--- title: "HubSpot and GDPR: how to handle personal data correctly" description: Is HubSpot GDPR compliant? About EU data storage, legal basis, consent, cookies and deletion, and what you need to do yourselves to follow GDPR in HubSpot. image: https://leadlabs.se/hubfs/Blog/hubspot-gdpr.jpg --- [Skip to content](https://leadlabs.se/en/insights/hubspot-gdpr#main-content) - [English](https://leadlabs.se/en/insights/hubspot-gdpr) - [Swedish](https://leadlabs.se/insikter/hubspot-gdpr) English Show submenu for translations [![Leadlabs](https://leadlabs.se/hs-fs/hubfs/leadlabs-primary-black.png?width=199&height=36&name=leadlabs-primary-black.png)](https://leadlabs.se/en?hsLang=en) - [Home](https://leadlabs.se/en/) - [Services](https://leadlabs.se/en/services) - [Articles](https://leadlabs.se/en/insights) - [About Us](https://leadlabs.se/en/about-us) - [Contact](https://leadlabs.se/en/contact-us) Open main navigation Close main navigation - [Home](https://leadlabs.se/en/) - [Services](https://leadlabs.se/en/services) - [Articles](https://leadlabs.se/en/insights) - [About Us](https://leadlabs.se/en/about-us) - [Contact](https://leadlabs.se/en/contact-us) - - [English](https://leadlabs.se/en/insights/hubspot-gdpr) - [Swedish](https://leadlabs.se/insikter/hubspot-gdpr) English Show submenu for translations - [Book Meeting](https://leadlabs.se/en/contact-us) [Book Meeting](https://leadlabs.se/en/contact-us?hsLang=en) [All posts](https://leadlabs.se/en/insights/all) October 11, 2026 # HubSpot and GDPR: how to handle personal data correctly ![Picture of Emelie](https://app.hubspot.com/settings/avatar/a7bfbbcaf0bc52ffebec008d63b2902f) By  [Emelie](https://leadlabs.se/en/insights/author/emelie)  ·  3 minute read ![Phone with a padlock icon on a purple screen](https://leadlabs.se/hs-fs/hubfs/Blog/hubspot-gdpr.jpg?width=1600&height=900&name=hubspot-gdpr.jpg) "Is HubSpot GDPR compliant?" is a question we get in almost every first conversation. The short answer is that HubSpot gives you the tools you need. But GDPR is about how you use them. Here is what HubSpot does, and what you need to do yourselves. **In short:** HubSpot can be used in compliance with GDPR. Data can be stored in HubSpot's EU data center, there is a data processing agreement and built in features for legal basis, consent, cookie banner and deletion. The responsibility for collecting, using and deleting personal data correctly, however, always lies with you as the data controller. ## Is HubSpot GDPR compliant? HubSpot is the data processor and you are the data controller. That means HubSpot is responsible for the platform being secure and the data being handled according to the agreement, while you are responsible for what data you collect, why, and how long you keep it. HubSpot offers, among other things: - **Data storage in the EU.** HubSpot has a data center in the EU, and new European accounts can be hosted there. Older accounts have been able to move their data. - **A data processing agreement** (DPA) as part of the terms. - **Standard contractual clauses** for any transfers outside the EU. - **Security** with encryption, two factor authentication and permission controls. ## GDPR features in HubSpot ### Legal basis for processing When you turn on the GDPR features, every contact gets a legal basis property, such as consent, contract or legitimate interest. You can set marketing emails to only be sent to contacts who have a legal basis. ### Consent in forms Forms can have consent checkboxes for different types of communication, with text you write yourselves. The consent is stored on the contact with timestamp and source. ### Subscription types Contacts can choose which types of email they want, such as newsletter, events or product news, and unsubscribe from individual types. ### Cookie banner HubSpot has a built in cookie banner that can block tracking until the visitor has consented. It can be adapted by language and country. ### Deletion and data access requests A contact can be permanently deleted under the right to be forgotten, and you can export all data about a person when someone requests access to their data. ## What you need to do yourselves 1. **Turn on the GDPR settings** in the account settings. 2. **Set a legal basis** on all contacts, including existing ones. Use workflows to do it in bulk. 3. **Update your forms** with clear consent text and a link to your privacy policy. 4. **Configure the cookie banner** and check that tracking is actually blocked without consent. 5. **Decide on retention rules.** How long do you keep contacts who are not customers and have not been active? 6. **Review integrations.