If for your job you use any Google services, chances are you are sending them a lot of personal data of your clients in emails, documents, etc. So technically you are the controller, and Google becomes one of your processors. Is Google's current privacy policy compliant with GDPR and also valid as the data processing agreement (DPA) between a controller (you) and a processor (them)? If not, then I guess it's illegal to use Google's services for professional purposes. If it is compliant, then I'd like to know what parts of their policy actually make it a valid DPA.

Edit: I just noticed that GDPR and DPAs are mentioned in the privacy policies of some of their products, like G-Suite and Google Cloud Platform, but I don't think this is valid in general for the privacy policy of all of their services, especially their free services. I'm sure there are millions of people who use at least one of Google's free services as part of their jobs, by the way.

  • You're right, people do. Google only get behind it and call themselves a processor when you pay them. The only way to be compliant when using free tools like Drive to process personal data within the scope of the GPR is to pay for G-Suite. – Sam_Butler Nov 19 '19 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.