HubSpot data privacy and consent: overview and key considerations
HubSpot provides data privacy and consent tools to help organisations manage personal data and support compliance with GDPR and other privacy regulations.
These tools can help you activate privacy features, record consent and manage cookie tracking. However, they must be configured and governed correctly as part of your organisation's wider compliance framework.
HubSpot provides the platform functionality, but your organisation remains responsible for how these tools are configured and used.
HubSpot guide:
Data privacy overview
Data privacy settings
HubSpot's data privacy settings activate privacy-related functionality across the platform, including features for lawful basis tracking, consent records and data subject requests.
Enabling these settings can affect how personal data is processed across different HubSpot tools.
Key considerations
When configuring your data privacy settings:
- Teams should understand how lawful basis and consent affect communications
- Settings should align with your organisation's internal data protection policies
- Your approach should also reflect your organisation's data retention requirements
Privacy settings should form part of a wider organisational approach to managing personal data rather than being treated as a standalone HubSpot configuration.
HubSpot guide:
Turn on data privacy settings
Consent management
HubSpot's consent settings can be used to record and manage communication consent and lawful processing information against contact records.
How these settings should be configured will depend on your organisation's requirements and the privacy obligations that apply to you.
Key considerations
- Consent language should be approved by your legal or compliance team
- Different regions may require different approaches to consent
- Consent records should be accurate and auditable
Your organisation is responsible for determining which lawful bases and consent approaches are appropriate.
HubSpot guide:
Set up consent for GDPR and other privacy laws
Cookie consent
HubSpot provides cookie consent functionality that enables website visitors to manage their tracking preferences.
This can be used as part of your organisation's approach to GDPR, ePrivacy and other applicable privacy requirements.
Key considerations
When configuring cookie consent:
- Cookie categories should reflect the actual behaviour of your website
- Your banner configuration should align with your published cookie and privacy policies
- Changes to the tracking technologies used on your website may require your cookie consent configuration to be reviewed and updated
Cookie consent should therefore be reviewed as your website and tracking setup changes.
HubSpot guide:
Set up cookie consent banners
Data Privacy Dashboard
HubSpot's Data Privacy Dashboard provides visibility into the status of your privacy configuration and can help identify potential gaps that may need to be reviewed.
It can be useful as an ongoing monitoring tool rather than something that is checked only during your initial HubSpot setup.
Key considerations
- The dashboard indicates configuration and setup completeness; it does not confirm legal compliance
- Recommendations and potential gaps should be reviewed regularly
- Your organisation should determine whether additional action is required based on its own policies and legal obligations
HubSpot guide:
Use the Data Privacy Dashboard
Your organisation's responsibilities
HubSpot provides technical functionality to help organisations manage privacy and consent, but using these tools does not in itself guarantee compliance with GDPR or other privacy regulations.
Your organisation remains responsible for areas including:
- Determining the appropriate lawful bases for processing personal data
- Approving consent and privacy language
- Deciding how consent should be collected and recorded
- Maintaining accurate consent records
- Establishing appropriate data protection and retention policies
- Ensuring your use of HubSpot complies with the privacy and data protection requirements that apply to your organisation
Where appropriate, your organisation should consult qualified legal or compliance professionals when determining its privacy obligations.
Forbidden and legal advice
Forbidden can help you understand and implement HubSpot's technical privacy and consent functionality as part of your HubSpot project.
However, Forbidden does not provide legal advice and does not determine whether your organisation is compliant with GDPR or other privacy regulations.
Your organisation remains responsible for its decisions as the data controller, including determining lawful bases for processing, approving consent language and ensuring its wider data protection obligations are met.
HubSpot guide:
GDPR in HubSpot
What to remember
HubSpot's privacy and consent tools provide the technical functionality needed to support your organisation's approach to data protection.
The important distinction is that HubSpot provides the tools, while your organisation determines how they should be configured and governed.
Privacy settings, consent language, cookie controls and data handling processes should therefore be reviewed within your organisation's wider privacy and compliance framework rather than configured in isolation.