If your HubSpot account contains personal data about individuals, HubSpot's separate Data Processing Agreement automatically applies and sets the rules for how that data is handled.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The DPA governs GDPR and CCPA compliance for personal data processed through HubSpot, and its terms and obligations are legally binding even though they are in a separate document that many customers may not have read.
Interpretive note: The adequacy of passive DPA incorporation by reference versus affirmative execution for GDPR Article 28 compliance is subject to regulatory interpretation and may vary by EU member state supervisory authority.
Any customer whose HubSpot account contains contact records, email addresses, or other personal information about individuals is automatically subject to the DPA, which carries its own compliance obligations around data subject rights, breach notification, and international data transfers.
How other platforms handle this
Cloudflare's current Privacy Policy is incorporated into this Agreement by this reference and is located at https://www.cloudflare.com/privacypolicy/. In addition, by using the Services, you acknowledge and agree that internet transmissions are never completely private or secure.
If you are an enterprise customer using our API, your data is handled pursuant to the applicable data processing agreement between AI21 and your organization. The terms of that agreement govern the collection, use, and retention of data processed through the API, and may differ from the terms applic...
If you access or use any of Oura's location-based services, such as by enabling GPS-based activity tracking through our Services, Oura may process the approximate or precise location of your device while the service is active. This data may be obtained via your device's service provider network ID, ...
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 10 platforms.
"HubSpot's Data Processing Agreement ('DPA'), which is incorporated herein by reference, applies to the extent Customer Data includes Personal Data, as defined in the DPA. The DPA sets out the terms that apply to HubSpot's processing of Customer Data and is available at https://legal.hubspot.com/dpa.— Excerpt from HubSpot's HubSpot Terms of Service
REGULATORY LANDSCAPE: This provision directly engages GDPR Article 28, which requires a written contract between data controller and data processor covering specified mandatory terms including processing instructions, confidentiality, security measures, sub-processor obligations, data subject rights assistance, and breach notification. CCPA service provider agreement requirements under California Civil Code are also implicated. Enforcement authorities include EU national supervisory authorities and the California Privacy Protection Agency. Legal teams should verify the current DPA version covers all GDPR Article 28 mandatory elements and that standard contractual clauses or other transfer mechanisms are in place for non-EEA data transfers. GOVERNANCE EXPOSURE: High. Incorporating the DPA by reference rather than requiring affirmative execution is operationally convenient but may create audit trail gaps for demonstrating GDPR Article 28 compliance, as regulators may require evidence that a formal data processing agreement was in place at the time of processing. Some EU supervisory authorities have indicated that clear affirmative agreement to DPA terms is preferable to passive incorporation. JURISDICTION FLAGS: EU and EEA customers face heightened exposure if the DPA does not adequately address post-Schrems II transfer mechanisms for US-based processing. UK customers require a separate International Data Transfer Agreement or addendum following Brexit. Healthcare sector customers in the US should assess whether HubSpot's DPA satisfies HIPAA Business Associate Agreement requirements, as a standard GDPR DPA does not constitute a BAA. CONTRACT AND VENDOR IMPLICATIONS: Vendor management programs should maintain a copy of the DPA version in effect at contract execution and monitor for updates. The DPA URL referenced (legal.hubspot.com/dpa) indicates HubSpot may update the DPA independently, which procurement teams should track as part of ongoing vendor assessment. Sub-processor lists referenced in the DPA should be reviewed for adequacy of data transfer protections. COMPLIANCE CONSIDERATIONS: Legal teams should (1) obtain and formally document acceptance of the current DPA; (2) verify that the DPA covers all categories of personal data the customer will process through HubSpot; (3) confirm transfer mechanism adequacy for cross-border data flows; (4) assess sub-processor disclosure completeness; and (5) establish a process for monitoring DPA amendments and assessing their impact on existing data processing activities.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Watcher: 10 platforms + same-day alerts. No credit card required.
We read the privacy policies and terms of service of 38 AI platforms. Here is what they say about training, retention, arbitration, and liability.
Professional Governance Intelligence
Need to monitor specific governance provisions?
Professional includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
The DPA governs GDPR and CCPA compliance for personal data processed through HubSpot, and its terms and obligations are legally binding even though they are in a separate document that many customers may not have read.
Any customer whose HubSpot account contains contact records, email addresses, or other personal information about individuals is automatically subject to the DPA, which carries its own compliance obligations around data subject rights, breach notification, and international data transfers.
ConductAtlas has identified this type of provision across 1 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.