{"id":3291,"date":"2026-10-05T22:26:34","date_gmt":"2026-10-05T20:26:34","guid":{"rendered":"https:\/\/eu.klytic.com\/?page_id=3291"},"modified":"2026-10-06T17:21:30","modified_gmt":"2026-10-06T15:21:30","slug":"gdpr-google-workspace","status":"publish","type":"page","link":"https:\/\/eu.klytic.com\/en\/gdpr-google-workspace\/","title":{"rendered":"GDPR and Google Workspace: what a business needs to check"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3291\" class=\"elementor elementor-3291 elementor-3216\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-8bf656a e-con-full kly-g e-flex e-con e-parent\" data-id=\"8bf656a\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-6b866ea e-con-full kly-g-hero e-flex e-con e-parent\" data-id=\"6b866ea\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-4348170 e-con-full kly-g-hero-in e-flex e-con e-parent\" data-id=\"4348170\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-a879fe1 elementor-widget elementor-widget-text-editor\" data-id=\"a879fe1\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/#souverainete\">Sovereignty<\/a><\/p><p class=\"kly-g-pill\" style=\"--pill:#38bdf8\">Sovereignty<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c40f6e4 elementor-widget elementor-widget-heading\" data-id=\"c40f6e4\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">GDPR and Google Workspace: what a business needs to check<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6b2a1c8 elementor-widget elementor-widget-text-editor\" data-id=\"6b2a1c8\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-lead\">Google Workspace can be used within a GDPR framework. As with Microsoft 365, compliance is verified in the contract, in the region actually covered and in the ability to respond to individuals. The software vendor is an American company. That sentence opens the review. It does not close it.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b32a10b elementor-widget elementor-widget-text-editor\" data-id=\"b32a10b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>9 min<\/b> read<\/span><span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b65b576 e-con-full kly-g-body e-flex e-con e-parent\" data-id=\"b65b576\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-54388a8 e-con-full kly-g-article e-flex e-con e-parent\" data-id=\"54388a8\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d7e2523 elementor-widget elementor-widget-text-editor\" data-id=\"d7e2523\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>1. Who is the controller, who is the processor<\/h2><p>For the content your organisation places in Gmail, Drive, Docs and Calendar, you are generally the controller and Google the processor. Google also describes processing for which it is the controller, related to the account, security and the operation of the service. The Google Workspace Data Processing Amendment and the transfer annexes are the documents to file alongside the record of processing activities.<\/p><p><strong>Why.<\/strong> The role determines who informs individuals, who responds to them and who sets retention periods. For content, that is you; Google acts on your instructions, under Article 28 of the GDPR.<\/p><p><strong>How to check.<\/strong> Check that the amendment covers the services enabled, including those added after the initial order. A 30-person communications agency that started with Gmail and Drive, then opened Chat, Sites and forms, has often documented only the first two.<\/p><p><strong>In the record.<\/strong> One line per service, with Google\u2019s role, the activation date and the archived version of the amendment.<\/p><p><strong>Common mistake.<\/strong> Filing the contract signed when the account was opened and never reading it again.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ebcbbf2 elementor-widget elementor-widget-text-editor\" data-id=\"ebcbbf2\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>2. The data region does not cover everything<\/h2><p>Depending on the edition, an administrator can choose to store covered data in the United States or in Europe, and to limit part of the processing to that region. Google publishes the list: covered content at rest for Gmail, Calendar, Drive, Chat, Docs, Sheets, Slides and other core services, covered processing for some of them. The documentation states that the region policy does not apply to data it does not list, notably certain logs or cached content.<\/p><p>Practical consequences.<\/p><ul><li>An account whose edition does not include data regions is not covered, even if a rule has been set on the organisational unit.<\/li><li>Two users in different regions who write to each other may have their data stored in both regions.<\/li><li>The editions that display a residency report are not the entry-level editions.<\/li><\/ul><p><strong>Why.<\/strong> \u201cEurope region\u201d describes a listed scope, not the service as a whole. What is not listed is what your record of processing activities must account for.<\/p><p><strong>How to check.