Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
HubSpot offers an opt-in email notification system through which customers can receive at least 30 days advance notice before a Sub-Processor is added, replaced, or materially changes its service or country of operation. Notification is not automatic and requires customers to complete a subscription form.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Under GDPR Article 28(2), processors using general authorization must inform controllers of intended sub-processor additions or replacements and allow the controller an opportunity to object. This provision establishes that HubSpot's notification mechanism is opt-in rather than automatic, meaning customers who do not actively subscribe to the notification form will not receive advance notice of Sub-Processor changes. The adequacy of this opt-in model as satisfaction of the GDPR Article 28 notification obligation may depend on the specific language of HubSpot's DPA.
Interpretive note: Whether the opt-in notification mechanism satisfies GDPR Article 28(2) notification obligations depends on the language of HubSpot's DPA, which is not reproduced in this document.
This provision establishes that customers receive at least 30 days advance notice of Sub-Processor additions, replacements, or material service changes only if they have actively subscribed via the form at https://legal.hubspot.com/subscribe-subprocessor-updates. Customers who do not subscribe will not receive proactive notification of changes to the Sub-Processors that access their Customer Data.
Cross-platform context
See how other platforms handle 30-Day Advance Notification for Sub-Processor Changes and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"You may subscribe to receive notifications by email if we update this page to add or replace any Sub-Processors, if any of our Sub-Processors materially change the services that they provide, or if they change the country from which they provide them. To subscribe to the notification please complete the form available at https://legal.hubspot.com/subscribe-subprocessor-updates . If you opt-in to receive a notification, we will notify you at least 30 days prior to any such change taking effect.Excerpt from HubSpot's Sub-Processors
(1) REGULATORY LANDSCAPE: GDPR Article 28(2) requires that where a processor uses general authorization to engage sub-processors, it must inform the controller of intended additions or substitutions and give the controller the opportunity to object. The opt-in notification model in this document raises the question of whether HubSpot's DPA separately satisfies the notification obligation as a contractual matter, independent of whether a customer has subscribed to the email notification. The Irish Data Protection Commission and other EU supervisory authorities have jurisdiction over this compliance question. (2) GOVERNANCE EXPOSURE: Medium. The opt-in structure means that customers who have not subscribed may not be informed of material Sub-Processor changes affecting their data in advance. For regulated industries or customers with heightened data protection obligations, this creates a procedural gap that could affect their own compliance posture if they are unaware of new Sub-Processor locations or service changes. (3) JURISDICTION FLAGS: EU and UK customers face the highest exposure, as their data protection obligations require documented awareness of sub-processor changes. Customers in regulated sectors (financial services, healthcare) may have additional contractual or regulatory requirements to assess new Sub-Processors before data transfer commences. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should confirm whether the HubSpot DPA independently obligates HubSpot to notify customers of Sub-Processor changes regardless of email subscription status, and whether the DPA preserves an explicit right to object. The 30-day notice period should be evaluated against the customer's internal change management timelines and any contractual obligations to their own customers or regulators. (5) COMPLIANCE CONSIDERATIONS: Legal and compliance teams should subscribe to the Sub-Processor notification list as an immediate operational step and document this subscription as part of their vendor management records. Teams should assess whether the 30-day notice period is sufficient to conduct transfer impact assessments or internal data protection impact assessments triggered by new Sub-Processor locations.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
Under GDPR Article 28(2), processors using general authorization must inform controllers of intended sub-processor additions or replacements and allow the controller an opportunity to object. This provision establishes that HubSpot's notification mechanism is opt-in rather than automatic, meaning customers who do not actively subscribe to the notification form will not receive advance notice of Sub-Processor changes. The adequacy of this …
This provision establishes that customers receive at least 30 days advance notice of Sub-Processor additions, replacements, or material service changes only if they have actively subscribed via the form at https://legal.hubspot.com/subscribe-subprocessor-updates. Customers who do not subscribe will not receive proactive notification of changes to the Sub-Processors that access their Customer Data.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.