Google Meet and GDPR: What to Check Before Using It

Google Meet can store your recordings and transcripts in Europe, provided your Google Workspace edition allows the "data region" setting and your admin has selected it. Without this setting, Google imposes no localization. Google contractually commits not to use your data to train its models without your permission. Google remains a US-based provider, and a European storage region does not change this legal affiliation. This page is published by Leexi, whose AI note-taking tool works with Google Meet, and only states what Google's official pages document.

Where Google Meet Hosts and Processes Your Data

By default, nowhere specific. With the right setting, in Europe.

Google Workspace offers a setting called "data regions." An admin chooses where covered data is stored.

Google Workspace, "Data covered by data regions," updated August 26, 2026 "you can choose to store your covered data in a specific geographic location (the United States or Europe)"

Two regions exist: United States or Europe, plus a "no preference" option imposing no localization. For Google Meet, covered data includes recordings (including chats in Google Drive), attendance reports, poll results, transcripts, and questions.

The setting is not available in all editions. The page "Choose a geographic location for your data" lists those with access: Business Standard and Business Plus, Enterprise Standard and Enterprise Plus, Frontline Starter, Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus. Business Starter is excluded.

Storage and Processing Are Different Settings

This point is often omitted on marketplace pages. The region setting covers data at rest for all listed editions. It covers processing only for three of them.

According to the same page, data processing coverage is "available for Frontline Plus, Enterprise Plus, and Enterprise Essentials Plus." A Business Standard organization choosing "Europe" gets European storage of Meet recordings but processing may occur elsewhere.

Two exclusions are explicitly stated.

Google Workspace, "Data covered by data regions" "Data regions cannot be applied to customer-supplied data or data types not specifically stated in this document, such as logs or cached content."

And for Gemini features: "Your organization's file sharing and data region settings do not apply to data in Gemini Notebook" (privacy hub, August 14, 2026).

What this means for you: ask your Workspace admin two things, the subscribed edition and the region setting value. Without these answers, no one can say where your meetings are.

What Google Does with Your Conversations

Google contractually commits not to train its models on your data without your permission.

This commitment is in the Google Workspace generative AI privacy hub.

Google Workspace, "Generative AI in Google Workspace privacy hub," updated August 14, 2026 "Workspace does not use customer data for training models without customer's prior permission or instruction."

The same document specifies that prompts are customer data per the Cloud Data Processing Addendum, that "your interactions with Gemini stay within your organization," and that content "won't be reviewed by human reviewers or otherwise used to train generative AI models outside of your domain without permission."

The legal strength of this commitment lies in the contract. The Cloud Data Processing Addendum defines Google's role.

Google, Cloud Data Processing Addendum, article 4.1 "Google is a processor and Customer is a controller or processor, as applicable, of Customer Personal Data."

A subcontractor acts only on instruction. This is mandated by GDPR Article 28.

GDPR, article 28, paragraph 3, point a) "processes personal data only on documented instructions from the controller"

What this means for you: Google's non-training commitment is contractual, not just stated. The caveat concerns "without prior permission": verify that no enabled function in your domain counts as permission.

Google Workspace Certifications

Google commits to maintaining ISO 27001 certification and annual SOC 2 and SOC 3 reports.

Google, Cloud Data Processing Addendum, article 7.4 "Google will maintain at least the following for the Audited Services to verify the continued effectiveness of the Security Measures: a. certificates for ISO 27001 and any additional certifications described in Appendix 4 (Specific Products) [...] ; and b. SOC 2 and SOC 3 reports produced by Google's Third-Party Auditor and updated annually based on an audit performed at least once every 12 months"

The same contract sets data fate at contract end: deletion on client instruction after a recovery period of up to 30 days, within a maximum of 180 days (article 6.2).

Credit is due: certification is contractual and audited yearly by a third party. What Google's public page does not provide is the exact certificate scope per product. It appears in Appendix 4 of the contract, available on request.

Legal Jurisdiction of the Provider

Google is a US-based provider. A European storage region does not change this.

The US Cloud Act, adopted in 2018, requires US-based communication service providers to hand over data they hold, wherever stored.

18 U.S. Code § 2713, added by Pub. L. 115-141, March 23, 2018 "A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."

What this means for you: the "Europe" setting answers "where is my data." It does not answer "which law can access it." These are distinct questions a DPO asks separately. This point is made here once and not repeated.

What This Changes for a European Team

What Leexi adds when joining a Meet meeting is a second scope, distinct from Google's: audio is transcribed and summarized on Leexi's infrastructure (AWS Paris region, language model run via Azure France in closed circuit, no training on your meetings), with a public DPA and ten named subprocessors. The integration page Google Meet describes how to connect Leexi to Meet. The compliance dossier and glossary provide definitions and documents.

Frequently Asked Questions

Can I assure my DPO that Meet recordings remain in Europe?

Yes for storage, if your edition allows the region setting (Business Standard and Plus, Enterprise Standard and Plus, Frontline, Education Standard and Plus, Enterprise Essentials Plus) and if the admin chose "Europe." Processing is covered only in Frontline Plus, Enterprise Plus, and Enterprise Essentials Plus. Logs and cached content remain outside the setting.

Does Google use my Meet meetings to train Gemini?

No without your prior permission or instruction, per Workspace generative AI privacy hub (August 14, 2026). Interactions stay within your organization and are not reviewed by humans outside your domain without permission. Verify no enabled function in your domain counts as permission.

Are participants notified when a Meet meeting is recorded?

Yes. Google's Meet help page states participants receive notification at recording start and stop. This notification does not replace GDPR-required organizer information on purpose and retention.

Where does the recording go and who has access?

In the organizer's Google Drive, in a "Meet" folder with a subfolder per meeting. Access follows your organization's Drive sharing rules. Only certain editions allow recording: Business Standard and Plus, Enterprise, Essentials, Education Plus, Workspace Individual.

What happens to my data at the end of my Google Workspace contract?

The Cloud Data Processing Addendum (article 6.2) provides for deletion of all remaining customer data on client instruction at contract end, after a recovery period of up to 30 days, within a maximum of 180 days, unless legal retention applies.

Is Google Meet sufficient for a strict sovereignty requirement?

No. Google is a US-based provider subject to 18 U.S. Code § 2713 regardless of storage location. The "Europe" setting localizes data but does not change the law that can access it. For this requirement, the criterion is the provider's legal jurisdiction, not the datacenter region.

Sources

Data verified September 2, 2026 on Google's official pages.

• Google Workspace, "Data covered by data regions," updated August 26, 2026
• Google Workspace, "Choose a geographic location for your data," updated August 26, 2026
• Google, Cloud Data Processing Addendum, articles 4.1, 6.2, 7.4, 10, and 11
• Google Workspace, "Generative AI in Google Workspace privacy hub," updated August 14, 2026
• Google Meet Help, "Record a video meeting"
• GDPR, articles 5 and 28, text published by CNIL
• 18 U.S. Code § 2713, Legal Information Institute, Cornell Law School

This page describes the applicable framework. It does not constitute legal advice.