Google Forms and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Google's Workspace terms (12.11 Training Restriction) say it will not use Customer Data to train or fine-tune its generative AI models without the customer's prior permission or instruction. Forms is a Workspace core service.

Vendor's wording: “Google will not use Customer Data to train or fine-tune any of its generative artificial intelligence models supporting the Google Workspace Generative AI Services without Customer's prior permission or instruction.”

Source: workspace.google.com12.11 Training RestrictionSecond source: support.google.comChecked on 19 October 2026

Not a single named country: Google's infrastructure is spread across data centres around the globe, and no default country is named for Forms responses.

Vendor's wording: “Google's infrastructure is strategically distributed across multiple data centers around the globe.”

Source: support.google.comWhere does Google store my data?Checked on 19 October 2026

EU hosting available.

Yes. On Business Standard an admin can set a data region of European Union or United States; Google Forms text, images, responses and draft responses are covered by Fundamental Data Regions. Business Starter is not supported.

Vendor's wording: “Google Forms Text, embedded images, responses, and draft responses”

Source: support.google.comData covered by data regions, Google FormsChecked on 19 October 2026

DPA in the terms.

Yes. The Cloud Data Processing Addendum is incorporated into the Workspace agreement; the customer accepts it online in the Admin console.

Vendor's wording: “This Cloud Data Processing Addendum (including its appendices, the “Addendum”) is incorporated into the Agreement(s) (as defined below) between Google and Customer.”

Source: workspace.google.comCloud Data Processing Addendum, overviewChecked on 19 October 2026

Published.

Yes, public at https://workspace.google.com/terms/subprocessors/: Core Services table has 14 third-party entities and 45 Google group entities (59 in total). It names no AI model providers.

Vendor's wording: “Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Workspace Core Services”

Source: workspace.google.comThird-Party Subprocessors (Core Services)Checked on 19 October 2026

On the list.

Active (Google LLC; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Google LLC'Checked on 19 October 2026

Kept until the customer deletes it. After a deletion Google removes the data within a maximum of 180 days; at the end of the term it also deletes remaining customer data. No Forms-specific retention period is published.

Vendor's wording: “Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days”

Source: workspace.google.comCloud Data Processing Addendum, 6.1 Deletion by CustomerChecked on 19 October 2026

Partly. Admins can turn the Gemini app off for users, and on supported editions switch Gemini features on or off in Gmail, Drive, Docs, Meet and Chat; Google Forms is not named in that list.

Vendor's wording: “Admins manage access to the Gemini app and can choose to disable the service.”

Source: support.google.comPrivacy hub: As an admin, can I turn Gemini on and off for users?Checked on 19 October 2026

€13.60 / user / mo.

EUR 13.60 per user per month, excluding tax (Business Standard). Google Forms is included, with no separate price. A first-3-months 50% promotion is also shown.

Vendor's wording: “Price is per user/month and does not include tax”

Source: workspace.google.comBusiness Standard card, price detailsChecked on 19 October 2026