<\/strong> Ask your administrator for a screenshot of the actual setting, not the sales brochure. Cross-check it against the edition subscribed for each group of users. An industrial SME with two sites, one of which is equipped with a more modest edition, may have a region rule that applies to only half of its accounts.<\/p><p><strong>In the record.<\/strong> The edition, the region chosen, the organisational units covered, the excluded categories (logs, cache), the date of the check.<\/p><p><strong>Common mistake.<\/strong> Writing \u201cdata stored in Europe\u201d without mentioning the exclusions published by Google.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6fb816b elementor-widget elementor-widget-text-editor\" data-id=\"6fb816b\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>3. Who at Google can open a ticket<\/h2><p>Access Management makes it possible to restrict the Google personnel who act on certain support data: for example, personnel located in the EU, or working through a virtual desktop located in the EU. This feature is tied to specific editions and to the Assured Controls option. It is not the default setting on all Business plans.<\/p><p><strong>Why.<\/strong> A technician who views data to resolve an incident is processing that data. The storage location says nothing about where that access takes place.<\/p><p><strong>How to check.<\/strong> If your compliance file assumes \u201csupport only from within the Union\u201d, check that the option has been purchased and is active, and keep proof of it.<\/p><p>Client-side encryption, where available for your edition, leaves you in control of keys over a defined scope of content. It changes what Google can read. It also changes search, anti-abuse and certain collaborative features. It should be tested before being announced to business teams: a pilot with one team, with the list of what no longer works, is worth more than a general memo.<\/p><p><strong>In the record.<\/strong> The active options, their scope, and what remains accessible to support.<\/p><p><strong>Common mistake.<\/strong> Assuming the option was included in the renewal because it had been mentioned during pre-sales.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-385670a elementor-widget elementor-widget-text-editor\" data-id=\"385670a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>4. The legal basis for transfers<\/h2><p>Google is an American company. As soon as access or a copy leaves the Union, the transfer must have a legal basis. As of 5 October 2026, adequacy decision (EU) 2023\/1795 remains in force for certified US organisations, while being challenged. According to a commentary by the law firm WilmerHale, the General Court of the European Union dismissed an action for annulment on 3 September 2025, and an appeal was lodged before the Court of Justice on 31 October 2025. The law firm DAC Beachcroft, in the title of its commentary, speaks of stability for now and uncertainty ahead.<\/p><p>Standard contractual clauses remain the other usual tool. The 2020 precedent shows why you need to know them: on 16 July 2020, in judgment C-311\/18 (known as Schrems II), the Court of Justice invalidated the Privacy Shield (decision 2016\/1250), owing in particular to the scope of US surveillance programmes and the absence of effective redress. Standard contractual clauses remained valid, subject to a case-by-case assessment.<\/p><p>The details of the CLOUD Act are on the page <a href='\/en\/protect-business-cloud-act\/'>protecting a business from the CLOUD Act<\/a>: a European region does not remove Google from US law if Google holds or controls the data. Article 48 of the GDPR, for its part, provides that a judgment of a court or a decision of an authority of a third country requiring the disclosure of personal data may only be recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty, in force between that country and the Union or the Member State. A US provider operating in Europe may therefore find itself caught between two sets of rules. Article 48 describes this conflict; it does not resolve it.<\/p><p><strong>In the record.<\/strong> The tool your contract uses, and the fallback plan should the adequacy decision fall.<\/p><p><strong>Common mistake.<\/strong> Thinking that the data region (point 2) answers the transfer question. It says where certain data is stored, not who can access it or under which law.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d9db728 elementor-widget elementor-widget-text-editor\" data-id=\"d9db728\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>5. Individuals\u2019 rights<\/h2><p>Export via the data export tool (Takeout) and the administration tools, search in Vault if you have it, and a one-month response deadline that falls on the controller.<\/p><p><strong>How to check.<\/strong> Designate the internal person who knows how to extract a Gmail mailbox, a Drive and a Calendar, and have them run a trial on a test account. Check group mailboxes and files whose owner has left the company: these are the requests that fall behind.<\/p><p><strong>In the record.<\/strong> The procedure, the person in charge, their deputy, and the tool used depending on the edition.