Collaboration
GDPR Google Workspace
In an indie stack, Google Workspace is used for Messaging, documents, and organization identity. Entity cited: For a Google Workspace contract, the contracting-entities page defines “Google” according to the billing address: Google Cloud France (8 Rue de Londres, Paris 75009) if it is in France; Google Cloud EMEA Limited for EMEA outside France, Italy and Poland; Google Cloud Italy S.r.l. in Italy; Google Cloud Poland Sp. z o.o. in Poland; Google LLC for the United States and any place not listed.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA Google Workspace
Yes. Cloud Data Processing Addendum, which also covers Google Workspace.
Stated role
The Cloud Data Processing Addendum (formerly the Workspace addendum) designates Google as processor and the customer as controller or processor of Customer Personal Data. The “Google” entity is the one on the contracting entities page, according to the billing address.
Personal data
Data relating to individuals provided to Google through the services, by the customer or on the customer's instruction, or by end users.
Sub-processors of Google Workspace
Workspace sub-processor list.
Transfers outside the EU
Hosting / location
Any country where Google or its sub-processors have facilities, subject to the location commitments in the service-specific terms. The locations of Workspace and Cloud Identity data centers are referred to google.com/about/datacenters/locations/.
EU–United States Data Privacy Framework
Google LLC is registered. EU-U.S. Data Privacy Framework status: Active (HR and non-HR data). The certification covers Google LLC and its 100%-owned US subsidiaries.
Cookies
The Google cookies page states that, on Google services, the SID and HSID cookies contain a signed and encrypted Google account identifier and the time of the last sign-in, and last for two years. Cookies set by Workspace on a customer's site: not disclosed.
Typical use, written by StackLégal and not by the vendor: Messaging, documents, and organization identity.
History
Last update: October 4, 2026.
Contracting entity, role, and cookies cross-checked against the official Google pages.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is Google Workspace a processor within the meaning of the GDPR?
The Cloud Data Processing Addendum (formerly the Workspace addendum) designates Google as processor and the customer as controller or processor of Customer Personal Data. The “Google” entity is the one on the contracting entities page, according to the billing address.
What DPA does Google Workspace publish?
Yes. Cloud Data Processing Addendum, which also covers Google Workspace. https://cloud.google.com/terms/data-processing-addendum
Which further sub-processors does Google Workspace publish?
Workspace sub-processor list. https://workspace.google.com/intl/en/terms/subprocessors.html
Where does Google Workspace state that it processes data, including outside the EU?
Any country where Google or its sub-processors have facilities, subject to the location commitments in the service-specific terms. The locations of Workspace and Cloud Identity data centers are referred to google.com/about/datacenters/locations/.
Is Google Workspace registered under the EU–United States Data Privacy Framework?
Google LLC is registered. EU-U.S. Data Privacy Framework status: Active (HR and non-HR data). The certification covers Google LLC and its 100%-owned US subsidiaries. https://www.dataprivacyframework.gov/participant/5780
Which personal data does Google Workspace mention?
Data relating to individuals provided to Google through the services, by the customer or on the customer's instruction, or by end users.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.