Gemini API: DPA, subprocessors and data location
Where to find the Gemini API DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: llm api (google). The table is the short version; the sections below add detail.
Gemini API at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 90 days Details on objecting |
| Data regions |
|
| Transfer mechanism |
|
| Vendor role | Both: processor for some data, controller for other data. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Gemini API
The Gemini API terms split by tier. For Paid Services (a Cloud project with an active billing account) Google does not use prompts and responses to improve its products and processes them under its processor DPA. For unpaid use, Google uses submitted content to improve its products and human reviewers may read it. If your API Client is available to users in the EEA, Switzerland or the UK, the terms allow Paid Services only.
The DPA gives 30 days' email notice of a new subprocessor, and your only objection is terminating the Agreement within 90 days (section 11.4). The subprocessor page that section 11.2 points to lists RCS entities and names no Gemini API subprocessors.
The DPA lets Google process in any country where it or its subprocessors have facilities, and the Gemini API terms add that abuse-detection logs may be cached in any such country.
Gemini API DPA: where to find it and how it is accepted
Read the DPA on business.safety.google. The Gemini API terms say that for Paid Services Google processes your prompts and responses under the "Data Processing Addendum for Products Where Google is a Data Processor". The DPA takes effect on the date you clicked to accept or the parties otherwise agreed. The page shows Version 10, 7 May 2026..
Source: business.safety.google, checked 2026-10-17Plans covered: Paid Services only (Gemini API used through a Cloud project with an active billing account)
Gemini API terms, "Paid Services" and "Unpaid Services" sections. Unpaid use (unpaid quota, and AI Studio without a billed Cloud project or Workspace enterprise account) follows different data terms. For users in the EEA, Switzerland or the UK the terms say the Paid Services data terms apply to all Services, and API Clients available to users in those regions may use Paid Services only.
Source: ai.google.dev, checked 2026-10-17Gemini API subprocessors: the list and how change notices reach you
Gemini API's subprocessor list.
Source: business.safety.google, checked 2026-10-17How changes are announced: Email to the Notification Email Address you set up (section 11.4(a)).
Source: business.safety.google, checked 2026-10-17Notice before a new subprocessor starts: 30 days.
Section 11.4(a): at least 30 days before a new subprocessor processes your data, Google informs you by email to the Notification Email Address, with the subprocessor's name, location and activities.
Source: business.safety.google, checked 2026-10-17You can object within 90 days. Terminate the Agreement for convenience immediately on written notice, within 90 days of being informed of the new subprocessor (section 11.4(b)).
Section 11.4(b): you object by terminating the Agreement for convenience, on written notice given within 90 days of being informed of the new subprocessor.
Source: business.safety.google, checked 2026-10-17Source: business.safety.google, checked 2026-10-17Where Gemini API stores data
- Any country where Google or its subprocessors maintain facilities
DPA section 10.1 lets Google process data in any country where it or its subprocessors have facilities, subject to the transfer terms. The Gemini API terms add that prompt and response logs kept for abuse detection may be stored transiently or cached in any country where Google or its agents maintain facilities. We found no region choice in these two documents.
Source: business.safety.google, checked 2026-10-17How Gemini API moves data outside the EU and UK
- DPF (including UK Extension and Swiss-US DPF)
- SCCs (if no Data Transfer Solution is available)
Appendix 3A, paragraph 7: Google has adopted a Data Transfer Solution for restricted transfers, and the SCCs apply only if one is not available. Paragraph 7.4 says Google participates in the Data Privacy Framework for itself and certain wholly-owned US subsidiaries and points to dataprivacyframework.gov. Swiss FDPA transfers are covered by the same appendix.
Source: business.safety.google, checked 2026-10-17Is Gemini API a processor or a controller?
Both: processor for some data, controller for other data.
The DPA covers products where Google is a data processor, which the Gemini API terms apply to prompts and responses for Paid Services. The same terms say other data, such as account information, billing history and usage details, stays under the Google Controller-Controller Data Protection Terms.
Source: ai.google.dev, checked 2026-10-17Is Gemini API GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Gemini API's own documents say:
- A DPA is published: The Gemini API terms say that for Paid Services Google processes your prompts and responses under the "Data Processing Addendum for Products Where Google is a Data Processor". The DPA takes effect on the date you clicked to accept or the parties otherwise agreed. The page shows Version 10, 7 May 2026.
- A subprocessor list is published.
- Notice of new subprocessors: 30 days. Section 11.4(a): at least 30 days before a new subprocessor processes your data, Google informs you by email to the Notification Email Address, with the subprocessor's name, location and activities.
- Transfer mechanisms named: DPF (including UK Extension and Swiss-US DPF), SCCs (if no Data Transfer Solution is available).
- Data locations named: Any country where Google or its subprocessors maintain facilities.
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Gemini API to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Gemini API, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Gemini API | LLM API (Google) | Any country where Google or its subprocessors maintain facilities | DPF (including UK Extension and Swiss-US DPF); SCCs (if no Data Transfer Solution is available) | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Gemini API | LLM API (Google) | Any country where Google or its subprocessors maintain facilities | DPF (including UK Extension and Swiss-US DPF); SCCs (if no Data Transfer Solution is available) | [DPA](https://business.safety.google/processorterms/) | [Subprocessors](https://business.safety.google/subprocessors/) |
If you add or replace Gemini API: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Gemini API states 30 days of notice before it adds a subprocessor. Section 11.4(a): at least 30 days before a new subprocessor processes your data, Google informs you by email to the Notification Email Address, with the subprocessor's name, location and activities. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- First check: facts recorded from Google's Gemini API terms (last updated 2026-04-28) and Google's processor DPA (version 10, 7 May 2026).
- Checked whether a Gemini- or Google Cloud-specific subprocessor list applies. The Gemini API terms (updated 2026-04-28) link only to the "Data Processing Addendum for Products Where Google is a Data Processor" (business.safety.google/processorterms), whose section 11.2 says "Information about Subprocessors is available at business.safety.google/subprocessors/". That page still has no Gemini entries (last update 12 December 2025). The separate Google Cloud Platform Subprocessors list (cloud.google.com/terms/subprocessors) is for Google Cloud Platform Services and does not name the Gemini API or AI Studio, so we do not treat it as the list for this vendor. Sections 10.1, 11.2 and 11.4 re-checked against the raw text: confirmed.
Related vendors
Sources and method
- https://business.safety.google/processorterms/ checked 2026-10-17
- https://ai.google.dev/gemini-api/terms checked 2026-10-17
- https://business.safety.google/subprocessors/ checked 2026-10-17
Facts come from Gemini API's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: ai.google.dev.