Since the GDPR took effect in 2018, a lot has changed in B2B marketing. Handling personal data is no longer just a “nice-to-have”—it’s now a crucial factor for successful collaboration between companies. Let’s take a look at what the GDPR is, what you need to keep in mind, and what features HubSpot offers to help you stay compliant.
Let’s start with the basics:
The General Data Protection Regulation is a European Union regulation that standardizes the rules governing the processing of personal data by most data controllers—both private and public—across the EU. This means it governs how companies and service providers are permitted to handle your personal data—and which regulations they must follow to protect their customers’ data.
It includes any data that can be used to identify a customer as an individual. This includes names, phone numbers, IP addresses, and personal email addresses.
The GDPR applies to all areas where personal data is processed—that is, if you can identify a person directly or indirectly, the GDPR applies. This is the case in B2B companies. So the answer is: Yes!
The GDPR specifies how you, as a business, are permitted to process, use, and store the personal data of EU citizens. B2B sales and marketing is one of the areas most heavily affected by the requirements of these regulations. That’s why you should familiarize yourself thoroughly with the regulations and always make sure to comply with them, because a data breach like this can end up costing you dearly.
You may face fines of up to 20 million euros or 4% of your company’s annual revenue. But it can also lead to official warnings, regular data protection audits (which can result in the blocking of data, including entire email lists), and liability claims. So here’s our tip: Don’t let it get that far.
As the title of this post suggests, this isn’t just about the GDPR itself—we want to show you how to remain compliant with data protection regulations when using HubSpot as a CRM system. You’re probably wondering: “But isn’t HubSpot American software?” Yes, that’s true.
In July 2020, the European Court of Justice’s Schrems II ruling declared the EU-U.S. Privacy Shield invalid. Companies must now verify, in every case of data transfer to the U.S., whether their contractual partner offers an equivalent level of data protection. This requires extensive research—including into U.S. law—that hardly any company can handle on its own.
The situation changed again on June 4, 2021. On that day, the European Commission published two updated sets of standard contractual clauses. HubSpot incorporated the updated Standard Contractual Clauses into its Terms of Service (see Section 5.4 of the HubSpot Terms of Service). Since then, HubSpot customers or partners no longer need to take any action to ensure that the updated Standard Contractual Clauses apply when their personal data is transferred.
Finally, in 2023, the EU-U.S. Privacy Framework determined that the United States ensures an adequate level of protection—comparable to that of the European Union—for personal data. For German customers of the software provider HubSpot, this means that personal data can be transferred from the EU to HubSpot, Inc. without risk and without any additional data protection measures.
So the answer is: Yes! HubSpot is GDPR-compliant. (You can find more information here)
HubSpot itself offers a comprehensive, very detailed article on GDPR-compliant use. You can find it here. All of these features, which help you remain compliant with data protection regulations, have been available since May 22, 2018. We’ve summarized the most important ones for you in a brief overview.
The“get consent status” feature allows you to check your users’ consent status regarding the use of cookies. The“remove cookies” feature lets you remove HubSpot cookies that have already been set in a user’s browser; their consent will be requested again on their next visit.
Under the GDPR, you need a lawful basis to use your users’ personal data. This can be the data subject’s consent following an appropriate notice. Important: The individual must know what they are consenting to.
Other options:
In HubSpot, the legal bases are divided into 2 categories:
HubSpot offers a standard contact property that records the legal basis for processing personal data, and tracking is simplified in HubSpot Opt-ins.
So-called“subscription types” replace the old email types, and subscription status can be tracked using a total of three states (subscribed, neither subscribed nor unsubscribed, and unsubscribed). This allows users to choose a specific subscription type. The system records whether a contact has actually subscribed. This provides you with the legal basis for communicating with your customers.
Contacts also have the right to request a copy of all personal data you’ve stored about them, as well as to request its deletion or correction. That’s why organized management and the ability to track customer data are so crucial. HubSpot has developed a“GDPR-compliant deletion”feature for this purpose, which permanently deletes contact data.
Last but not least, HubSpot offers a form creation feature that allows you to establish the legal basis for data processing and for communicating with your customers.
Let us put your system through its paces: