Safe Setup Guide: Google Gemini for Legal Work

Overview

Gemini is Google's AI assistant. It comes in two forms that handle your data very differently:

Gemini on a personal Google account. Google's privacy notice says human reviewers read some chats, and asks you not to enter confidential information.
Gemini on a Google Workspace account. Google says your content is not human reviewed or used to train generative AI models outside your domain without permission.

For legal work, use Gemini only through your firm's Google Workspace account. This guide is for firms that already use Workspace.

Every vendor fact below was checked against Google's own pages on 29 September 2026. The pages are listed under "Sources checked" at the end of this guide. Settings and prices change, so follow the links before you rely on them.

Setup time: about 10 minutes, once your administrator has configured Workspace Suitable for: firms using Google Workspace

Plans and prices

Google's UK pricing page gives prices in pounds. These are the standard prices per user per month on an annual plan, excluding tax, as shown on 29 September 2026. The page also showed introductory discounts for new customers.

Workspace plan	Price	Gemini features the page lists
Business Starter	£5.90	Gemini in Gmail; chat in the Gemini app
Business Standard	£11.80	Gemini in Gmail, Docs, Meet and more; Gemini Notebook; the Gemini app with expanded access
Business Plus	£18.40	As Standard, with more storage and security controls
Enterprise	Contact Google's sales team	Adds data loss prevention, context-aware access and "Enterprise data regions"

Starter, Standard and Plus can be bought for a maximum of 300 users.

What Google says about your data

	Personal Google account	Google Workspace account
Used to train models	Yes, while the "Keep activity" setting is on	Not without your organisation's permission or instruction
Human review	Yes. Reviewed chats are kept for up to three years and are not deleted when you delete your activity	Content is not human reviewed for model training
Retention	18 months by default. You can change it to 3 months, 36 months or indefinite	Set by administrators. Gemini app conversations: 3, 18 or 36 months, with 18 months the default
With history off	Chats are still kept for 72 hours	New chats are kept for up to 72 hours
Data location	Not stated on the pages checked	United States, European Union or no preference, on supported editions

Two points that are easy to miss:

There is no UK data region. Google's data regions page offers the United States, the European Union or "No preference". It lists Business Standard, Business Plus and the Enterprise editions among those supported. Business Starter is not listed.
Feedback is optional and is kept. Google says feedback from Workspace users may be retained for up to 18 months. It says the feedback is not used to train the generative AI models behind Workspace.

The pages checked did not confirm whether Gemini prompts and responses are among the data covered by a data region policy. Ask Google or your reseller.

Step 1: Check which account you are signed in to

Go to gemini.google.com.
Check which Google account you are signed in with. It should be your work address on your firm's domain.
If it is a personal address, stop and switch accounts.

Do not use a personal Google account for client work. If your firm does not have Workspace, this guide does not apply to you.

Step 2: Confirm the admin settings

Your Workspace administrator controls the settings that matter. Ask them to confirm:

Which edition the firm has, and so which Gemini features and controls are included.
Whether the Gemini app is turned on. Google says access to the Gemini app is on by default and administrators can turn it off.
Which Workspace services have Gemini features turned on. On supported editions administrators can turn Gemini features on or off in Gmail, Drive, Docs, Meet and Chat.
The retention period for Gemini conversations.
The data region policy, if your edition supports one.
Whether data loss prevention rules are in place. Google says that on supported editions, existing rules apply to Gemini output that is inserted into emails, Docs and shared Drive files.

Do not use Gemini for client work until your administrator has confirmed these.

Step 3: Understand what Gemini can reach

Google says Gemini in Workspace retrieves content that the signed-in user already has permission to access, and does not retrieve content the user cannot access.

That means Gemini can draw on any file or email you can open. If a matter folder is shared more widely than it should be, Gemini will use it for anyone who has access. Review sharing on sensitive folders before turning Gemini on.

Google says two controls can restrict Gemini's access to sensitive files:

Information Rights Management. If a user is not allowed to download, print or copy a file, Gemini will not retrieve it for that user.
Client-side encryption. Google says it has no technical means to access client-side encrypted content.

Step 4: Where Gemini appears

App	What it does	Care needed
Gmail	Drafts and summarises email	It can draw on email you have access to, including privileged email
Docs	Drafts and rewrites text	Output needs checking like any other draft
Drive	Finds and summarises files	It reaches every file you can open
Meet	Summarises and takes notes	A meeting note is a record of what was said. Decide before the meeting whether one should be made

Each person's Gemini history is visible only to them. Google says collaborators on a shared file cannot see your prompts or Gemini's responses.

Your professional duties

This section summarises published rules and guidance. It is not legal advice, and it has not yet been reviewed by a solicitor.

