Is HubSpot Forms GDPR compliant?

HubSpot is one of the most widely deployed marketing and CRM platforms in Europe. Thousands of European businesses use HubSpot's embedded forms to capture leads, contact requests, and newsletter sign-ups. But the combination of US-based infrastructure by default, an embedded tracking pixel, and data subject rights tooling that requires manual administrator action means HubSpot's GDPR compliance depends heavily on how you configure it — and which plan you are on.

The short answer: HubSpot can be used in a GDPR-compliant way, but only with deliberate configuration. Out of the box, HubSpot forms load a tracking script, store data on US infrastructure, and provide limited self-service DSAR tooling. European organisations using HubSpot for collecting personal data need to understand these defaults and take active steps to address them.

Where HubSpot stores form data

By default, HubSpot stores all form submissions — including contact details, personal responses, and associated CRM records — on servers in the United States (AWS). For the vast majority of HubSpot customers, form data is processed in the US regardless of the respondent's location.

HubSpot does offer EU data hosting ('European data residency') as an add-on for Enterprise-tier customers. If your account is configured for EU data residency, contact records and associated form data are stored in the EU. However, this feature is not available on Starter or Professional plans, and it must be actively enabled — it is not the default even on Enterprise. If you are not on Enterprise or have not enabled EU residency, your data is in the US.

HubSpot's tracking script and cookie consent

Every HubSpot form embeds the HubSpot tracking code (hs-script-loader.js) on the page — even if you are only using the free form tool. This script sets tracking cookies (hubspotutk, __hssrc, __hssc), tracks the respondent's browsing session, and links the form submission to a broader behavioural profile in HubSpot CRM.

Under the GDPR and the ePrivacy Directive (implemented as TTDSG in Germany and similar national laws across the EU), setting tracking cookies requires prior, specific, informed consent — not merely a pre-ticked checkbox. If a visitor submits a HubSpot form before giving cookie consent, the tracking script has already fired. This is a common compliance gap for organisations using HubSpot's free or basic form tools without a properly configured cookie consent banner that blocks the HubSpot script until consent is granted.

HubSpot's built-in GDPR features

HubSpot includes several GDPR-oriented features. The platform provides configurable consent checkboxes for forms, a cookie consent banner (available on paid plans), a privacy notice integration for embedding consent language on the form, and a data subject request workflow for handling access and deletion requests.

HubSpot's data subject request handling requires administrator action — when a deletion request comes in, it must be processed manually in the HubSpot settings. There is no self-service portal where respondents can submit and track their own DSAR. Deletion must be performed contact by contact, and HubSpot retains backup copies of deleted data for up to 30 days. These retention details must be disclosed in your privacy notice.

The DPA with HubSpot

HubSpot provides a Data Processing Agreement for customers. Under GDPR Article 28, you must have a signed DPA with every service that processes personal data on your behalf. HubSpot's DPA incorporates Standard Contractual Clauses for data transfers outside the EEA.

For free HubSpot accounts, DPA availability is more limited — free accounts may not have access to a formal DPA. If you are using HubSpot's free CRM and form tools to collect personal data from EU residents, verify whether a DPA is available for your account tier before relying on it for compliance.

GDPR checklist for HubSpot Forms users

• ✓ Is your HubSpot account on Enterprise with EU data residency enabled? If not, data is stored in the US by default.
• ✓ Have you signed a DPA with HubSpot? Required under GDPR Article 28 — verify your plan includes it.
• ✓ Does your cookie consent banner block the HubSpot tracking script until consent is given? The default tracking code fires immediately on page load.
• ✓ Do your form pages include a clear consent notice identifying HubSpot as a data processor and linking to your privacy policy?
• ✓ Do you have a process for data subject requests (Article 15–17)? HubSpot requires manual administrator action for each access or deletion request.
• ✓ If you use HubSpot integrations (Salesforce, Mailchimp, Zapier), does each integration have its own DPA and lawful cross-border transfer basis?

When HubSpot is (and isn't) suitable for GDPR

• ✓ Acceptable: Enterprise plan with EU data residency enabled, signed DPA, cookie consent blocking tracking script, DSAR workflow in place
• ✓ Acceptable: Marketing lead capture where consent is lawfully obtained, properly disclosed in a privacy notice, and the tracking script is consent-gated
• ✗ Risky: Starter or Professional plan — form data is stored in the US by default, with no EU residency option
• ✗ Risky: HubSpot tracking script active before cookie consent is given — violates ePrivacy / TTDSG requirements in Germany and most EU member states
• ✗ Risky: Free plan collecting personal data without a confirmed DPA
• ✗ Not suitable: Collecting special category data (health, legal, financial) under Article 9 — HubSpot provides no per-submission encryption or field-level access control
• ✗ Not suitable: Organisations requiring a self-service DSAR portal

HubSpot Forms vs a dedicated GDPR-first form tool

HubSpot Forms is fundamentally a lead capture layer within a broader CRM and marketing automation platform. Its GDPR features exist to support marketing compliance — consent checkboxes, cookie banners — but the underlying infrastructure (US-hosted by default, tracking pixel, shared CRM data model) was not designed with privacy-by-design as a first principle.

