Last updated: October 2026
If you introduce HubSpot or already use it, sooner or later you will hear the same question, from management, from sales, or from your data protection officer: Are we allowed to store our customer data in a US CRM? We come across this question regularly in HubSpot projects. The short answer: yes, if you set a few things up properly.
Whether your use is compliant depends on your settings, legal bases, and processes. HubSpot provides the contractual foundation and the right features, and your team takes care of settings and data maintenance. We go through it step by step: from the basics of the GDPR and the question of US software to the settings in HubSpot.
This article is for general information only. For your specific situation, please consult your data protection advisor.
The General Data Protection Regulation (GDPR) is an EU regulation that has applied since May 25, 2018. It sets uniform rules across the EU on when companies and public bodies may process personal data. It also defines the rights of the people concerned, such as the right of access and the right to erasure.
Personal data is any information relating to an identified or identifiable natural person. In everyday B2B work, this includes names, direct phone numbers, and IP addresses. A business email address following the pattern firstname.lastname@company.com counts as well. A shared address such as info@company.com usually does not, as long as it cannot be linked to a specific person.
Yes. As soon as your CRM contains named contacts, you process personal data. The rules therefore apply equally to marketing, sales, and service.
Supervisory authorities can impose fines of up to €20 million or 4% of the previous year's worldwide annual revenue, whichever is higher. This cap applies, for example, to violations of the processing principles, of data subject rights, and to unlawful transfers to third countries. For other obligations, the cap is €10 million or 2%. If a person suffers damage from a violation, they can also claim compensation.
Our tip: Put the basics in place before anyone asks. The next sections show how to do this with HubSpot.
As a rule, yes, if the transfer to the US is safeguarded. The question is still a fair one: As soon as data flows to the US, the GDPR requires that it be protected there to a level comparable to the EU. Earlier agreements failed on exactly this point because US authorities had too much access to data.
Today, two mechanisms safeguard the transfer. The first is the EU-US Data Privacy Framework. Under this framework, US companies can be certified and are then considered safe recipients. HubSpot, Inc. is actively certified under it, as well as under its Swiss counterpart and the UK extension. The second mechanism is the EU Standard Contractual Clauses, contract modules specified by the European Commission. HubSpot has included them in its Data Processing Agreement (DPA).
The overview shows how this situation came about.
| Date | Event | What it means for you |
|---|---|---|
| July 16, 2020 | CJEU ruling "Schrems II" (C-311/18) | The EU-US Privacy Shield is invalid. Transfers to the US need a different legal basis. |
| June 4, 2021 | New EU Standard Contractual Clauses (Implementing Decision 2021/914) | Transfers to third countries can be safeguarded by contract. |
| July 10, 2023 | Adequacy decision on the EU-US Data Privacy Framework (2023/1795) | Certified US companies count as recipients with an adequate level of protection. |
| September 15, 2024 | Swiss-US Data Privacy Framework takes effect | The same logic applies to transfers from Switzerland. |
| September 3, 2025 | The EU General Court dismisses the action against the framework (T-553/23) | The framework remains valid. |
| October 31, 2025 | Appeal filed with the CJEU (C-703/25 P) | The proceedings are ongoing as of October 2026. |
The Data Privacy Framework is valid, and the CJEU has yet to rule on the appeal. Regardless, the Standard Contractual Clauses in HubSpot's DPA are in place as a second basis.
Two tasks remain with you:
HubSpot hosts on Amazon Web Services (AWS) in five regions. For the EU, the data center is in Germany. Under Settings > Privacy & Consent, in the Data Hosting tab, you can see where your account is hosted. With a paid subscription (Starter, Professional, or Enterprise), you can switch data centers.
Even with hosting in the EU, data can leave the region: through support access, subprocessors, apps from the HubSpot Marketplace, and usage data that HubSpot transfers to the US. Safeguards through the framework and the DPA therefore remain relevant even with an EU data center.
In Switzerland, the revised Federal Act on Data Protection (FADP) has applied since September 1, 2023. Personal data may be transferred abroad if the Federal Council certifies that the destination country offers adequate protection. Alternatively, suitable safeguards such as data protection clauses in the contract are sufficient. For certified US companies, the Swiss-US Data Privacy Framework has applied since September 15, 2024. HubSpot is actively certified under it, and the DPA covers this framework. The FADP provides for fines of up to CHF 250,000 against private individuals, for example for intentionally unlawful disclosure of data abroad.
