Field note
Gemini Google Apps: Data Boundary Review
Before Gemini is allowed to read Gmail, Drive or Calendar for a business task, check which account type is in use, which apps the administrator has enabled, and where the resulting chats are kept.
Before Gemini is allowed to read Gmail, Drive or Calendar for a business task, check which account type is in use, which apps the administrator has enabled, and where the resulting chats are kept.
Two very different boundaries
Gemini connects to Google apps on both personal and work accounts, but the terms are not the same.
On a personal Google account, Connected Apps and Personal Intelligence let Gemini read Gmail, Drive, Calendar, Photos and more. Google's help says that data from connected apps is used according to the Gemini Apps Privacy Notice, that a subset is reviewed by human reviewers, and that summaries, excerpts and inferences may be used to train models when Keep Activity is on. Google's advice is explicit: do not connect apps that contain confidential information you would not want used for training.
On a work account with a qualifying Workspace edition, the Generative AI in Google Workspace Privacy Hub applies. Google states that Gemini only accesses Workspace content the user already has permission to access, that prompts and content are not used to train models without permission, and that interactions stay within the organisation.
So a boundary review starts with one question: which account is the person signed into? A member of staff using personal Gemini on a personal Gmail that receives forwarded work mail is outside every control the business has.
What the Workspace connected app can reach
For work accounts, the Google Workspace connected app covers Gmail, Google Calendar, Google Chat, Google Docs, Google Drive, Google Keep and Google Tasks at the time of writing. Three things must be true before it works: the organisation has a qualifying edition, the user's Keep Activity setting is on (for work accounts only the administrator manages this), and the administrator has enabled connecting apps to Gemini.
Users call it by typing @ and choosing the app in a prompt, and Gemini lists the sources it used after the response. Google's help also documents what it cannot do at the time of writing: it cannot create drafts or delete emails in Gmail, cannot access pictures and videos in Drive or anything that is not a document, spreadsheet, presentation or PDF, and cannot create folders or move files. In practice the Workspace connected app is mostly a read-and-summarise path today. Check the current help page before relying on any of those limits, because the list changes.
The review, source by source
| Source | Question to answer | Typical first decision |
|---|---|---|
| Gmail | Whose mailbox: own only, or shared and delegated mailboxes too? | Own mailbox only; keep finance and HR shared mailboxes out of the pilot |
| Drive | Is there existing oversharing, such as folders open to the whole organisation? | Fix sharing first; Gemini inherits it |
| Calendar | Do events hold external attendee details or interview notes? | Usually acceptable |
| Chat | Are there spaces with HR, legal or disciplinary content? | Exclude those users, or accept the exposure in writing |
| Keep and Tasks | Low sensitivity | Allow |
The key point is that Gemini reads what the user can already open. If a payroll spreadsheet sits in a Drive folder shared with everyone, Gemini will summarise it on request for anyone who asks. Fix the sharing, not the assistant. The method in the ChatGPT connectors oversharing audit applies unchanged to Drive.
Retention and admin controls
The Workspace Privacy Hub sets out retention at the time of writing. For the Gemini app, prompts and responses are retained for up to 36 months as determined by administrators, who control whether conversations are saved and for how long. For Gemini in the Workspace side panel, retention runs from 90 days to indefinite as set by administrators, and Vault covers Workspace data. The Workspace admin help lists the controls: turn the Gemini app on or off, control Gemini app access to Workspace services, manage conversation history settings, and control temporary chats and chat deletion.
Decide three things and write them down: the retention period, whether temporary chats are allowed, and which organisational units get the connected app first.
What to write into policy
- Work data is handled on work accounts only. No forwarding of work mail to personal Gmail.
- The list of enabled Workspace services in Gemini, with a named owner for changes.
- Groups excluded until the sharing review is complete, typically HR and finance.
- The retention choice and the reason for it.
- Users check the sources listed after a response before acting on it. Google's help warns that Gemini can hallucinate or use an older email when a newer one exists.
- A review date tied to changes in Google's connected app list.
An AI governance review can turn this into a maintained control set rather than a one-off decision.