Confidentiality. Paragraph 6.3 of the SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs requires you to keep the affairs of current and former clients confidential unless disclosure is required or permitted by law or the client consents.
Competence. Paragraph 3.2 requires the service you provide to be competent, and paragraph 3.3 requires you to keep your professional knowledge and skills up to date.
Supervision. Under paragraph 3.5, where you supervise or manage others you remain accountable for the work carried out through them.
Not misleading anyone. Paragraph 1.4 says you do not mislead or attempt to mislead your clients, the court or others.
Responsibility for output. The SRA's Risk Outlook report on AI (20 November 2023) says you "remain responsible and accountable for the outputs from AI you are using".
Law Society guidance. "Generative AI – the essentials" says that if you are using a free, online generative AI service where you have no operational relationship with the vendor other than use, you should not put any confidential data into the tool. It also advises carrying out due diligence on the supplier, and being able to say where data is processed, who processes it, how and where it is stored, and who has access to it.
Data protection. Where a prompt contains personal data, the UK GDPR and the Data Protection Act 2018 are relevant. The Information Commissioner's Office says a restricted transfer of personal data outside the UK must be covered by UK adequacy regulations, appropriate safeguards or an exception. Google's data regions are the United States and the European Union.

Follow your firm's own AI and information security policy where it is stricter than this guide.

What not to put into Gemini

On a personal Google account, do not enter anything about a client or a matter. Google's own privacy notice asks you not to enter confidential information that you would not want a reviewer to see.

On a Workspace account, what may go in is a decision for your firm, made after due diligence on the contract and the data processing terms. Until your firm has decided, keep these out of prompts:

client names, or facts that would identify a client or matter
privileged communications or advice
personal data about anyone, including health information and financial details
National Insurance numbers, passport numbers or bank account details
the terms of a confidential settlement
anything covered by a confidentiality agreement or undertaking

Examples of prompts that carry no client information:

"Draft a template client care letter for a residential conveyancing matter"
"Create a checklist for corporate due diligence on a share purchase"

Checking output

Gemini can produce authorities that do not exist and misstate ones that do. Google's privacy notice says Gemini may produce inaccurate information and should not be relied on for legal or other professional help. Before relying on anything it produces:

Cases: find every case in a law report or on a service such as Westlaw UK, Lexis+ UK, BAILII or The National Archives' Find Case Law, and read it
Legislation: check the text and whether it is in force, for example on legislation.gov.uk
Jurisdiction: confirm the law is that of England and Wales, not Scotland, Northern Ireland or another country
Quotations: check every quotation against the source
Summaries: read the email thread or document yourself before acting on a summary of it
Currency: confirm the authority has not been overruled, amended or repealed

The Law Society's guidance says that for documents going to court you must review final versions to make sure all citations are verified, and that the court expects to impose severe sanctions for the misuse of AI in legal research or court documents other than in exceptional circumstances.

If client information goes in by mistake

If it went into a personal account, delete the chat in Gemini Apps activity. Google says chats that have already been reviewed are not deleted when you delete your activity.
Tell the person your firm's policy names, usually the compliance officer for legal practice (COLP) or the data protection lead.
Record what was entered, when, and into which account.

The ICO says a notifiable personal data breach must be reported to it without undue delay and not later than 72 hours after you become aware of it. Whether an incident is notifiable is for your firm to assess. Paragraph 7.11 of the SRA Code requires you to be honest and open with clients if things go wrong.

Quick checklist

Before first use

Signed in with the firm's Workspace account, not a personal one
Administrator has confirmed edition, retention, data region and which services have Gemini on
Sharing reviewed on sensitive folders
Your firm's AI policy read

Every time

Signed in with the work account
No client information in a prompt unless your firm has approved it
Every authority and summary checked against its source
Meeting notes only where a record is appropriate

Sources checked

All read on 29 September 2026.

Google

Gemini Apps Privacy Hub and Privacy Notice (notice last updated 29 June 2026)
Generative AI in Google Workspace Privacy Hub (last updated 14 August 2026)
Choose a geographic location for your data (last updated 24 September 2026)
Google Workspace pricing (UK)

Rules and guidance

SRA Code of Conduct for Solicitors, RELs, RFLs and RSLs (version in effect from 11 April 2025)
SRA Risk Outlook report: the use of artificial intelligence in the legal market (20 November 2023)
Law Society: Generative AI – the essentials (page dated 1 October 2025)
ICO: International transfers guide
ICO: Personal data breaches guide

Need help?

If you have a question about this guide, or find that a setting has moved, contact hello@counsel.directory.

Review status: this guide has not yet been reviewed by a solicitor.

Disclaimer: This guide is general information about configuring a software product. It is not legal advice and it is not advice on your professional obligations. You remain responsible for complying with the SRA Standards and Regulations, data protection law and your firm's policies. Check with your firm's compliance and IT teams before using a new tool for client work.