HubSpot GDPR Compliance: The Complete Configuration Guide

GDPR Compliance Is Not Optional – and HubSpot Supports It

Every company processing personal data of UK or EU residents must comply with GDPR. Fines for non-compliance reach up to 4% of annual global turnover or 20 million EUR, whichever is higher. HubSpot provides native GDPR tools, but they require proper configuration. This guide covers every GDPR configuration you need in HubSpot to achieve compliance.

GDPR Requirements and HubSpot Configuration

Step-by-Step GDPR Configuration

Step 1: Enable GDPR tools. Navigate to Settings → Privacy & Consent → Enable GDPR settings. This activates lawful basis tracking, consent capture on forms, and the GDPR delete function. This is the foundation – everything else builds on this setting.

Step 2: Configure lawful basis options. Define which lawful bases your company uses: consent (most common for marketing), legitimate interest (for existing business relationships), and contractual necessity (for customer data processing). Apply the appropriate basis to existing contacts and configure forms to capture basis for new contacts.

Step 3: Set up consent on all forms. Every form that collects personal data must include appropriate consent language. Configure separate consent checkboxes for: data processing consent, marketing communication consent, and specific subscription consents. Consent language must be clear, specific, and unambiguous.

Step 4: Configure cookie consent. Enable HubSpot’s cookie banner with proper categorization. Ensure analytics and advertising cookies only load after consent. Test that cookie preferences are respected across page visits and sessions.

Step 5: Create data subject request process. Build internal workflows for handling access requests, deletion requests, and restriction requests within the required 30-day response window. Assign a data protection contact and document the process.

Common GDPR Mistakes in HubSpot

Mistake 1: Pre-checked consent boxes. GDPR requires active, affirmative consent. Pre-checked checkboxes are not valid consent. Configure all form consent fields as unchecked by default.

Mistake 2: Bundled consent. “I agree to everything” is not valid GDPR consent. Separate consent for processing, marketing emails, and specific communication types. Contacts must be able to consent to some and decline others.

Mistake 3: No consent for existing contacts. When enabling GDPR tools, existing contacts need lawful basis documentation. Run a re-consent campaign or document legitimate interest for existing business relationships.

Example: UK Company That Achieved GDPR Audit Readiness

A UK B2B company with 25,000 contacts in HubSpot received notification of a potential ICO audit. Their HubSpot configuration had GDPR tools enabled but improperly configured: no lawful basis tracked for 60% of contacts, forms lacked proper consent language, and cookie consent was not properly blocking tracking before consent.

A 3-week remediation project included: re-consent email campaign to undocumented contacts (recovering consent from 45%), legitimate interest documentation for existing customers, form consent language update across all 30 forms, cookie consent reconfiguration, and creation of data subject request workflows. The company passed the ICO review with no findings. Total remediation cost: 8,000 GBP – significantly less than the potential fine.

Conclusion

GDPR compliance in HubSpot requires intentional configuration: enabling GDPR tools, tracking lawful basis, capturing proper consent, configuring cookie management, and creating data subject request processes. These configurations should be implemented during initial HubSpot setup, not added retroactively. Companies operating in the UK and EU should treat GDPR configuration as a mandatory implementation requirement, not an optional enhancement.

Need GDPR-compliant HubSpot configuration? Talk to Widelly about GDPR compliance setup including consent management, lawful basis tracking, and audit-ready documentation.

HubSpot GDPR Configuration: The Complete 8-Step Setup

Step 1: Enable GDPR settings in HubSpot (Settings > Privacy and Consent > GDPR). This activates consent tracking on all forms and enables the legal basis and consent tracking fields on contact records. Step 2: Configure your cookie consent banner (Settings > Website > Cookie Policy). Set banner text, consent categories (necessary, analytics, marketing), and ensure the banner appears before any tracking cookies are set for EU visitors. Step 3: Add legal basis properties to contact records. For each marketing communication type (email, phone, direct mail), document the legal basis: consent, legitimate interest, or contractual necessity. Step 4: Update all HubSpot forms to include explicit consent checkboxes with opt-in language and link to your privacy policy. Step 5: Configure a data retention policy – decide how long to keep personal data for different contact types and create a workflow that flags or deletes contacts after the retention period expires. Step 6: Set up a right-to-erasure workflow: when a contact submits a deletion request (via a form or email), a workflow deletes all their personal data from HubSpot and confirms deletion. Step 7: Test the full consent and deletion process with a test contact before going live. Step 8: Document your data processing activities in a Record of Processing Activities (RoPA) that references HubSpot as a data processor.

GDPR Lawful Basis for Marketing in HubSpot: Consent vs Legitimate Interest

Most B2B companies rely on either consent or legitimate interest as the lawful basis for marketing communications under GDPR. Consent requires explicit opt-in from the contact for each communication type. Legitimate interest allows marketing to existing customers and prospects who have a reasonable expectation of receiving relevant business communications, without requiring explicit consent – but requires a documented Legitimate Interest Assessment (LIA) and a clear opt-out mechanism. HubSpot supports both approaches: consent is tracked through opt-in checkboxes on forms, legitimate interest is documented through the Legal Basis contact property. B2B marketers in the EU typically use legitimate interest for direct business-to-business marketing (confirmed in GDPR recital 47 and UK ICO guidance) while using consent for re-marketing to cold contacts and consumer-facing communications.

Frequently Asked Questions

HubSpot Cookie Consent: Configuring for UK and EU Markets

UK and EU companies using HubSpot must configure their website’s cookie consent management to comply with the UK GDPR and EU ePrivacy Directive. The minimum compliant configuration: a cookie consent banner that appears before any non-essential cookies (analytics, marketing) are set, requires explicit user action to accept or decline non-essential cookies (pre-ticked boxes are not compliant), provides the ability to manage consent preferences by category, and records consent decisions with timestamps. HubSpot’s built-in cookie consent banner (configurable in Settings > Privacy and Consent) provides this functionality for HubSpot-hosted pages. For third-party CMPs (OneTrust, Cookiebot) managing consent across a broader website infrastructure, configure the CMP to control HubSpot’s tracking code loading – preventing HubSpot’s tracking from firing until consent for analytics cookies is obtained.

Data Portability and Subject Access Requests in HubSpot

Under GDPR and UK GDPR, data subjects have the right to receive a copy of all personal data held about them (Data Subject Access Request, DSAR) and the right to receive it in a portable format. HubSpot supports DSAR compliance through the data portability feature: an admin can export all data held for a specific contact (contact properties, activity history, form submissions, email history) as a JSON or CSV export. This export can be provided to the data subject as evidence of DSAR compliance. For automated DSAR workflows, Operations Hub custom-coded actions can trigger the HubSpot API’s privacy endpoints to generate the export automatically when a DSAR request form is submitted, reducing admin time from 2-4 hours to 5-10 minutes per request.

Frequently Asked Questions