gemini Enterprise Standard/Plus/Frontline, or the API through the former Vertex AI platform.[1] The “Business Edition” sounds like a business-customer version, but in VISCHER’s assessment neither variant is really built for that. The free one lacks the GCP contract, and Google may use the data for its own purposes. The paid one lacks a general confidentiality clause. For offerings that run under the GCP contract, by contrast, a data processing agreement applies, which Google calls its “Cloud Data Processing Addendum.”[1] As soon as an AI model is allowed to search the internet, it leaves the protected environment. This is exactly where VISCHER’s overview shows the biggest difference from Microsoft. In the standard variant, “Grounding with Google Search” (the model bases its answer on a Google search), Google may store search queries for up to three days for its own debugging, which the contract declares part of the service. In the free version of Google AI Studio, this goes further still: there, Google also uses web-search data for testing its own systems.[1] > **VISCHER on web search** > > “Google offers, unlike Microsoft, an ‘Enterprise’ variant of Web Grounding \[…\] with no storage for debugging, usable with professional/official secrecy data \[…\]. To our knowledge, Google is so far the only provider that does this.” According to VISCHER, Web Grounding for Enterprise is available in the API through the Agent Platform. For Gemini Enterprise Standard/Plus/Frontline, the documentation is unclear. For companies that need a web search and handle sensitive data, this is the decisive difference from Microsoft and OpenAI: according to the same overview, both so far offer no comparable enterprise web search.[1] Anyone procuring through the Google Cloud Platform can also choose other models instead of Gemini, including those from Anthropic. The contracting party is Google. According to Anthropic’s own contract terms, Anthropic has no access to the customer’s Google Cloud environment in this case, or to the data processed there, with the exception of a few specially regulated models. ## Gemini CLI: from free tool to enterprise licence VISCHER’s overview does not separately cover Gemini CLI, Google’s command-line tool for coding work. What follows is our own research into Google’s public disclosures, as of July 2026, and is not an assessment by VISCHER. The picture has changed since spring. > **Risk** > > According to Google’s own announcement, Google discontinued access for individual users on 18 June 2026. Since then, Gemini CLI and its associated extensions for development environments (IDE) have no longer been available to the free and personal-customer tiers (Google AI Pro, Google AI Ultra).[2] Google instead points individual users to a new tool called Antigravity CLI, which according to industry reports is not open source (Google itself does not name the licence); we have not independently reviewed its data protection terms. Companies with a Gemini Code Assist licence (Standard or Enterprise) are not affected by this change: their access to Gemini CLI and the IDE extensions continues, under the same GCP contract that also applies to Gemini Enterprise. For this licence tier, Google makes clear commitments: prompts and responses are processed statelessly, that is, not stored, and do not flow into training without explicit permission.[3] The Enterprise tier is certified under, among others, ISO 27001, 27017, 27018 and SOC 1/2/3.[4] The data residency (the country in which the data is stored) can also be set. The same limitation applies as for Gemini itself: Switzerland is not part of the EU multi-region endpoint, so a region must be chosen deliberately. For your company, that means that only the licensed Code Assist variant belongs in production use. A personal Google account with an API key from the free offering is unsuitable for this. ## Professional secrecy: what already works today For law firms, doctors, trustees and public authorities, Swiss law imposes [professional and official secrecy](https://souverana.ch/en/insights/berufsgeheimnis-cloud/). VISCHER names four conditions for Google Gemini to be usable for this: 1. **Additional contract**: A separate contract for professional and official secrecy data must be in place, in addition to the standard GCP contract. 2. **Abuse Monitoring off**: Manual review of requests by Google staff must be switched off. Automated technical filters remain unproblematic. 3. **Web Grounding for Enterprise**: The Enterprise variant must be used instead of the standard web search, or web search stays off entirely. 4. **Zero Data Retention and Access Approval**: Recommended: disable caching so that Google retains no data (zero data retention), and set up Access Approval so that Google access requires your consent. This is technically solvable, VISCHER writes. The bottleneck is elsewhere: “The ‘ordinary’ GCP contract can be concluded online, but the addendum needs offline billing \[…\], which Google usually offers only to larger customers.” Smaller institutions, such as a law firm, normally obtain this contract only through personal contacts, and according to VISCHER this can take months. VISCHER states that it has already brokered several such contracts.