Skip to main content
    Back to Articles

    How to Activate Google CDPA & BAA for Privacy Compliance

    Lucas Meyers, NCG
    November 21, 2025

    A simple but frequently overlooked compliance step if you use any Google products and handle sensitive or personal data is signing the Cloud Data Processing Addendum (CDPA) and Business Associate Agreement (BAA) inside your Google Admin Console.

    Why These Agreements Matter

    These agreements formalize Google as a compliant data processor under HIPAA, GDPR, CPRA/CCPA, and other privacy frameworks - otherwise you have compliance issues.

    They contractually obligate Google Workspace to: - Protect your data - Follow strict security protocols - Notify you of breaches - Limit data access

    HIPAA Requirements

    If you handle any protected health information digitally through a Google service - medical records, caregiver data, elder care information, or anything related to diagnosis and treatment - HIPAA requires a BAA with any cloud service storing that data. Without it, you are potentially in violation.

    How to Activate (2 Minutes)

    1. Log into admin.google.com 2. Navigate to Account Settings -> Legal & Compliance 3. Locate the CDPA and BAA under "Additional Terms" 4. Click Review and Accept 5. Document the confirmation for your compliance folder

    Benefits

    This simple step: - Increases safety of stored regulated data - Helps meet processor contract requirements - Reduces liability - Strengthens audit readiness