Perform a GDPR-compliant delete in HubSpot

Last updated: August 12, 2020

Applies to:

All products and plans

Under the General Data Protection Regulation (GDPR), contacts in your account have the right to request that you delete all of their personal data. When this happens, the GDPR requires that you permanently remove the contact record from your database, including email tracking history, call records, form submissions, and other engagement data and activity. Typically, these requests should be attended to within 30 days. The right to deletion is not absolute, and can depend on the context of the request, so it doesn’t always apply.

Please note: while these features live in HubSpot, your legal team is the best resource to give you compliance advice for your specific situation.

In HubSpot, GDPR-compliant deletion includes a blocklist functionality, which means that once a contact is GDPR-deleted, you will not be able to add them back to your account in the future. This functionality is supported by anonymized data. If a GDPR-deleted contact chooses to fill out a form on your website, they will be added back to your account. 

Please note: while the contact's personal data will be deleted, anonymized analytics data will remain. For example, the contact's sessions will continue to be reflected in your sources report, but you won’t be able to identify the individual contact. Similarly, if you’ve sent emails to the contact or the contact filled out a form, the analytics will still be reflected in the email performance (opens, clicks, etc.) and number of form submissions, but the contact's information will no longer appear. 

To perform a GDPR-compliant deletion in HubSpot, you must be a Super Admin in your account and GDPR features must be enabled.

Perform a GDPR-compliant delete on a contact

To delete a contact in compliance with GDPR:

  • In your HubSpot account, navigate to Contacts > Contacts.
  • Click the name of the contact. GDPR-compliant deletions can only be performed on individual contact records. You cannot perform GDPR-compliant deletions in bulk using lists of contacts or workflows.  
  • In the left panel, click Actions, then select Delete.
  • In the dialog box, select the Permanently delete this contact and all its associated content to follow privacy laws and regulations radio button. Then click Delete contact.


Permanently delete records that have been deleted

If a record is already deleted and sent to the recycle bin (i.e., a normal delete and not a GDPR-compliant delete), you can still permanently delete it after. This can apply to other standard object records such as companies, deals, and tickets.

  • In your HubSpot account, navigate to your contacts, companies, deals, or tickets.
  • In the upper right, click the Actions dropdown menu and select Restore [objects].
  • Hover over the record you want to delete permanently and click Delete.
  • In the dialog box, click Permanently delete.

Data that will be purged upon a GDPR-compliant delete

Up to 30 days after this deletion is initiated, a GDPR-compliant purge will be performed. The record will be removed from your HubSpot account along with the following information: 

  • Salesforce connector
  • Contacts data 
  • Analytics data
  • Calling data
  • Form submissions
  • Feedback data
  • Integrations data 
  • Emails
  • Notifications
  • Meetings 
  • Engagements
  • Conversations 
  • Bots 

If you have the ads add-on, when you perform a GDPR-compliant delete of a contact, they will also be deleted from your syncing Facebook ads audience, ensuring that you no longer send advertisements to this contact. HubSpot will not automatically delete any blog comments the contact left on your blog posts, so you will need to manually delete the blog comments.