When HubSpot moves your data from Europe or the UK to the United States or other countries, it relies on legal mechanisms like Standard Contractual Clauses or the EU-U.S. Data Privacy Framework to make that transfer lawful.
Your personal data processed by HubSpot (a U.S.-headquartered company) is transferred to the United States, and the legal mechanism protecting that transfer could be challenged or invalidated, potentially leaving your data with reduced legal protections.
Cross-platform context
See how other platforms handle Cross-Border Data Transfers (SCCs and EU-U.S. Data Privacy Framework) and similar clauses.
Compare across platforms →The legal adequacy of cross-border data transfers has been challenged repeatedly (Schrems I and II), and if the EU-U.S. Data Privacy Framework is invalidated again, the lawfulness of your data being held in the U.S. could be called into question.
(1) REGULATORY FRAMEWORK: GDPR Art. 44-49 governs cross-border transfers; the EU-U.S. Data Privacy Framework was adopted by European Commission Adequacy Decision of July 10, 2023, but remains subject to challenge (cf. Schrems II, Case C-311/18). Standard Contractual Clauses are governed by EC Implementing Decision 2021/914. UK transfers are governed by UK GDPR and the UK's International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs. The primary enforcement authority for transfer adequacy is the EDPB and national DPAs. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.