These eight obligations lie with your company, regardless of the CRM you use:
HubSpot bundles its data protection features under Settings > Privacy & Consent, in the consent banner, and in the contact properties. HubSpot explains them in detail in its own knowledge base. We summarize the most important features here.
| Requirement | HubSpot feature |
|---|---|
| Consent for cookies | Consent banner with opt-in and categories |
| Document the legal basis | Property "Legal basis for processing contact's data" |
| Manage communication by topic | Subscription types with a status per contact |
| Consent at the point of capture | Data privacy options in forms |
| Access and erasure on request | Data privacy request page, data request manager, permanent delete |
| Apply retention periods | Automatic deletion of inactive contacts |
| Control AI training | "AI Model Training" switch |
Under Settings > Privacy & Consent, you turn on the data privacy settings. You need super admin rights or the Edit account defaults permission. For accounts with data hosting in the EU, the settings are on by default. Among other things, this turns on:
HubSpot then only tracks opens and clicks for contacts with a legal basis. HubSpot also recommends the Limit emails to contacts with a subscription switch. It restricts marketing emails to contacts with a subscription.
In Germany, storing cookies on a device requires consent. Cookies that are strictly necessary for the requested service are exempt. This is set out in Section 25 of the German TDDDG, formerly the TTDSG.
You set up the banner under Settings > Privacy & Consent in the Cookies tab. It offers three types:
For Germany, opt-in is therefore usually the right choice, optionally with a selection by category. Since May 11, 2026, HubSpot has been automatically migrating accounts created before November 2022 that still use the old banner to version v2. Check the copy, categories, and country selection afterward.
The banner blocks HubSpot cookies and cookies from HubSpot integrations such as Google Analytics and Google Tag Manager. HubSpot does not automatically block cookies from scripts you add manually. For such setups, a dedicated consent tool is worth it. We compare five providers in Cookie Notices: 5 Common CMPs Compared. With HubSpot's cookie banner API, you pass that tool's consents on to HubSpot.
You store the legal basis in the contact property "Legal basis for processing contact's data". The options are:
You maintain the property individually, through bulk editing, on import, or via workflow. Check HubSpot's examples against German law: For newsletters to leads, Section 7 of the German Unfair Competition Act (UWG) requires express consent, even though HubSpot cites legitimate interest as an example for this case.
For each subscription type, a contact has one of three statuses: Subscribed, Unsubscribed, or Not Specified. When you subscribe a contact to a subscription type, you record the legal basis for the communication. This shows you, topic by topic, who may receive which emails.
In the form editor, you define under Data privacy options which consents a form asks for. You link each checkbox to a subscription type, optionally with a note pointing to your privacy policy. When a contact submits the form, HubSpot sets the legal basis to "Freely given consent from contact" and records the consent on the contact. With the data privacy settings turned on, the data privacy checkboxes are mandatory in new forms. Consent via form applies to marketing emails. For SMS, you collect consent another way.
On a data privacy request page, contacts can request a copy of their data or its deletion themselves. You log requests received by phone or email in the data request manager, with a responsible person and a deadline.
With permanent delete, you remove a contact along with email tracking, calls, and form submissions. This works only one contact at a time, and complete deletion can take up to 30 days. The email address goes on a block list and can then no longer be recreated by import or through the interface. If the person later gets in touch themselves, for example through a form, a new record is created. You delete the contact's comments on blog posts manually.
Yes. Under Settings > Privacy & Consent > Privacy tools, you turn on Delete inactive contacts automatically. By default, a contact counts as inactive after 365 days without activity, and you can adjust this period. HubSpot checks the create date, last session, last marketing email open, and last engagement. Deleted contacts can be restored from the recycling bin for 90 days, after which HubSpot deletes them permanently. Before turning this on, check how the deletion affects your reports.
By default, HubSpot uses customer data to train its own AI models. Super admins turn this off under Settings > AI in the Access tab with the AI Model Training switch. The opt-out only applies going forward: what a model has already learned from your data cannot be undone. You control data enrichment through a separate setting. HubSpot prohibits external AI providers from using customer data for training.
Make this decision deliberately and align it with your privacy policy and legal bases. We describe which rules to set before using Breeze in 6 Requirements for AI with HubSpot Breeze.