GDPR and CCPA risks when moving to HubSpot
How opt-outs, consent records and deletion requests get lost on the way into HubSpot, and how to carry them across intact.
The short answer: Compliance breaks when opt-outs, unsubscribes, consent records and past deletion requests don’t reach HubSpot. Inventory every consent field across your CRM and email tools, map them to HubSpot subscription types and legal basis, check imports against a deletion suppression list, reconcile opt-out counts before go-live and sign a data processing agreement with your partner.
This article explains common compliance risks in CRM migrations. It isn’t legal advice. Talk to your privacy counsel about your specific obligations.
Privacy laws such as the EU and UK GDPR and California’s CCPA, as amended by the CPRA, don’t stop applying because you’re changing software. A migration is when you’re most likely to break them by accident. Your customers’ choices about how their data is used are recorded in your old CRM and email tools. If those records don’t reach HubSpot intact, the new system starts acting against those choices.
Where consent lives before the move
- Opt-out and unsubscribe flags in your old CRM, often in more than one field.
- Email tool lists. Unsubscribes recorded in Mailchimp, Pardot, Zoho Campaigns or similar, not in the CRM at all.
- Consent and legal basis records for contacts covered by GDPR, sometimes in custom fields.
- Deletion history. People who asked to be deleted, who by design no longer exist as records.
- Custom flags such as “do not call” or “restricted account.”
Where it needs to land in HubSpot
HubSpot manages email permissions through subscription types and a contact’s subscription status, and can record a contact’s legal basis for processing in a dedicated property. Map every opt-out and consent field from your old systems to these explicitly, and document the mapping.
The four ways compliance breaks
1. Opt-outs don’t carry over
If unsubscribe data isn’t mapped, the first HubSpot campaign emails people who asked you to stop.
2. Deleted people come back
A contact deleted at their request can be recreated from an old spreadsheet or a second system. Keep a suppression list of past deletion requests and check every import against it.
3. The evidence is lost
Under GDPR you should be able to show your lawful basis for processing. If consent history stays behind in a system you then switch off, you lose the evidence. Archive it securely before the old subscription ends.
4. The migration itself is unlawful processing
Your migration partner is processing personal data on your behalf. That generally requires a written data processing agreement, appropriate security and care about where the data is processed.
How to carry consent across
- Inventory every consent-related field and list across the CRM and email tools.
- Map each to HubSpot subscription types, subscription status and legal basis.
- Build a deletion suppression list and check every import against it.
- Reconcile opt-out counts between old and new systems before go-live, like revenue.
- Decide which contacts are marketing contacts in HubSpot. It affects both compliance and your HubSpot bill.
- Sign a data processing agreement with your migration partner before they get access.
For the wider security picture, see the CRM migration security checklist.
Sources and further reading
- Track legal basis of processing in HubSpot, HubSpot Knowledge Base
- Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex
- GDPR Article 28: Processor, GDPR text
- UK GDPR, legislation.gov.uk
- CCPA laws and regulations, California Privacy Protection Agency
Platform features and policies change. Check the vendor’s current documentation before acting on any detail in this article. This article is general information, not legal advice.