HubSpot offers an opt-in email notification system through which customers can receive at least 30 days advance notice before a Sub-Processor is added, replaced, or materially changes its service or country of operation. Notification is not automatic and requires customers to complete a subscription form.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Under GDPR Article 28(2), processors using general authorization must inform controllers of intended sub-processor additions or replacements and allow the controller an opportunity to object. This provision establishes that HubSpot's notification mechanism is opt-in rather than automatic, meaning customers who do not actively subscribe to the notification form will not receive advance notice of Sub-Processor changes. The adequacy of this opt-in model as satisfaction of the GDPR Article 28 notification obligation may depend on the specific language of HubSpot's DPA.
Interpretive note: Whether the opt-in notification mechanism satisfies GDPR Article 28(2) notification obligations depends on the language of HubSpot's DPA, which is not reproduced in this document.
This provision establishes that customers receive at least 30 days advance notice of Sub-Processor additions, replacements, or material service changes only if they have actively subscribed via the form at https://legal.hubspot.com/subscribe-subprocessor-updates. Customers who do not subscribe will not receive proactive notification of changes to the Sub-Processors that access their Customer Data.
Cross-platform context
See how other platforms handle 30-Day Advance Notification for Sub-Processor Changes and similar clauses.
Compare across platforms →"You may subscribe to receive notifications by email if we update this page to add or replace any Sub-Processors, if any of our Sub-Processors materially change the services that they provide, or if they change the country from which they provide them. To subscribe to the notification please complete the form available at https://legal.hubspot.com/subscribe-subprocessor-updates . If you opt-in to receive a notification, we will notify you at least 30 days prior to any such change taking effect.Excerpt from HubSpot's Sub-Processors
(1) REGULATORY LANDSCAPE: GDPR Article 28(2) requires that where a processor uses general authorization to engage sub-processors, it must inform the controller of intended additions or substitutions and give the controller the opportunity to object.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Under GDPR Article 28(2), processors using general authorization must inform controllers of intended sub-processor additions or replacements and allow the controller an opportunity to object. This provision establishes that HubSpot's notification mechanism is opt-in rather than automatic, meaning customers who do not actively subscribe to the notification form will not receive advance notice of Sub-Processor changes. The adequacy of this …
This provision establishes that customers receive at least 30 days advance notice of Sub-Processor additions, replacements, or material service changes only if they have actively subscribed via the form at https://legal.hubspot.com/subscribe-subprocessor-updates. Customers who do not subscribe will not receive proactive notification of changes to the Sub-Processors that access their Customer Data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.