<\/p><p><strong>Common mistake.<\/strong> Deleting the account of an employee who has left without having decided what happens to their shared files, then receiving a request that concerns them.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3e6d580 elementor-widget elementor-widget-text-editor\" data-id=\"3e6d580\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>6. What goes wrong on the day you leave the service<\/h2><p>Messages and files leave relatively well (IMAP, Drive export). Google Chat histories, Sites, Apps Script, forms linked to automations and administration rules do not carry over as they are to another suite. The page <a href='\/en\/migrate-from-google-workspace\/'>migrating from Google Workspace<\/a> lists these gaps.<\/p><p><strong>Why.<\/strong> Exit is part of compliance: it determines portability, the end of retention periods and the recovery of your data if the contract ends.<\/p><p><strong>In the record.<\/strong> The inventory of content that does not export as is, and what you would do with it.<\/p><p><strong>Common mistake.<\/strong> Discovering critical automations in the month of termination.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-03def39 elementor-widget elementor-widget-text-editor\" data-id=\"03def39\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Frequently asked questions<\/h2><h3>Does the GDPR require leaving Google Workspace?<\/h3><p>No. It governs roles, transfers and individuals\u2019 rights. It does not prohibit a software vendor on account of its nationality; it requires you to describe what you do and on what legal basis.<\/p><h3>Is choosing the Europe region enough?<\/h3><p>No. The region covers the data that Google lists, depending on your edition. Certain logs and cached content are not included, and the region does not change the software vendor\u2019s nationality.<\/p><h3>Does client-side encryption settle the access question?<\/h3><p>It changes what Google can read within the encrypted scope. It does not cover everything, and it changes search and certain collaborative features. Test it before rolling it out.<\/p><h3>What should we do if the Data Privacy Framework is annulled?<\/h3><p>The record of processing activities should already provide for the fallback, generally standard contractual clauses with a case-by-case assessment. Preparing that assessment in advance avoids having to draft it in a hurry.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-524e45c elementor-widget elementor-widget-text-editor\" data-id=\"524e45c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>When staying is the right conclusion<\/h2><p>When teams live in Docs and Drive, when your edition\u2019s data region covers the content that matters to you, and when the record of processing activities accounts for logs and residual access. The GDPR does not require leaving Google. It requires you to describe what you do.<\/p><p>The reasons for staying are sound in this case. Simultaneous editing in Docs and Sheets, search across the whole of Drive and teams\u2019 habits have a value that must be measured before leaving. A poorly prepared migration creates its own risks for data. Subscribing to the edition that includes regions and support controls may be more proportionate than changing suite. The trade-offs are detailed in <a href='\/en\/google-workspace-vs-sovereign-solution\/'>staying with or leaving Google Workspace<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-74526ea elementor-widget elementor-widget-text-editor\" data-id=\"74526ea\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>When changing operator is the right conclusion<\/h2><p>When you want a European or Swiss company to hold the files and emails, or when the edition subscribed does not include the region and support controls your analysis requires. If the gap between the current edition and the one that would meet the need weighs as much as a change, the question is worth asking.<\/p><p>Changing operator places the data holder under the law of its own country, provided its processors do not reintroduce a US provider. It does not exempt you from the data processing agreement, the record of processing activities or the procedure for individuals\u2019 rights. Infomaniak, a Nextcloud operated by a European hosting provider, OVHcloud or Klytic meet different needs. The guide <a href='\/en\/european-alternatives-microsoft-365\/'>European alternatives to Microsoft 365<\/a> and the page <a href='\/en\/european-alternatives-google-workspace\/'>alternatives to Google Workspace<\/a> set them apart. The same checks on the Microsoft side are in <a href='\/en\/gdpr-microsoft-365\/'>GDPR and Microsoft 365<\/a>.