-1.svg)
Key Takeaways
-
GDPR governs how you collect, store, and use the personal data of people in the EU and UK.
-
HubSpot includes built-in tools for consent, data access, and deletion to support compliance.
-
Compliance starts with collecting clear, recorded consent at the point of capture.
-
You must be able to honor requests to access or delete a person's data.
-
This is a legal area, so set up the tools and confirm your approach with qualified counsel.
What Is GDPR Compliance and Why It Matters
GDPR is a data-protection regulation that governs how organizations collect, store, and use the personal data of people in the EU and UK. In practice it means getting clear consent before you process someone's data, being transparent about how you use it, and honoring their rights to see or delete it. HubSpot includes tools to help you do this: consent options on forms, consent tracking on records, and ways to handle access and deletion requests.
This matters because the rules carry real penalties, and because handling data respectfully builds trust with the people in your database. The tools below help you operate compliantly, but GDPR is a legal area with nuances specific to your business. Treat this as a practical setup guide for the HubSpot side, and confirm your overall approach with qualified legal counsel rather than relying on software settings alone.
How to Set Up GDPR Tools: Step-by-Step
GDPR settings have moved within HubSpot over time and some features depend on your plan, so confirm the exact location in your portal. This is not legal advice.
Step 1: Turn On GDPR Functionality
-
Log into your HubSpot account.
-
Open your account settings and find the privacy and consent options.
-
Enable the GDPR or data-privacy functionality for your account.
-
Confirm the exact path in your portal, as this setting has moved between versions.
Step 2: Set Up Consent on Your Forms
Consent is collected at the point of capture, so configure your forms first. In HubSpot:
-
Add consent checkboxes or notices to your forms.
-
Use clear language explaining what people are opting into.
-
Distinguish between consent to communicate and consent to process.
-
Make sure consent is freely given, not pre-ticked or bundled.
Step 3: Configure Consent Tracking
-
Make sure the legal basis for each contact is recorded on their record.
-
Track when and how consent was given.
-
Set subscription types so people can consent to specific kinds of communication.
-
Keep the record of consent so you can demonstrate it if asked.
Step 4: Prepare for Data Requests
People have the right to access or delete their data, so be ready to honor requests:
-
Know how to export a contact's data for an access request.
-
Know how to permanently delete a contact's data on request.
-
Note that permanent deletion is irreversible, so confirm requests carefully.
-
Have a clear internal process for who handles these requests.
Step 5: Review Cookies and Tracking
-
Set up a cookie consent banner for your website visitors.
-
Choose the most privacy-preserving defaults, declining non-essential tracking until consent.
-
Make sure tracking only runs where you have consent.
-
Confirm the banner and tracking behavior with your legal and web teams.
Best Practices for GDPR in HubSpot
-
Collect Consent Clearly: Use plain language and unbundled, un-ticked options at the point of capture, so consent is genuine and defensible.
-
Record the Legal Basis: Make sure every contact's record shows why you're allowed to process their data, and keep evidence of consent.
-
Honor Rights Promptly: Have a clear process to handle access and deletion requests quickly, and confirm deletions carefully since they're permanent.
-
Default to Privacy: On cookies and tracking, decline non-essential by default until someone consents, rather than opting them in.
-
Confirm With Counsel: Software settings support compliance but don't define it. Verify your overall approach with qualified legal advice for your business.
How to Use GDPR Tools in Your Workflow
-
Use subscription types so contacts control which communications they receive.
-
Reference recorded consent before adding contacts to marketing campaigns.
-
Route data access and deletion requests through one clear internal process.
-
Keep consent and privacy notices current as your data practices change.
Troubleshooting Common GDPR Setup Issues
Problem: I can't find the GDPR settings
Solution: This setting has moved within HubSpot over time and may depend on your plan. Check your privacy and consent settings, and confirm the current path in your portal.
Problem: Consent isn't being recorded on contacts
Solution: GDPR functionality may not be enabled, or your forms aren't configured for consent. Turn on the functionality and add consent options to your forms.
Problem: I need to fully delete someone's data
Solution: Use the permanent deletion option, but confirm the request first, as deletion is irreversible and removes the record entirely.
The Bottom Line
GDPR compliance in HubSpot comes down to collecting clear consent, recording your legal basis, and being able to honor access and deletion requests. The built-in tools make each of these practical, but compliance is ultimately a legal matter, so set up the software carefully and confirm your approach with qualified counsel. Handling data respectfully isn't just risk management, it builds trust with everyone in your database.
The Markivis Approach
We set up consent as a practice, not a checkbox, and confirm the details with counsel:
-
Collect consent clearly: We use plain, unbundled language at the point of capture, so consent is genuine and defensible.
-
Record the legal basis: We make sure every contact's record shows why we're allowed to process their data.
-
Default to privacy: We decline non-essential tracking until someone consents, rather than opting them in by default.
-
Confirm with counsel: We treat the HubSpot settings as support for compliance, not a substitute for legal advice on the specifics.
That trust-first foundation is part of how we turned marketing into a scalable revenue engine for Maple Assist, treating customer data as something to protect, not just use. See the Maple Assist case study.
