Is Google Workspace GDPR Compliant in 2025?

Every week, a European business signs up for Google Workspace. They check the GDPR box in their head - Google is compliant, right? They have data centres in Europe, a DPA on file, and a privacy policy that runs to 47 pages. That should cover it. It doesn't.

What GDPR Compliance Actually Requires

GDPR compliance isn't a certificate you earn once. It's a set of ongoing obligations about where data is processed, who can access it, under what legal authority, and what happens when something goes wrong. Signing Google's Data Processing Addendum (DPA) satisfies one of those obligations. It doesn't satisfy all of them.

The distinction that matters most for EU businesses is between data stored in Europe and data controlled by a European entity. Google can store your data on servers in Frankfurt or Dublin. But Google LLC - a US company - remains the infrastructure operator. And that creates a problem that storage location alone cannot fix.

The CLOUD Act Override

The US CLOUD Act (2018) requires American technology companies to produce data when served with a valid US government order - regardless of where that data is physically stored. A Google server in Ireland does not change Google's obligations under US law. If US authorities request your company's emails, documents, or calendar data, Google is legally required to comply.

This is not speculation or a fringe legal interpretation. It's the explicit text of the law. The European Data Protection Board has acknowledged this conflict. Several national DPAs - including the Austrian DSB and the Danish Datatilsynet - have issued guidance or decisions that reflect exactly this tension.

"GDPR asks where data is stored. The CLOUD Act asks who controls the company. Only one of those questions has a clear answer when it comes to Google."

What Google's DPA Actually Says

Google's Data Processing Addendum is a real document with real legal weight. It commits Google to processing your data only on your instructions, implementing appropriate technical measures, and notifying you of breaches. These are meaningful commitments.

What the DPA does not - and cannot - do is exempt Google from US law. No contractual document between a European customer and a US company can override a valid US government request. The DPA is a GDPR instrument. The CLOUD Act is a US statute. They operate on different legal planes, and when they conflict, the CLOUD Act wins.

The Standard Contractual Clauses Gap

Since Schrems II invalidated the EU-US Privacy Shield in 2020, Standard Contractual Clauses (SCCs) have become the default legal mechanism for transferring data outside the EU. Google uses SCCs. Most large US cloud providers do.

But SCCs come with a caveat that is easy to miss: they require a Transfer Impact Assessment (TIA). The TIA must evaluate whether the legal protections in the destination country are essentially equivalent to those in the EU. For the United States - given the CLOUD Act, FISA Section 702, and Executive Order 12333 - a rigorous TIA will struggle to reach that conclusion. Many businesses do not bother conducting one at all.

Specific Risk Areas for EU Businesses

The risk is not evenly distributed. Some categories of data are more exposed than others:

HR and employment records stored in Google Workspace carry particular sensitivity under GDPR Article 9 if they include health information, union membership, or disciplinary records.
Client communications in Gmail may include legally privileged information or commercially sensitive negotiations - data that EU clients have not consented to expose to US jurisdiction.
Financial documents in Google Drive are subject to sector-specific regulations in some EU member states that impose additional localisation requirements.
Healthcare data in any form is almost certainly incompatible with US cloud storage under multiple EU national laws, regardless of Google's general GDPR commitments.

What Regulators Are Actually Doing

Enforcement is accelerating. The Austrian DSB ruled in 2022 that using Google Analytics - a far simpler tool than Workspace - violated GDPR because data was transferred to the US without adequate protection. France's CNIL followed with similar guidance. Denmark's Datatilsynet has repeatedly signalled concern about US cloud dependencies in public-sector contexts.

The pattern is consistent: regulators are not accepting "we have a DPA and European servers" as sufficient. They are asking the harder question - who ultimately controls access to this data, and under what legal framework?

"A European server rack does not make a US company a European company. GDPR is about legal jurisdiction, not geography."

The Honest Answer

Is Google Workspace GDPR compliant in 2025? Google has taken significant steps toward compliance. The DPA is real. The European data centres are real. The SCCs are real. For businesses processing low-sensitivity data with low regulatory exposure, the practical risk may be manageable.

But for businesses processing HR data, client communications, financial records, or anything touching regulated sectors - the answer is more complicated. The CLOUD Act exposure is real. The SCC gap is real. And the regulatory direction of travel is clearly toward stricter interpretation, not more permissive.

What the Alternative Looks Like

An EU-operated productivity suite - one where the company, the infrastructure, and the legal jurisdiction are all European - does not have a CLOUD Act problem. It doesn't require a Transfer Impact Assessment to justify. It simply works within the legal framework your data is already supposed to be protected by. That's the gap InfoPeak was built to close.