Getting started with GDPR and CASL compliance

[udimailig1]

Hi everyone, new to the Hubspot community 👋

A bit of context: 

My organization has been using Hubspot primarily for sales/deal tracking with a large bulk of our CRM consisting of US, Canada and EU contacts imported from Seamless.ai as cold leads. I recently joined as their sole marketer and are now ready to leverage Hubspot more for marketing including email marketing, segmentation and content creation. From a marketing perspective, it feels like we're starting from scratch in Hubspot in a way, with a ton of sales contacts but no marketing CRM processes to speak of. While I'm moderately familiar with creating Hubspot emails, campaigns and landing pages, it's been years since I've had to manage a CRM hands-on for marketing - in the past, I'd either be working with mature CRM systems with established processes or had CRM specialists who handled list pulls and workflows for me. 

Where I need advice: 

I'm feeling overwhelmed with getting our Hubspot instance set up properly for email marketing. With no other marketers on my team or in-house legal/privacy experts to consult with, I'm wondering what's the best approach to get our Hubspot set up for success, particularly when it comes to contact consent, subscription lists and CASL/GDPR compliance. If there are other solo marketers who have been in this position, how did you get started? Is it better to bring in consultants? Register for training with Hubspot or elsewhere? Ultimately, I'm looking to educate myself as a marketer AND get advice specific to our Hubspot instance so we can hit the ground running.

Any advice or resources to get started would be super appreciated! Thanks in advance 🙏 

[karstenkoehler]

Hi @udimailig1,

I understand your challenge, it took me a while to wrap my head around all of the HubSpot functionalities and legal requirements in different countries. And still, whenever I talk to legal teams, their evaluations and requirements can differ drastically between countries.

Generally, here's what I'd suggest and what would likely also be easiest on your budget and time:

• Employ an external data privacy officer or commission legal consultation. As long as you're doing this on your own, you're most likely also liable for your mistakes and GDPR mistakes can get expensive quite quickly. If you can, work with someone who can spell out exact requirements and ideally has worked with HubSpot before. (Unfortunately, the latter isn't easy.)
• If they are experienced with HubSpot, they can formulate exact HubSpot requirements.
• If not, there are some resources that you can tap into, one of the main resources being this free course: https://academy.hubspot.com/courses/gdpr-course
• Additionally, I'd recommend reading up thoroughly on:
  • Subscriptions: https://knowledge.hubspot.com/contacts/how-do-subscription-preferences-and-types-work
  • Double opt-in: https://knowledge.hubspot.com/email/set-up-double-opt-in-for-emails
  • Legal basis for data processing: https://knowledge.hubspot.com/contacts/how-can-i-track-lawful-basis-of-processing-in-hubspot
  • GDPR features: https://knowledge.hubspot.com/privacy-and-consent/how-do-i-turn-on-gdpr-functionality-in-my-hubspot-...
  • GDPR overview: https://www.hubspot.com/data-privacy/gdpr

After / while doing so, you'll have questions, a lot of which community members can answer. Few members will ever give out legal advice but people like me will definitely explain HubSpot features and what to watch out for.

I'm not aware of any one-size-fits-all courses that would do it all for you and in my decade of working with HubSpot, HubSpot vendors, agencies and data privacy officers, I haven't met a person or resource that covers everything. It's always going to be a mix and I'm fairly confident that the above would be the leanest approach.

Hope this helps!

[udimailig1]

Hey Karsten

I appreciate your advice – thank you!

I really like the idea of having a data privacy officer or legal consultant so that it doesn’t fall solely on my shoulders to know everything – a scary thought! Do you recommend then that we engage with a law firm or are there consultants/agencies known to Hubspot who do this type of service? It feels like I’m searching for a unicorn who is familiar with privacy law, Hubspot and marketing best practices in Canada lol! If I take this approach, I would have request this to my leadership and I know they'd want recommendations on names or companies for consideration.

In the meantime, I’ll take a look at the links. Thanks so much for sharing!

[karstenkoehler · Accepted solution]

Hi @udimailig1,

Of course, happy to help!

I'm not familiar with the Canadian market but I'd probably start by getting offers/quotes from a few "traditional" law firms. In Europe, most fully online-based services that try to scale data privacy consultation and which I've worked with have fallen behind their promises, unfortunately.