What record categories live in our CRM, and how long do we retain each?

A sound records management program applies retention rules to CRM data the same way it applies them to email, contracts, or financial records by knowing which record categories live in your CRM and what regulatory and business requirements apply.

What triggers a litigation hold on CRM data, and who executes it?

The EDRM (Electronic Discovery Reference Model) process applies to CRM data. Organizations need a litigation hold process that includes HubSpot to suspend normal deletion activity when a legal hold trigger is met.

Who formally owns records governance in our CRM?

Records management is often a structural gap because CRM implementation is usually handled by sales or marketing operations. A governed CRM requires someone or a documented process to formally own records governance.

Your HubSpot CRM Is a Records Management Problem Waiting to Happen

Q: How do we respond to privacy deletion requests across our CRM environment?

Under GDPR and CCPA, you need to trace data across systems and execute a documented, verifiable deletion that holds up to regulatory scrutiny, rather than just removing a contact from a marketing list.

Steve Golden
May 3
4 min read

Your sales team lives in HubSpot. Every email, every deal note, every contact record, every pipeline update — it all lands there. HubSpot's dashboards are clean, the automation is powerful, and the data is easy to access.

That's exactly the problem.

Because what your sales team built as a pipeline management tool is also a records repository. And in most organizations, nobody is treating it like one.

What Your CRM Actually Contains

Think about what's sitting in your HubSpot instance right now.

Contact records with personal information — names, emails, phone numbers, company affiliations — subject to GDPR, CCPA, and a growing patchwork of U.S. state privacy laws. Email communications that may constitute business records under any number of regulatory frameworks. Deal history and pipeline notes that could be relevant to litigation. Documents attached to contacts or companies. Marketing communications tied to individuals who may have since requested deletion.

This isn't a hypothetical inventory. It's what's in your CRM today. The question isn't whether it carries legal significance — it does. The question is whether your organization has any documented, defensible approach to governing it.

Most don't.

Three Places Where It Goes Wrong

Retention — The Default Is "Keep Everything"

Most organizations have never asked how long CRM records should be kept. The default answer — keep everything, indefinitely — feels safe. It isn't. Retaining records longer than your legal obligation requires isn't neutral: it expands your exposure in litigation, creates unnecessary privacy liability, and compounds storage and operational costs every year you leave it unaddressed.

A sound records management program applies retention rules to CRM data the same way it applies them to email, contracts, or financial records. That means knowing which record categories live in your CRM, what regulatory and business requirements apply, what your retention periods should be — and then actually implementing them.

Privacy Rights — The Right to Be Forgotten Is Real

Under GDPR and CCPA, individuals have the right to request that their personal data be deleted. When that request arrives, removing them from your marketing list isn't enough. You need to trace their data across systems — including your CRM — and execute a documented, verifiable deletion that holds up to regulatory scrutiny.

Can you do that in HubSpot today? Do you know every property and associated object that holds a given contact's data? Do you have a process — not a workaround — for handling deletion requests end to end?

This is an information governance problem. HubSpot configuration won't solve it.

E-Discovery — What Are You Producing?

If your organization faces litigation, opposing counsel can request records from your CRM: deal communications, contact histories, email logs, internal notes. The EDRM (Electronic Discovery Reference Model) process applies to CRM data the same as any other electronically stored information.

Do you have a litigation hold process that includes HubSpot? Do you know how to suspend normal deletion activity on specific records while operations continue? Is anyone formally responsible for preserving CRM records when a legal hold trigger is met?

If the answer is "I don't know," you have your answer.

The Root Cause

HubSpot was implemented by your sales operations team — or your marketing team, or your revenue operations function. They're excellent at what they do. Records management is not in their job description.

That's not a criticism. It's a structural gap that exists in nearly every organization that has deployed a CRM without IG involvement. The technology is solid. The governance layer is missing.

When I work with organizations on IG programs, CRM systems almost always surface as a problem area during assessment. Not because anyone made a mistake — but because nobody asked the records management questions when the system went in. Now there's years of accumulated data, no retention policy, no deletion workflow, and no one who formally owns any of it.

What Good Looks Like

A governed CRM isn't a restricted CRM. Your sales team loses nothing. What changes is that someone — or a documented process — can answer the questions that currently have no answer:

What record categories live in our CRM, and how long do we retain each?
What triggers a litigation hold on CRM data, and who executes it?
How do we respond to privacy deletion requests across our CRM environment?
Who formally owns records governance in our CRM?

These questions belong in your IG program. If you don't have one, they go unanswered — until they can't.

The Bottom Line

Your CRM is not just a sales tool. It is a records environment with compliance obligations, privacy exposure, and e-discovery implications. The sooner your organization recognizes that — and builds the governance framework to match — the less likely you are to learn it the hard way.

Call to Action:

If your organization runs HubSpot and has never asked the records management questions, that's a gap worth closing before it costs you. Let's talk. No obligation — just a straight conversation about where you are and what it would take to get where you need to be.