Is Google&#39;s privacy policy compliant with GDPR for the data processing agreement between a controller and a processor?
<p>If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google becomes one of your processors. Is Google's current privacy policy compliant with GDPR and also valid as the data processing agreement (DPA) between a controller (you) and a processor (them)? If not, then I guess it's illegal to use Google's services for professional purposes. If it is compliant, then I'd like to know what parts of their policy actually make it a valid DPA.</p>

<p>Edit: I just noticed that GDPR and DPAs are mentioned in the privacy policies of <em>some</em> of their products, like G-Suite and Google Cloud Platform, but I don't think this is valid in general for the privacy policy of all of their services, especially their free services. I'm sure there are millions of people who use at least one of Google's free services as part of their jobs, by the way.</p>

<p>Google has many different products and product tiers, and offers DPAs for <em>some</em> of them. E.g. Google does offer DPAs for business-oriented products like Google Workspace (formerly GSuite), Google Analytics, and Google Cloud. They do not offer DPAs for consumer-oriented products such as their free Docs and Gmail offerings. Even within paid offerings, Google may sometimes act as a data processor and sometimes as a data controller, enabling them to use collected data for their own purposes. Care has to be taken by admins to disable unwanted features in order to achieve GDPR compliance.</p>
<p>Even when Google offers DPAs, that might not be sufficient to achieve GDPR compliance. Since Google does not guarantee the location of data (except for some Cloud products and higher Workspace tiers), international transfers are involved. International transfers of personal data into the US are not generally legal following the 2020 Schrems II ruling.</p>

privacy european-union gdpr