Google Workspace and GDPR Compliance

Date: 10 November 2025
Purpose: Guide for GDPR-compliant use of Google Workspace in parish management

Overview

Google Workspace can be used in a manner that is compliant with the GDPR, but ultimate compliance is a shared responsibility between Google and the customer (data controller). Google provides the necessary contractual commitments, infrastructure, and tools, but the customer must configure the services correctly and implement appropriate internal policies.

Google’s Responsibilities and Provisions

Google acts as a data processor and provides robust measures to facilitate GDPR compliance for its customers (data controllers). Key provisions include:

Data Processing Agreement (DPA)

Google offers a Data Processing Amendment (DPA) that customers must review and accept via the Admin Console
This legally binding contract outlines Google’s commitment to comply with GDPR requirements regarding the processing of customer data

International Data Transfers

The DPA incorporates the EU’s Standard Contractual Clauses (SCCs)
Google participates in the EU–U.S. Data Privacy Framework
Provides legal mechanisms for data transfers outside the EU to third countries while ensuring adequate protection

Security Measures

Industry-leading technical and organizational security measures
Encryption of data at rest and in transit
Robust access controls and incident management procedures

Certifications and Audits

Regular independent third-party audits
Certifications including ISO/IEC 27001, 27017, 27018, 27701, and SOC 2/3
Customers can use these certifications for their own risk assessments

Transparency

Audit logs allow administrators to monitor user and Google staff activity (with Access Transparency)
Documentation provided to assist in privacy assessments

Data Subject Rights Assistance

Built-in tools in the Admin Console to help customers manage data subject requests (DSARs)
Support for rights to access, rectify, export, or delete data

Subprocessor Oversight

Public list of subprocessors involved in providing the services
All subprocessors bound by written data protection obligations

Customer’s Responsibilities

To achieve full GDPR compliance, the organization using Google Workspace must take several essential steps:

1. Accept the DPA

The customer must explicitly opt-in and accept the Data Processing Amendment in the Admin Console

2. Configure Services Correctly

Use available security and privacy controls effectively
Enforce strong passwords and two-factor authentication
Implement data loss prevention (DLP) policies
Define data retention rules in Google Vault

For data processing activities requiring user consent, obtain, manage, and document explicit user consent
Examples include certain uses of Google Forms on public websites

4. Conduct DPIAs

Perform Data Protection Impact Assessments (DPIAs) for high-risk data processing activities

5. Train Employees

Educate staff on GDPR basics
Train on secure data handling practices
Ensure understanding of internal privacy policies

6. Document Processes

Maintain documentation of data processing activities
Have an incident response plan in place

When using Google Workspace as an email account, several specific considerations under the GDPR are crucial for the customer (data controller) to manage effectively:

1. Lawful Basis for Processing

Organizations must establish a clear legal basis for processing personal data within emails, which includes employee email addresses and the content of communications.

Employee Data:

Processing employee emails is often based on the necessity of a contract (employment contract) or the organization’s legitimate interests

External Communications:

For marketing emails, explicit, opt-in consent is almost always required
For other business-to-business (B2B) cold emails, legitimate interest might be applicable, provided a balancing test is conducted and recipients can easily opt-out

Transparency:

The organization’s privacy policy must clearly inform individuals about how their email data is used, how it was obtained, and their rights regarding that data

2. Data Minimization and Retention

Email accounts often accumulate vast amounts of data, which must be managed according to the GDPR principles of data minimization and storage limitation.

Retention Policies:

Establish and enforce clear data retention policies for emails
Use Google Vault to define how long emails are retained
Ensure emails are deleted when no longer necessary for their original purpose

Regular Review:

Regularly review stored emails and attachments to purge unneeded personal data

3. Security and Access Controls

Email is a primary vector for data breaches, making robust security configurations essential.

Authentication:

Enforce strong, mandatory two-factor authentication (2FA) to prevent unauthorized access to email accounts

Encryption:

Google provides encryption of data in transit and at rest by default
For highly sensitive data, consider client-side encryption (CSE) where the organization manages its own encryption keys

Data Loss Prevention (DLP):

Configure Gmail’s DLP rules to scan and block sensitive information from being sent to unauthorized external parties

Access Monitoring:

Utilize the Admin Console’s audit logs to track who accesses email data, when, and from where
Essential for demonstrating accountability

4. Responding to Data Subject Requests (DSARs)

GDPR grants individuals rights over their personal data, including the right to access, rectify, or erase their email data.

Procedures:

Define efficient internal procedures to use Google’s built-in search and export tools
Use Google Vault to locate all emails related to a specific individual
Respond to DSARs within the one-month timeframe required by the GDPR

Deletion:

When an individual requests deletion (“right to be forgotten”), ensure the data is permanently removed
Adhere to set deletion schedules

5. Employee Training

Employees are the primary users of email and a potential weak point in the compliance chain.

Awareness:

Regular training on GDPR principles
Education on how to handle personal data securely in emails
Training to recognize phishing attempts
Understanding of internal procedures for reporting incidents or handling data subject requests

Implementation Checklist

Initial Setup

Accept Google’s Data Processing Amendment in Admin Console
Review and understand Google’s subprocessor list
Configure organization-wide security settings
Set up Google Vault for retention and eDiscovery

Security Configuration

Enable mandatory 2FA for all users
Configure DLP rules for sensitive data
Set up audit logging and monitoring
Implement access controls based on roles

Policy Implementation

Establish email retention policies
Create data subject request procedures
Develop incident response plan
Document all data processing activities

Ongoing Compliance

Conduct regular security training
Perform periodic DPIAs for high-risk activities
Review and update privacy policies
Monitor compliance with retention schedules

Comparison with Other Providers

Feature	Google Workspace	Mailbox.org	Spacemail
Data Center Location	Global (EU available)	Germany (EU)	United States
GDPR Compliance	Strong with DPA	Excellent (built-in)	Problematic
DPA Available	Yes (must accept)	Yes	Complex/unclear
Email Security	Advanced (Gmail security)	High (PGP support)	Basic
Admin Controls	Comprehensive	Good	Limited
Data Subject Tools	Built-in DSAR support	Available	Limited
Cost	$6-12/user/month	€1-3/user/month	~$0.88/user/month

Recommendations for Parish Management

Use Google Workspace if you need advanced collaboration tools and have dedicated IT staff to manage compliance
Accept the DPA immediately in the Admin Console
Implement strict 2FA policies for all users
Use Google Vault for automatic retention and deletion
Train staff regularly on GDPR email handling
Document all procedures for data subject requests
Consider Mailbox.org for simpler email-only needs with built-in GDPR compliance

Conclusion

Google Workspace provides a strong foundation for GDPR compliance, but successful implementation relies heavily on the customer’s proper configuration and governance of the services. For parish management applications, the choice between Google Workspace and alternatives like Mailbox.org should be based on the complexity of needs, available technical expertise, and resource allocation for compliance management.

Document Status: Approved
Review Date: 6 months from implementation date
Related Documents: Email Provider Comparison, Data Security, Data Subject Rights