Google Meet and GDPR: What to Check Before Using It

Google Meet can store your recordings and transcripts in Europe, provided your Google Workspace edition allows the "data region" setting and your administrator has selected it. Without this configuration, Google does not enforce localization. Google contractually commits not to use your data to train its models without your permission. Google is a US-based company, and a European storage region does not change this relationship. This page is published by Leexi, whose AI note-taking assistant is used in Google Meet, and only reports what Google's official pages document.

Where Google Meet hosts and processes your data

By default, nowhere in particular. With the right configuration, in Europe.

Google Workspace offers a setting called "data regions." An administrator chooses where covered data is stored.

Google Workspace, "Data covered by data regions," updated August 26, 2026 "you can choose to store your covered data in a specific geographic location (United States or Europe)"

There are two regions, United States or Europe, plus the "no preference" option, which does not enforce localization. For Google Meet, covered data includes recordings (including chats on Google Drive), attendance reports, poll results, transcripts, and questions.

The setting is not available in all editions. The page "Choose a geographic location for your data" lists those with access: Business Standard and Business Plus, Enterprise Standard and Enterprise Plus, Frontline Starter, Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus. Business Starter is not included.

Storage and processing are separate settings

This point is omitted in marketplace pages. The region setting covers data at rest for all listed editions but covers processing only for three of them.

According to the same page, processing coverage is "available for Frontline Plus, Enterprise Plus, and Enterprise Essentials Plus." An organization on Business Standard choosing "Europe" gets European storage of Meet recordings, but processing may occur elsewhere.

Two exclusions are clear.

Google Workspace, "Data covered by data regions" "Data regions cannot be applied to customer-provided data or data types not specified in this document, such as logs or cached content."

And for Gemini features: "Your organization's file sharing and data region settings do not apply to data in Gemini Notebook" (privacy hub, August 14, 2026).

What this means for you: ask your Workspace administrator two things, the subscribed edition and the region setting value. Without these answers, no one can say where your meetings are located.

What Google does with your conversations

Google contractually commits not to train its models with your data without your permission.

This commitment is central to Google Workspace's generative AI privacy hub.

Google Workspace, "Generative AI in Google Workspace privacy hub," updated August 14, 2026 "Workspace does not use customer data to train models without prior permission or instruction from the customer."

The same document specifies that prompts are customer data under the Cloud Data Processing Addendum, that "your interactions with Gemini remain within your organization," and that content "will not be reviewed by humans or used to train generative AI models outside your domain without permission."

The legal force of this commitment is contractual. The Cloud Data Processing Addendum defines Google's role.

Google, Cloud Data Processing Addendum, article 4.1 "Google is a processor and the Customer is the controller or processor, as applicable, of Customer Personal Data."

A processor acts only on instruction. This is required by GDPR Article 28.

GDPR, Article 28, paragraph 3, point a) "processes personal data only on documented instructions from the controller"

What this means for you: Google's commitment not to train is contractual, not just declarative. The caveat concerns the phrase "without prior authorization": verify that no enabled function in your domain counts as authorization.

Google Workspace certifications

Google commits to maintaining ISO 27001 certification and annual SOC 2 and SOC 3 reports.

Google, Cloud Data Processing Addendum, article 7.4 "Google will maintain at least the following for the Audited Services to verify the continued effectiveness of Security Measures: a. ISO 27001 certificates and any additional certifications described in Annex 4 (Specific Products) [...] ; and b. SOC 2 and SOC 3 reports produced by Google's External Auditor and updated annually based on an audit conducted at least once every 12 months"

The same contract defines data disposition at contract end: deletion on customer instruction, after a recovery period up to 30 days, maximum 180 days (article 6.2).

Credit is due: certification is contractual and audited annually by third parties. What Google's public page does not detail is the exact scope of the certificate per product. It is in Annex 4 of the contract, available upon request.

Legal status of the publisher

Google is a US-based company. A European storage region does not change this.

The US law called the Cloud Act, enacted in 2018, requires US-based communication service providers to hand over data they hold, regardless of where it is stored.

18 U.S. Code § 2713, added by Pub. L. 115-141 on March 23, 2018 "An electronic communication or remote computing service provider must comply with the obligations of this chapter to preserve, backup, or disclose the contents of an electronic communication and any record or other information pertaining to a customer or subscriber in the provider's possession, custody, or control, regardless of where such data is located."

What this means for you: the "Europe" setting answers "where is my data." It does not answer "which law can access it." These are distinct questions handled separately by a DPO. This point is mentioned here once and will not be repeated.

What changes for a European team

What Leexi adds by connecting to a Meet meeting is a second scope, distinct from Google's: audio is transcribed and summarized within Leexi's infrastructure (AWS Paris region, language model executed via Azure France in a closed circuit, no training on your meetings), with public DPA and ten named subprocessors. The integration page Google Meet explains how to connect Leexi to Meet. The compliance dossier and glossary provide definitions and documents.

Frequently asked questions

Can I guarantee my DPO that Meet recordings remain in Europe?

Yes, for storage, if your edition allows the region setting (Business Standard and Plus, Enterprise Standard and Plus, Frontline, Education Standard and Plus, Enterprise Essentials Plus) and if the administrator chose "Europe." Processing is covered only in Frontline Plus, Enterprise Plus, and Enterprise Essentials Plus. Logs and cached content are outside configuration.

Does Google use my Meet meetings to train Gemini?

No without your prior permission or instruction, according to Workspace's generative AI privacy hub (August 14, 2026). Interactions remain within your organization and are not reviewed by humans outside your domain without permission. Verify that no enabled function in your domain counts as authorization.

Are participants notified when a Meet meeting is recorded?

Yes. Google's Meet help page states participants receive a notification at the start and end of recording. This notification does not replace the information GDPR requires you to provide as organizer about purpose and retention duration.

Where does the recording go and who has access?

To the organizer's Google Drive, in a "Meet" folder, with subfolders per meeting. Access follows your organization's Drive sharing rules. Only certain editions allow recording: Business Standard and Plus, Enterprise, Essentials, Education Plus, Workspace Individual.

What happens to my data at the end of the Google Workspace contract?

The Cloud Data Processing Addendum (article 6.2) provides for deletion of all remaining customer data on customer instruction at contract end, after a recovery period up to 30 days, maximum 180 days, unless legal retention obligations apply.

Is Google Meet sufficient for a strict sovereignty requirement?

No. Google is a US-based company, subject to 18 U.S. Code § 2713 regardless of storage location. The "Europe" setting localizes data but does not change the law that can access it. For this requirement, the criterion is the publisher's legal status, not the datacenter region.

Sources

Data verified as of September 2, 2026, on Google's official pages.

• Google Workspace, "Data covered by data regions," updated August 26, 2026
• Google Workspace, "Choose a geographic location for your data," updated August 26, 2026
• Google, Cloud Data Processing Addendum, articles 4.1, 6.2, 7.4, 10 and 11
• Google Workspace, "Generative AI in Google Workspace privacy hub," updated August 14, 2026
• Google Meet Help, "Record a video meeting"
• GDPR, articles 5 and 28, text published by CNIL
• 18 U.S. Code § 2713, Legal Information Institute, Cornell Law School

This page describes the applicable framework. It does not constitute legal advice.

Try Leexi for free