HubSpot and the GDPR: How to Stay Compliant with Data Protection Regulations

Last updated: October 2026

If you introduce HubSpot or already use it, sooner or later you will hear the same question, from management, from sales, or from your data protection officer: Are we allowed to store our customer data in a US CRM? We come across this question regularly in HubSpot projects. The short answer: yes, if you set a few things up properly.

Whether your use is compliant depends on your settings, legal bases, and processes. HubSpot provides the contractual foundation and the right features, and your team takes care of settings and data maintenance. We go through it step by step: from the basics of the GDPR and the question of US software to the settings in HubSpot.

This article is for general information only. For your specific situation, please consult your data protection advisor.

What Is the GDPR?

The General Data Protection Regulation (GDPR) is an EU regulation that has applied since May 25, 2018. It sets uniform rules across the EU on when companies and public bodies may process personal data. It also defines the rights of the people concerned, such as the right of access and the right to erasure.

What Is Personal Data?

Personal data is any information relating to an identified or identifiable natural person. In everyday B2B work, this includes names, direct phone numbers, and IP addresses. A business email address following the pattern firstname.lastname@company.com counts as well. A shared address such as info@company.com usually does not, as long as it cannot be linked to a specific person.

Does the GDPR Also Apply in B2B?

Yes. As soon as your CRM contains named contacts, you process personal data. The rules therefore apply equally to marketing, sales, and service.

What Happens If You Violate the GDPR?

Supervisory authorities can impose fines of up to €20 million or 4% of the previous year's worldwide annual revenue, whichever is higher. This cap applies, for example, to violations of the processing principles, of data subject rights, and to unlawful transfers to third countries. For other obligations, the cap is €10 million or 2%. If a person suffers damage from a violation, they can also claim compensation.

Our tip: Put the basics in place before anyone asks. The next sections show how to do this with HubSpot.

Can You Use HubSpot as US Software in Germany and Switzerland?

As a rule, yes, if the transfer to the US is safeguarded. The question is still a fair one: As soon as data flows to the US, the GDPR requires that it be protected there to a level comparable to the EU. Earlier agreements failed on exactly this point because US authorities had too much access to data.

Today, two mechanisms safeguard the transfer. The first is the EU-US Data Privacy Framework. Under this framework, US companies can be certified and are then considered safe recipients. HubSpot, Inc. is actively certified under it, as well as under its Swiss counterpart and the UK extension. The second mechanism is the EU Standard Contractual Clauses, contract modules specified by the European Commission. HubSpot has included them in its Data Processing Agreement (DPA).

The overview shows how this situation came about.

How Has the Legal Situation Developed Since 2020?

The Data Privacy Framework is valid, and the CJEU has yet to rule on the appeal. Regardless, the Standard Contractual Clauses in HubSpot's DPA are in place as a second basis.

Two tasks remain with you:

• Name HubSpot as a recipient in your privacy policy, along with the transfer to the US.
• Check the certification status regularly in the official Data Privacy Framework list.

Where Does HubSpot Store Your Data?

HubSpot hosts on Amazon Web Services (AWS) in five regions. For the EU, the data center is in Germany. Under Settings > Privacy & Consent, in the Data Hosting tab, you can see where your account is hosted. With a paid subscription (Starter, Professional, or Enterprise), you can switch data centers.

Even with hosting in the EU, data can leave the region: through support access, subprocessors, apps from the HubSpot Marketplace, and usage data that HubSpot transfers to the US. Safeguards through the framework and the DPA therefore remain relevant even with an EU data center.

What Applies to Companies in Switzerland?

In Switzerland, the revised Federal Act on Data Protection (FADP) has applied since September 1, 2023. Personal data may be transferred abroad if the Federal Council certifies that the destination country offers adequate protection. Alternatively, suitable safeguards such as data protection clauses in the contract are sufficient. For certified US companies, the Swiss-US Data Privacy Framework has applied since September 15, 2024. HubSpot is actively certified under it, and the DPA covers this framework. The FADP provides for fines of up to CHF 250,000 against private individuals, for example for intentionally unlawful disclosure of data abroad.

How Do You Meet the GDPR Requirements as a B2B Company?

These eight obligations lie with your company, regardless of the CRM you use:

• Collect data sparingly: Only create fields that marketing and sales actually use.
• Record the legal basis: In B2B, consent, contract, or legitimate interest are usually relevant. Record which one applies for each contact.
• Prove consent: You must be able to show that someone gave consent. Consent can be withdrawn at any time.
• Safeguard promotional emails: In Germany, email advertising requires prior express consent, in B2B as well. There is an exception for existing customers: you received the address in connection with a sale, you promote your own similar products, the customer has not objected, and you point out their right to object when collecting the address and with every use.
• Keep your privacy policy up to date: Name HubSpot as a recipient and the transfer to the US.
• Put data processing on a contractual footing: Under Art. 28 GDPR, you need a contract with HubSpot. The DPA is part of the terms of service, and a signed version is available in the Legal Center.
• Keep a record of processing activities: The exemption for companies with fewer than 250 employees applies, among other conditions, only to occasional processing. A CRM in ongoing use usually does not qualify.
• Answer requests on time: You handle access, erasure, and rectification requests within one month. For complex or numerous requests, you may extend by two months, but you must inform the person within the first month and give reasons.

