The gap between those two columns is the entire Gemini data privacy problem. Your company bought the right-hand column; a meaningful share of your employees are typing into the left-hand one, because it's free and it's one tab away.
Consumer Gemini conversations can be selected for human review to improve the service — and reviewed content may be retained for an extended period even if you later delete your activity. Google's guidance is explicit that you shouldn't submit confidential information or anything you wouldn't want a reviewer to see.
For a security team, that's a clean bright line: a customer's SSN, a patient's chart, or a production API key pasted into consumer Gemini may be read by a person. No configuration on your side changes that, because the account isn't yours.
Gemini for Workspace is grounded in your Google Workspace content — Gmail, Drive, Docs, Sheets — meaning it can surface anything the signed-in user has permission to access. Like Copilot in Microsoft 365, it doesn't grant new access, but it removes the friction that kept poorly-shared files buried. Overshared Drive folders and "anyone with the link" documents become instantly discoverable through a natural-language question.
That makes Gemini readiness a Google Drive data-hygiene project: find the sensitive data, fix the sharing, remediate the content.
Strac covers Gemini in the browser (Chrome, Edge, Firefox, Safari) alongside ChatGPT, Claude, Copilot, and Perplexity — and protects the Google Workspace data underneath it. See AI DLP.
Consumer Gemini may use your conversations to improve Google's services, and selected conversations can be reviewed by humans. Gemini for Google Workspace is different: governed by your enterprise agreement, your data is not used to train models and stays within your Workspace protections. The risk is employees using the consumer app for work.
On consumer Gemini, yes — selected conversations may be reviewed by human reviewers to improve the service, and reviewed content can be retained for a period even after you delete your activity. Google advises not entering anything confidential you wouldn't want a reviewer to see. That guidance alone should keep customer and patient data out of it.
It's far safer than the consumer app — no model training, and your data stays in the Workspace compliance boundary. But it still surfaces anything the user can access, so overshared Drive content becomes newly discoverable, and it doesn't stop employees pasting confidential data into a different AI tool. Pair it with data-hygiene cleanup and browser-level protection.
The structure is similar — a consumer tier with looser terms and an enterprise tier that excludes training — but Gemini's consumer human-review disclosure is unusually explicit, and Gemini for Workspace is grounded in your Google content, which makes oversharing a bigger factor than it is for a standalone chatbot.
Enforce it in the browser, not in policy: detect sensitive data as it's typed and redact it, warn the employee, or block the submission. Because it operates at the browser layer, it protects you even when the employee is signed into a personal Google account you don't manage — which is exactly where the exposure is.
Gemini data privacy hinges on a distinction most employees never make: the Gemini your company licensed protects your data; the Gemini in their personal tab may be read by a human. You can't close that gap with licensing or policy — only by controlling what leaves the browser. Clean up Drive, steer people to Workspace Gemini, and redact the prompt regardless.
Book a demo to see sensitive data redacted from Gemini prompts in real time.
Related: AI data privacy · is Gemini safe? · is Gemini HIPAA compliant? · ChatGPT data privacy · Google Workspace DLP
.avif){kind=icon}
.gif)
.webp)