Organisations that use forms primarily for secure data collection rather than CRM — accountants collecting client intake data, consultants running surveys, HR teams capturing job applications — often find that a dedicated EU-hosted form tool with encryption at rest provides simpler, cleaner compliance than a CRM platform that has been configured to meet GDPR requirements after the fact.

Comparing tools? See our answer to is Google Forms GDPR compliant for how a Workspace account changes the picture.

HubSpot Forms and TTDSG compliance for German organisations

German organisations face additional obligations under the Telekommunikation-Telemedien-Datenschutz-Gesetz (TTDSG), which transposed the ePrivacy Directive into German law and requires prior opt-in consent before setting any non-essential cookies. The HubSpot tracking script (hs-script-loader.js) sets cookies on page load before any consent interaction — a direct conflict with TTDSG requirements as interpreted by the Hamburg and Berlin data protection authorities (Datenschutzbehörden).

For German companies embedding HubSpot forms, the required steps are: (1) Configure your consent management platform (CMP) to classify hs-script-loader.js as a 'marketing' or 'statistics' cookie category. (2) Set the CMP to block this script by default — it must load only after the visitor actively accepts marketing cookies. (3) Verify with a cookie auditing tool that the HubSpot script does not fire before consent. (4) Update your Datenschutzerklärung (German privacy policy) to name HubSpot as a data processor, describe the specific cookies set (hubspotutk, __hssrc, __hssc), their duration, and the legal basis. German DPA enforcement on pre-consent cookie tracking has resulted in fines and orders to cease processing — TTDSG compliance is not optional.

Frequently asked questions

Is HubSpot Forms GDPR compliant?

HubSpot Forms can be made GDPR compliant, but only with deliberate configuration on the right plan. On Enterprise with EU data residency enabled, a signed DPA, and a cookie consent banner that blocks the HubSpot tracking script until consent is given, HubSpot Forms is defensible for most marketing and lead capture use cases. On Starter or Professional plans — where data is stored in the US by default and there is no EU data residency option — HubSpot Forms creates GDPR exposure for EU respondent data. Free plan users may not have access to a formal DPA, making any personal data collection on the free tier a direct Article 28 risk.

Does HubSpot store data in the EU?

Only on Enterprise tier with EU data residency explicitly enabled. By default, all HubSpot plans store form submissions and CRM records in US-based AWS infrastructure. EU data residency is not available on Starter or Professional plans. To verify your data location, check your HubSpot account settings — if you do not see a EU data residency indicator, your data is stored in the United States. Even with EU residency enabled, HubSpot may transfer some data outside the EU for support, security, and service delivery purposes.

Does HubSpot provide a DPA?

Yes — HubSpot provides a Data Processing Agreement that incorporates Standard Contractual Clauses for cross-border data transfers. For paid accounts, the DPA is available online. However, free HubSpot accounts may not have access to a formal DPA — if you are collecting personal data from EU residents using HubSpot's free CRM and form tools without a confirmed DPA, you are in violation of GDPR Article 28. Always confirm DPA availability for your specific account tier before using any HubSpot form to collect EU personal data.

Does HubSpot's tracking script fire before cookie consent?

Yes, by default. The HubSpot tracking script (hs-script-loader.js) fires immediately on page load — before any cookie consent interaction. This means tracking cookies (hubspotutk, __hssrc, __hssc) are set and behavioural profiling begins as soon as a visitor lands on a page with a HubSpot form, regardless of whether they have given consent. Under the ePrivacy Directive (TTDSG in Germany, equivalent legislation across the EU), this violates the prior consent requirement for tracking cookies. To fix this, configure your consent management platform to block the HubSpot script as a 'marketing' category cookie until the visitor actively opts in.

Can I use HubSpot for collecting special category data under GDPR?

Not recommended. Special category data under GDPR Article 9 — health data, financial data, political opinions, trade union membership, religious beliefs, racial or ethnic origin — requires explicit consent or a specific Article 9(2) legal basis, a higher standard of technical protection, and careful documentation. HubSpot provides no per-submission encryption or field-level access control, stores data in US infrastructure by default, and loads a tracking script on form pages. For health or financial client data, an EU-hosted form tool with application-level encryption and no third-party tracking provides a materially stronger compliance position.

Is HubSpot Forms suitable for EU healthcare organisations collecting patient data?

Not recommended. EU healthcare organisations collecting patient personal data are subject to GDPR Article 9 (special category data) requirements and sector-specific national regulations. HubSpot Forms presents three specific problems for healthcare settings: the tracking script fires on the form player page before the visitor gives consent; data is stored in the US by default on all plans except Enterprise with EU residency explicitly enabled; and there is no per-submission encryption or field-level access control. For patient intake forms, appointment booking forms, or any form where respondents share health-related information, an EU-hosted form builder with application-level encryption at rest, no third-party tracking on the form player, and a DPA specifically covering healthcare data collection provides a significantly stronger compliance position under GDPR Article 9.