Which HubSpot Features Support You with the GDPR?

HubSpot bundles its data protection features under Settings > Privacy & Consent, in the consent banner, and in the contact properties. HubSpot explains them in detail in its own knowledge base. We summarize the most important features here.

How Do You Turn On the Data Privacy Settings?

Under Settings > Privacy & Consent, you turn on the data privacy settings. You need super admin rights or the Edit account defaults permission. For accounts with data hosting in the EU, the settings are on by default. Among other things, this turns on:

• the cookie banner
• a data privacy section in new forms
• unsubscribe links in sales emails and sequences
• notices in the sales extension when a contact lacks a legal basis

HubSpot then only tracks opens and clicks for contacts with a legal basis. HubSpot also recommends the Limit emails to contacts with a subscription switch. It restricts marketing emails to contacts with a subscription.

How Do You Set Up the Cookie Banner?

In Germany, storing cookies on a device requires consent. Cookies that are strictly necessary for the requested service are exempt. This is set out in Section 25 of the German TDDDG, formerly the TTDSG.

You set up the banner under Settings > Privacy & Consent in the Cookies tab. It offers three types:

• Notification only shows a notice about cookies.
• Opt-out accepts all cookies automatically, and visitors can object afterward.
• Opt-in starts tracking only after consent.

For Germany, opt-in is therefore usually the right choice, optionally with a selection by category. Since May 11, 2026, HubSpot has been automatically migrating accounts created before November 2022 that still use the old banner to version v2. Check the copy, categories, and country selection afterward.

The banner blocks HubSpot cookies and cookies from HubSpot integrations such as Google Analytics and Google Tag Manager. HubSpot does not automatically block cookies from scripts you add manually. For such setups, a dedicated consent tool is worth it. We compare five providers in Cookie Notices: 5 Common CMPs Compared. With HubSpot's cookie banner API, you pass that tool's consents on to HubSpot.

How Do You Document the Legal Basis?

You store the legal basis in the contact property "Legal basis for processing contact's data". The options are:

• three variants of legitimate interest (lead, customer, other)
• performance of a contract
• freely given consent
• "Not applicable"

You maintain the property individually, through bulk editing, on import, or via workflow. Check HubSpot's examples against German law: For newsletters to leads, Section 7 of the German Unfair Competition Act (UWG) requires express consent, even though HubSpot cites legitimate interest as an example for this case.

How Do You Manage Subscription Types?

For each subscription type, a contact has one of three statuses: Subscribed, Unsubscribed, or Not Specified. When you subscribe a contact to a subscription type, you record the legal basis for the communication. This shows you, topic by topic, who may receive which emails.

How Do You Collect Consent Through Forms?

In the form editor, you define under Data privacy options which consents a form asks for. You link each checkbox to a subscription type, optionally with a note pointing to your privacy policy. When a contact submits the form, HubSpot sets the legal basis to "Freely given consent from contact" and records the consent on the contact. With the data privacy settings turned on, the data privacy checkboxes are mandatory in new forms. Consent via form applies to marketing emails. For SMS, you collect consent another way.

How Do You Handle Access and Erasure Requests?

On a data privacy request page, contacts can request a copy of their data or its deletion themselves. You log requests received by phone or email in the data request manager, with a responsible person and a deadline.

With permanent delete, you remove a contact along with email tracking, calls, and form submissions. This works only one contact at a time, and complete deletion can take up to 30 days. The email address goes on a block list and can then no longer be recreated by import or through the interface. If the person later gets in touch themselves, for example through a form, a new record is created. You delete the contact's comments on blog posts manually.

Can HubSpot Delete Inactive Contacts Automatically?

Yes. Under Settings > Privacy & Consent > Privacy tools, you turn on Delete inactive contacts automatically. By default, a contact counts as inactive after 365 days without activity, and you can adjust this period. HubSpot checks the create date, last session, last marketing email open, and last engagement. Deleted contacts can be restored from the recycling bin for 90 days, after which HubSpot deletes them permanently. Before turning this on, check how the deletion affects your reports.

What Applies to AI Features in HubSpot?

By default, HubSpot uses customer data to train its own AI models. Super admins turn this off under Settings > AI in the Access tab with the AI Model Training switch. The opt-out only applies going forward: what a model has already learned from your data cannot be undone. You control data enrichment through a separate setting. HubSpot prohibits external AI providers from using customer data for training.

Make this decision deliberately and align it with your privacy policy and legal bases. We describe which rules to set before using Breeze in 6 Requirements for AI with HubSpot Breeze.

Questions About HubSpot and the GDPR