Sub-Processor Disclosure List

What it is

The document publishes an enumerated list of third-party vendors that HubSpot engages to process personal data on behalf of its customers, identifying each vendor by name, processing purpose, and data processing location.

Why it matters (compliance & governance perspective)

This provision serves as the primary GDPR Article 28 disclosure mechanism for HubSpot's processor obligations, enabling business customers acting as data controllers to identify and authorize the third parties who access personal data stored in HubSpot products.

Consumer impact (what this means for users)

The document establishes that personal data entered into HubSpot products may be processed by enumerated third-party vendors across multiple geographic locations, which affects the scope of data sharing that HubSpot's business customers must account for in their own privacy governance frameworks.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 28(2) and (4), which require processors to obtain controller authorization before engaging sub-processors and to impose equivalent data protection obligations on those sub-processors by contract. The relevant enforcement authorities are the EU data protection supervisory authorities and the UK Information Commissioner's Office. Where the provision discloses sub-processors in third countries, GDPR Chapter V transfer mechanism obligations are implicated. 2) GOVERNANCE EXPOSURE: Medium. The sub-processor list creates a formal disclosure record that controllers must reconcile against their own data processing inventories. Failure to monitor and respond to sub-processor changes could result in a controller operating with an inaccurate Record of Processing Activities, creating regulatory exposure under GDPR Article 30. 3) JURISDICTION FLAGS: EU and EEA controllers face the most direct obligation, as GDPR Article 28 governs the processor relationship directly. UK-based customers operate under an equivalent obligation under the UK GDPR. Swiss customers operating under the nFADP face analogous requirements. Customers in California are subject to CCPA service provider provisions, which similarly require disclosure of the categories of data shared with service providers. 4) CONTRACT AND VENDOR IMPLICATIONS: Business customers should confirm that their executed HubSpot Data Processing Agreement includes a clause granting the right to object to new sub-processors and specifying a notification window. The sub-processor list alone does not confirm that HubSpot has executed compliant sub-processing agreements with each listed vendor, and customers may wish to request confirmation of this as part of vendor due diligence. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should establish a process to receive and review HubSpot sub-processor change notifications, assess each new or modified sub-processor against data sensitivity and regulatory risk, and update their own Records of Processing Activities accordingly. Organizations subject to sector-specific regulations such as HIPAA or financial services data protection rules should evaluate whether any listed sub-processors handle regulated data categories.

Applicable agencies

Provision details

Other risks in this policy

• Cross-Border Data Transfer Disclosure medium
• Sub-Processor Change Notification medium
• Vendor Purpose and Function Categorization low
• Data Processing Location Disclosure medium