<\/p><p>Klytic is operated by Dedicace Software, a French company. It covers email, documents in a dedicated Nextcloud instance per customer (sharing, online editing alone or with others, version history), video conferencing, a CRM and telephony, which can be purchased separately. Nextcloud is published by Nextcloud GmbH (Germany); the email service is based on Zimbra, published by Synacor (United States) and operated by Klytic. Hosting is provided in any geographical area corresponding to the applicable jurisdiction, subject to the availability of the required services, for example in Europe or Mauritius, or on the customer\u2019s servers. The data is held by the customer, or by Klytic on its behalf, and encrypted natively or according to the customer\u2019s choice; the key is held by the customer or kept in its account, and Klytic has no access to it. The steps where encryption is managed by Klytic are detailed on the page <a href='\/en\/protect-business-cloud-act\/'>protecting a business from the CLOUD Act<\/a>. The contract must describe this holding and this encryption. Online editing, alone or with others, takes place within the instance; it is not the Google editor, and Klytic does not replicate identically its search across the whole body of content. It is not SecNumCloud-qualified.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d89d33a kly-g-disclaimer elementor-widget elementor-widget-text-editor\" data-id=\"d89d33a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>This page describes a general framework. It does not constitute legal advice.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3830019 kly-g-legal elementor-widget elementor-widget-text-editor\" data-id=\"3830019\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><b>Legal status as of 5 October 2026.<\/b> This text does not replace a contract review. The EU\u2013US adequacy decision (EU) 2023\/1795 is in force. It is being challenged. The ANSSI catalogue is authoritative for SecNumCloud.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-952fb71 kly-g-sources elementor-widget elementor-widget-text-editor\" data-id=\"952fb71\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Sources<\/h2><p>Accessed in October 2026.<\/p><ul><li>Regulation (EU) 2016\/679, Articles 28 and 44 to 49, including Article 48 (decisions of third-country authorities). <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:32016R0679' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>Google, data covered by data regions, and excluded types. <a href='https:\/\/support.google.com\/a\/answer\/9223653' rel='noopener' target='_blank'>Google Help<\/a><\/li><li>Google, choice of region depending on the edition. <a href='https:\/\/support.google.com\/a\/answer\/14310028' rel='noopener' target='_blank'>Google Help<\/a><\/li><li>Google, Access Management and the Assured Controls option. <a href='https:\/\/support.google.com\/a\/answer\/10343878' rel='noopener' target='_blank'>Google Help<\/a><\/li><li>Decision (EU) 2023\/1795. <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:32023D1795' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>Court of Justice of the European Union, 16 July 2020, C-311\/18 (Schrems II). <a href='https:\/\/eur-lex.europa.eu\/legal-content\/FR\/TXT\/?uri=CELEX:62018CJ0311' rel='noopener' target='_blank'>EUR-Lex<\/a><\/li><li>On the Data Privacy Framework litigation, a lawyers\u2019 commentary, not a decision: WilmerHale, \u201cEuropean Court of Justice to Review Challenge to EU-U.S. Data Privacy Framework\u201d, 1 December 2025. <a href='https:\/\/www.wilmerhale.com\/en\/insights\/blogs\/wilmerhale-privacy-and-cybersecurity-law\/20251201-european-court-of-justice-to-review-challenge-to-eu-us-data-privacy-framework' rel='noopener' target='_blank'>wilmerhale.com<\/a><\/li><li>On the litigation and the ongoing review, a lawyers\u2019 commentary, not a decision: DAC Beachcroft, \u201cThe EU\u2013US Data Privacy Framework: stability for now, uncertainty ahead\u201d. <a href='https:\/\/www.dacbeachcroft.com\/en\/What-we-think\/The-EU-US-Data-Privacy-Framework-Stability-for-now-uncertainty-ahead' rel='noopener' target='_blank'>dacbeachcroft.com<\/a><\/li><li>18 U.S.C. \u00a7 2713. <a href='https:\/\/www.govinfo.gov\/content\/pkg\/USCODE-2023-title18\/html\/USCODE-2023-title18-partI-chap121-sec2713.htm' rel='noopener' target='_blank'>govinfo<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-995a4ea e-con-full kly-g-aside e-flex e-con e-parent\" data-id=\"995a4ea\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-2611010 elementor-widget elementor-widget-html\" data-id=\"2611010\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t\t<nav class=\"kly-g-toc\" aria-label=\"Contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e4530a6 elementor-widget elementor-widget-text-editor\" data-id=\"e4530a6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"kly-g-cta\"><h3>A French operator for your data<\/h3><p>Email, documents, video conferencing, CRM and telephony, hosted in the zone that matches your jurisdiction, for example in Europe or Mauritius, or on your premises.<\/p><p><a class=\"kly-g-btn\" href=\"\/en\/contact\/\">Talk to an advisor \u2192<\/a><\/p><p style=\"margin:0\"><a class=\"kly-g-btn ghost\" href=\"\/en\/hosting-sovereignty\/\">Klytic hosting<\/a><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-a590084 e-con-full kly-g-related e-flex e-con e-parent\" data-id=\"a590084\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-55d79e6 elementor-widget elementor-widget-text-editor\" data-id=\"55d79e6\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Read next<\/h2><div class=\"kly-g-grid\"><a class=\"kly-g-card\" href=\"\/en\/what-is-sovereign-cloud\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">What is a sovereign cloud?