** Data sent to other systems also needs to follow GDPR. 7. **Have a routine** for data access and deletion requests within one month. ## Legitimate interest in B2B Many B2B companies use legitimate interest as the legal basis for contacting people in their professional role. It can work, but it requires a documented balancing test, communication that is relevant to the person's role and that it is always easy to opt out. Check your setup with your data protection officer or a lawyer. ## AI agents and GDPR With HubSpot's new [AI agents](https://leadlabs.se/en/insights/ai-agents-in-hubspot?hsLang=en) the question becomes even more important. Agents that tailor messages or make decisions about individuals touch on the rules for automated decision making. Document what each agent does, what data it uses and where a human reviews it. ## Frequently asked questions about HubSpot and GDPR ### Does HubSpot store data in the EU? Yes. HubSpot has a data center in the EU where European customers' data can be stored. Check in your account settings where your account is hosted. ### Is HubSpot a data processor? Yes. When you use HubSpot you are the data controller and HubSpot is the data processor. The data processing agreement is included in HubSpot's terms. ### How do you delete a contact under GDPR in HubSpot? Open the contact and choose to permanently delete it under GDPR. The contact and its history are removed and the email address is blocked so it is not accidentally imported again. ### Do you need consent to send B2B emails? Not always. In B2B, legitimate interest can sometimes be used as the legal basis, but it requires a documented balancing test and relevant communication. Marketing law also sets requirements, so check with legal counsel. ### Does HubSpot have a cookie banner? Yes. HubSpot has a built in, customizable cookie banner that can block tracking until the visitor has given consent. ## Summary HubSpot gives you the tools you need to comply with GDPR, but you have to use them correctly. Turn on the features, set a legal basis on all contacts, have clear forms and routines, and review your integrations and AI agents. Want help reviewing your HubSpot portal from a GDPR perspective? Get in touch with LeadLabs. Please note that we are not lawyers, so for legal assessments we always recommend legal advice. ## Read also - [AI agents in HubSpot: how to get started](https://leadlabs.se/en/insights/ai-agents-in-hubspot?hsLang=en) - [Connect HubSpot to Fortnox or Visma](https://leadlabs.se/en/insights/hubspot-fortnox-visma-integration?hsLang=en) - [HubSpot implementation step by step](https://leadlabs.se/en/insights/hubspot-implementation?hsLang=en) Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://leadlabs.se/en/insights/hubspot-gdpr) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://leadlabs.se/en/insights/hubspot-gdpr) [twitter icon](https://twitter.com/intent/tweet?url=https://leadlabs.se/en/insights/hubspot-gdpr) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://leadlabs.se/en/insights/hubspot-gdpr) [envelope icon](mailto:?body=https://leadlabs.se/en/insights/hubspot-gdpr) ## Related posts [![](https://leadlabs.se/hubfs/Website%20images/HubSpot%20Target%20Accounts.png)](https://leadlabs.se/en/insights/how-to-use-target-accounts-in-hubspot-to-win-your-dream-clients?hsLang=en) [CRM & Sales](https://leadlabs.se/en/insights/tag/crm-sales) ### [How to Use Target Accounts in HubSpot to Win Your Dream Clients](https://leadlabs.se/en/insights/how-to-use-target-accounts-in-hubspot-to-win-your-dream-clients?hsLang=en) [![A silver key and a gold key on a purple background](https://leadlabs.se/hubfs/hubspot-gratis-vs-betalversion.jpg)](https://leadlabs.se/en/insights/hubspot-free-or-paid?hsLang=en) [HubSpot Platform](https://leadlabs.se/en/insights/tag/hubspot-platform) ### [HubSpot free or paid: what is included and when do you need to upgrade?](https://leadlabs.se/en/insights/hubspot-free-or-paid?hsLang=en) [![Light bulb with an AI chip against a purple background](https://leadlabs.se/hubfs/context-home-hubspot.jpg)](https://leadlabs.se/en/insights/context-home-hubspot-growth-context?hsLang=en) [AI](https://leadlabs.se/en/insights/tag/ai) ### [Context Home in HubSpot: why your AI is never better than your context](https://leadlabs.se/en/insights/context-home-hubspot-growth-context?hsLang=en) {{ footer\_js() }} {{ js\_integration\_body\_end() }} ```json { "@context" : "http://schema.org", "@type" : "Article", "author" : { "@type" : "Person", "name" : [ "Emelie" ], "url" : "https://leadlabs.se/en/insights/author/emelie" }, "datePublished" : "2026-10-11T22:31:15+0000", "description" : "Is HubSpot GDPR compliant? About EU data storage, legal basis, consent, cookies and deletion, and what you need to do yourselves to follow GDPR in HubSpot.", "headline" : "HubSpot and GDPR: how to handle personal data correctly", "image" : "https://4336585.fs1.hubspotusercontent-na1.net/hubfs/4336585/Blog/hubspot-gdpr.jpg", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://4336585.fs1.hubspotusercontent-na1.net/hubfs/4336585/leadlabs-primary-black.png" }, "name" : "Leadlabs" }, "url" : "https://leadlabs.se/en/insights/hubspot-gdpr" } ```