[1] At Microsoft, the comparable addendum is easier to obtain: any certified Cloud Solution Provider (a reseller of Microsoft services) can offer it, without involving Microsoft itself. ## The EU compute pool: Zurich exists, but is not guaranteed VISCHER supplies the contractual assessment. What their overview does not answer: where exactly does the server that actually processes your request stand? A look at Google’s own model catalogue gives a first answer. > **46 models** That is how many AI models Google's Vertex AI Model Garden lists for the Zurich cloud region (europe-west6), from Google itself and from third parties such as Anthropic, DeepSeek or Alibaba. A snapshot; the catalogue changes continuously. > > Source: Google Cloud, Vertex AI Model Garden, europe-west6 region, as of July 2026 A Swiss cloud region therefore exists, and it offers many models. The newest flagship Gemini models of the 3 series, however, are mostly reachable there only through the EU multi-region endpoint, a shared access point for several EU locations. The request is then processed “somewhere in the EU”, with no fixed location such as Zurich assigned to it. Older endpoints bound to a single EU region (single-region) currently offer Gemini 2.5 Pro and 2.0 Flash, that is, models of an older generation.[1] > **Risk** > > This matches an observation VISCHER makes independently for the whole industry: the trend runs “away from nationally fixed processing locations.” The top models initially ran partly in Switzerland, then only in selected EU data centres. Google now offers some of its models only somewhere in the EU, for load-balancing reasons.[1] The server location changes nothing about corporate affiliation: as a US company, Google remains subject to the US CLOUD Act, regardless of whether the data sits in Zurich, Frankfurt or elsewhere in the EU. A case at Microsoft in 2025 showed how real this risk is: when the US government sanctioned the chief prosecutor of the International Criminal Court, his Microsoft account was blocked shortly afterwards, despite a server location in Europe. The law applies equally to every US hyperscaler, Google included. [We examine the case in more detail](https://souverana.ch/en/insights/was-ist-souveraene-ki/). ## Where Google Gemini stands on the sovereignty scale The contract question is one layer. The other is the architecture: which legal jurisdiction the processing really falls under, how open the model behind it is, where operation actually runs, and whether you can leave the system if necessary. How we understand sovereignty in general is set out in our foundational article [What is sovereign AI?](https://souverana.ch/en/insights/was-ist-souveraene-ki/). The same six axes apply concretely to Gemini and the Agent Platform: less sovereign more sovereign → Legal jurisdiction US EU Switzerland Model closed open weights open + training data Software proprietary open code true open source Operation US cloud Swiss provider in-house Data provider trains on it contractually prohibited technically impossible Integration proprietary API open standards in-house On legal jurisdiction, Gemini sits in the middle for most companies today: the EU pool as the standard case, a Swiss region as an option, but without a guarantee for the newest models, as the previous section shows.[5] On operation, Gemini sits fully on the left: it runs at a hyperscaler, a large cloud provider. The flagship model cannot be self-hosted; the next section returns to this. On integration, Google has an advantage in one respect: Web Grounding for Enterprise is not an open interface, but it is the only web search among the three large providers that can be used with professional-secrecy data. ## The escape route: Gemma Gemma is one exception to the lock-in to the cloud provider: with it, Google publishes its own family of open models that you may download and run on your own or Swiss infrastructure, independent of Google’s cloud.[6] That gives Google the same escape route that Microsoft offers through Azure AI Foundry and OpenAI through its gpt-oss model. This matters for the sovereignty assessment because it separates the model axis from the other five. Anyone who uses Gemini stays tied to Google Cloud for legal jurisdiction, operation and integration. If you instead run a Gemma model [at a Swiss or European host](https://souverana.ch/en/insights/souveraene-ki-infrastruktur/), all three change. If an open model’s performance covers the task, operation no longer has to sit with Google. ## Where to start Before signing your next Google contract or extension, clarify these four points. The most important is access to the professional-secrecy addendum. 1. Who is your contact at Google for the addendum? Without a personal contact, activation takes months according to VISCHER.[1] 2. Are all four conditions from the section “Professional secrecy: what already works today” implemented? A signed addendum with the standard web search still active does not close the gap. 3. Which region does your booked model run in: a fixed one, or the EU pool? 4. Would a self-operated Gemma model give individual use cases more control than the Google Cloud connection? > **An example from practice** > > VISCHER states that it deploys Gemini under a Google contract with the professional-secrecy addendum, the Abuse Monitoring opt-out and zero data retention, on EU data centres, including unrestricted web search through Web Grounding for Enterprise.[1] As a second source, the firm also uses Microsoft Azure OpenAI Services, likewise with the professional-secrecy addendum, but without web search. One model as the primary source, a second as a safeguard: this pattern transfers to other industries. Want Google Gemini or Vertex AI set up properly, with the professional-secrecy addendum, Web Grounding for Enterprise and Access Approval configured correctly? [Architecture & Solution Selection](https://souverana.ch/en/leistungen/ki-architektur/) How OpenAI, Anthropic and Microsoft fare on the same questions is covered in the other parts of the series, along with Proton as the counter-model. ## Sources [1] Lucian Hunger and Jonas Baeriswyl. «Marktübersicht zum Datenschutz bei KI-Tools (Google-Teil)». VISCHER. July 2026. Rechtliche Marktübersicht, Sekundärquelle (ohne URL im Artikel). The author Joel Barmettler AI Architect · Souverana, Zurich Joel Barmettler guides Swiss companies from AI strategy to integration: sovereign, confidential and production-ready. He built the Swiss AI Hub as its architect and today co-owns its architecture; he personally leads every Souverana mandate. Mandates from one-person firms to Fortune 500 corporations. [Book an intro call](https://meet.brevo.com/joel-barmettler/30-minute-meeting) [More about Souverana](https://souverana.ch/en/) [LinkedIn](https://www.linkedin.com/in/joel-barmettler-b9ab361b7) ## Frequently asked questions Is Google Gemini usable in compliance with data protection law for Swiss companies? Yes, provided the right offering is chosen. According to the Zurich law firm VISCHER, only products under the Google Cloud contract are suitable for business use, such as Gemini in Workspace, Gemini Enterprise Standard/Plus/Frontline or the API through the Agent Platform. The free app version and the free Business Edition are not. What is the difference between Gemini Enterprise and Vertex AI? Gemini Enterprise is Google's AI offering for employees in companies. Vertex AI was the former name of the platform through which developers use models via an interface (API), now the 'Gemini Enterprise Agent Platform'. The platform runs under the Google Cloud contract and is, in principle, suitable for confidential data, including the professional-secrecy addendum. What is Web Grounding for Enterprise? Web Grounding for Enterprise is a variant of Google's web search for AI models: the model bases its answer on search results, and Google stores no data for its own debugging. According to the Zurich law firm VISCHER, Google is so far the only large cloud provider whose web search can also be used with professional-secrecy data. Can a law firm or a medical practice use Google Gemini? In principle yes. Required are an addendum contract for professional and official secrecy, Abuse Monitoring (manual review of requests by Google staff) switched off, and the enterprise web search Web Grounding for Enterprise. Access to the addendum is more demanding at Google than at Microsoft, and is usually obtained only through contacts or larger volumes. Does Google Gemini run in Switzerland? Google operates a cloud region in Zurich with a broad model catalogue. The newest, flagship Gemini models, however, are often reachable in it only through the EU compute pool, that is, through servers in the EU with no fixed assignment to a region. Guaranteed processing exclusively in Switzerland therefore does not hold consistently for the newest models. Is Gemini CLI suitable for business use? Gemini CLI is Google's coding assistant for the terminal. In a business it is suitable only through a licensed Gemini Code Assist tier (Standard or Enterprise), under the same Google Cloud contract as Gemini Enterprise and with the same commitments on non-storage and training. Free individual-user access was discontinued on 18 June 2026. ## Glossary - **Professional and official secrecy**: The criminally protected duty of confidentiality of authorities (official secrecy, Art. 320 of the Swiss Criminal Code) and a list of professions named in the law (Art. 321), such as lawyers, doctors and pharmacists. It applies independently of data protection law and reaches further. Banking secrecy sits separately in the Banking Act. - **API**: A programming interface through which software addresses a language model directly, without a chat interface. Usually billed per token. - **Data Processing Agreement (DPA)**: The contract that governs how a provider may process personal data on a customer's behalf. Without a signed DPA, a cloud provider is not considered bound under data protection law. - **RAG**: Retrieval-Augmented Generation: before answering, the model receives matching excerpts from your own documents and answers with evidence instead of from memory. - **Open source (AI)**: More than open weights: the training code and details of the training data are disclosed too, under a free licence. The Open Source Initiative published a definition for this in 2024. The Swiss Apertus model meets it; many models marketed as "open" only partially do. - **Prompt**: The input to a language model: question, instruction and any text sent along. What is in the prompt determines the answer and the cost. - **Load balancer**: A component that distributes requests over the available GPUs and machines so that none is overloaded and none has to wait for the slowest. - **US CLOUD Act**: A 2018 US law: American providers must hand over data under their control regardless of where in the world the servers stand. It also reaches the European data centres of US corporations. - **Open weight**: Models whose weights are publicly available and may be self-hosted (e.g. Apertus, DeepSeek, Llama). A precondition for sovereign operation without vendor lock-in.