<\/span><span class=\"q\">A sovereign cloud is judged by its operator, the applicable law, control over access and data exit. The datacenter\u2019s location is not enough.<\/span><span class=\"m\"><span>8 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/sovereign-cloud-definition\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">Sovereign cloud: definition, criteria and limits<\/span><span class=\"q\">An operational definition of sovereign cloud, ten verifiable criteria for a tender, and the limits of the term: SecNumCloud, location, access, exit.<\/span><span class=\"m\"><span>8 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/european-alternatives-microsoft-365\/\" style=\"--cat:#6d28d9\"><span class=\"c\">Comparisons<\/span><span class=\"t\">European alternatives to Microsoft 365: 2026 guide<\/span><span class=\"q\">Selection criteria, then Microsoft 365, Google Workspace, OVHcloud, Nextcloud, Infomaniak, other players and Klytic. When each one is relevant.<\/span><span class=\"m\"><span>18 min read<\/span><b>Read \u2192<\/b><\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-539316dd e-con e-atomic-element e-div-block-base e-default-div e-c9fd865-4a50 \" data-id=\"539316dd\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"539316dd\" data-e-type=\"e-div-block\" data-id=\"539316dd\">\n    <div class=\"elementor-element elementor-element-4f79afcb e-con e-atomic-element e-div-block-base e-default-div e-4fa9fe-ce86 \" data-id=\"4f79afcb\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"4f79afcb\" data-e-type=\"e-div-block\" data-id=\"4f79afcb\">\n    \t\t\t<p class=\"e-4dcf5c70-2ec7 e-paragraph-base e-default-p\" data-interaction-id=\"330a7a35\" data-e-type=\"widget\" data-id=\"330a7a35\">Welcome offer<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"56f1f7d5\" class=\"e-347faa43-4e20 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"56f1f7d5\">30-day free trial, assisted migration<\/h2>\n\t\t\t\t\t<p class=\"e-7f6310da-1caa e-paragraph-base e-default-p\" data-interaction-id=\"2ce27288\" data-e-type=\"widget\" data-id=\"2ce27288\">No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.<\/p>\n\t\t<div class=\"elementor-element elementor-element-35ea29a1 e-con e-atomic-element e-div-block-base e-default-div e-1cd48b22-e6da \" data-id=\"35ea29a1\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"35ea29a1\" data-e-type=\"e-div-block\" data-id=\"35ea29a1\">\n    \t\t\t<a href=\"https:\/\/eu.klytic.com\/en\/30-day-free-trial\/\" target=\"_self\" class=\"e-4a7886e3-652d e-button-base e-default-a\" data-interaction-id=\"19bfa8f1\" data-e-type=\"widget\" data-id=\"19bfa8f1\">\n\t\ud83d\ude80 Start free trial\n<\/a>\n\t\t\t\t\t<a href=\"https:\/\/eu.klytic.com\/en\/pricing\/\" target=\"_self\" class=\"e-137e863d-dd0d e-button-base e-default-a\" data-interaction-id=\"326d82ab\" data-e-type=\"widget\" data-id=\"326d82ab\">\n\tSee pricing\n<\/a>\n\t\t\n<\/div>\n\n<\/div>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Accueil\u203aGuides\u203aSouverainet\u00e9 Souverainet\u00e9 RGPD et Google Workspace : ce qu\u2019une entreprise doit v\u00e9rifier Google Workspace peut \u00eatre utilis\u00e9 dans un cadre RGPD. Comme pour Microsoft 365, la conformit\u00e9 se v\u00e9rifie dans le contrat, la r\u00e9gion r\u00e9ellement couverte et la capacit\u00e9 \u00e0 r\u00e9pondre aux personnes. L\u2019\u00e9diteur est une soci\u00e9t\u00e9 am\u00e9ricaine. Cette phrase ouvre la v\u00e9rification. Elle ne [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"GDPR and Google Workspace: what a business needs to check | Klytic","_seopress_titles_desc":"Roles, data regions, support access, logs not covered, transfers and exit: what to check before closing the Google Workspace question.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"GDPR and Google Workspace: what a business needs to check | Klytic","_seopress_social_fb_desc":"Roles, data regions, support access, logs not covered, transfers and exit: what to check before closing the Google Workspace question.","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"GDPR and Google Workspace: what a business needs to check | Klytic","_seopress_social_twitter_desc":"Roles, data regions, support access, logs not covered, transfers and exit: what to check before closing the Google Workspace question.","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-3291","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/comments?post=3291"}],"version-history":[{"count":4,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3291\/revisions"}],"predecessor-version":[{"id":4172,"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/3291\/revisions\/4172"}],"wp:attachment":[{"href":"https:\/\/eu.klytic.com\/en\/wp-json\/wp\/v2\/media?parent=3291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}