Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision establishes that fifteen named HubSpot affiliate entities across the US, Ireland, Germany, Australia, Singapore, Japan, Colombia, Sweden, France, the UK, Belgium, Canada, Spain, the Netherlands, and India are authorized as Sub-Processors with access to Customer Data by virtue of the customer's agreement to the DPA.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes Customer Data access by HubSpot affiliate entities in jurisdictions that include countries without EU adequacy decisions, specifically Singapore (HubSpot Asia Pte. Ltd.), India (HubSpot India Private Limited), Japan (HubSpot Japan KK), and Colombia (HubSpot Latin America S.A.S.). Customers must ensure that appropriate cross-border transfer mechanisms are in place for data flowing to these entities.
Interpretive note: The specific cross-border transfer mechanisms applicable to affiliate Sub-Processors in Singapore, India, Japan, and Colombia are not disclosed in this document and depend on the content of HubSpot's DPA and associated standard contractual clauses.
Under this provision, Customer Data may be accessed by fifteen HubSpot affiliate entities in fifteen countries, including Singapore, India, Japan, and Colombia, as authorized by the customer's agreement to the DPA. Customers with data residency or transfer restrictions should evaluate the transfer mechanisms applicable to each affiliate location.
Cross-platform context
See how other platforms handle HubSpot Affiliate Sub-Processors with Global Scope and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"To help HubSpot deliver the Subscription Service, we engage HubSpot Affiliates as Sub-Processors to assist with our data processing activities. By agreeing to the DPA, you agree all of these Sub-Processors may have access to Customer Data.Excerpt from HubSpot's Sub-Processors
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V (international data transfers) for transfers to affiliate entities in Singapore, India, Japan, and Colombia, none of which currently hold a full EU adequacy decision. Equivalent requirements apply under UK GDPR for transfers from the UK. Japan has an adequacy decision from the EU, but it applies under specific conditions and to specific categories of data. India's Digital Personal Data Protection Act introduces new transfer obligations that may interact with this provision. The relevant enforcement authorities include EU national supervisory authorities and the Irish Data Protection Commission. (2) GOVERNANCE EXPOSURE: High. The geographic scope of affiliate Sub-Processors spans fifteen countries, several of which require documented transfer mechanisms (Standard Contractual Clauses or binding corporate rules) for EU personal data. The document does not specify which transfer mechanisms apply to each affiliate location, requiring customers to obtain this information from HubSpot's DPA or supplementary documentation. (3) JURISDICTION FLAGS: EU and EEA customers face transfer obligations for data flowing to Singapore, India, Colombia, and potentially Japan (subject to adequacy conditions). UK customers are subject to equivalent UK GDPR international transfer requirements. Customers in regulated sectors should assess whether sector-specific restrictions on international data transfers apply to affiliate sub-processor relationships. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request from HubSpot the specific transfer mechanisms (Standard Contractual Clauses, binding corporate rules, or other) in place for each non-EEA affiliate entity. Intra-group data transfer agreements and transfer impact assessments should be documented and made available for regulatory inspection if required. (5) COMPLIANCE CONSIDERATIONS: Customers should update their records of processing activities to reflect all fifteen HubSpot affiliate entities as Sub-Processors and document the applicable transfer mechanisms for each non-EEA location. Transfer impact assessments may be required for Singapore, India, Japan, and Colombia. Customers should monitor for changes to adequacy decisions or national data protection legislation in these jurisdictions that could affect the validity of existing transfer mechanisms.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision authorizes Customer Data access by HubSpot affiliate entities in jurisdictions that include countries without EU adequacy decisions, specifically Singapore (HubSpot Asia Pte. Ltd.), India (HubSpot India Private Limited), Japan (HubSpot Japan KK), and Colombia (HubSpot Latin America S.A.S.). Customers must ensure that appropriate cross-border transfer mechanisms are in place for data flowing to these entities.
Under this provision, Customer Data may be accessed by fifteen HubSpot affiliate entities in fifteen countries, including Singapore, India, Japan, and Colombia, as authorized by the customer's agreement to the DPA. Customers with data residency or transfer restrictions should evaluate the transfer mechanisms applicable to each affiliate location.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.