1cloudconsultants.com - News , Data Sovereignty1cloudconsultants.com - News , Data Sovereigntyhttps://www.1cloudconsultants.com/blogs/data-sovereigntyWed, 09 Sep 2026 08:36:01 -0700http://zoho.com/sites/<![CDATA[HubSpot's Data U-Turn: What It Means for Your CRM]]>https://www.1cloudconsultants.com/blogs/post/hubspot-data-u-turn-what-it-means-for-your-crmHubSpot reversed its enrichment terms after customer backlash, raising fresh questions on CRM data governance, sovereignty and GDPR for UK and Irish firms.]]>

HubSpot's Data U-Turn: What It Means for Your CRM

Business Operations · 6 July 2026

On 1 July 2026, HubSpot told customers it was updating its terms of service to feed enrichment data from customer accounts into a shared commercial dataset, opted in by default. Four days later, following vocal pushback from customers on LinkedIn, HubSpot reversed the change entirely. Co-founder and CTO Dharmesh Shah replied to one of the loudest critics with a one-line admission: "You are right. We made a mistake and have taken steps to correct it."

The episode was brief, but it exposed a question that most businesses running their operations through a SaaS CRM rarely stop to ask: once your customer and prospect data sits inside someone else's platform, who actually controls what happens to it next? For UK and Irish businesses working under UK GDPR, the answer matters more than a single terms-of-service update. It touches data governance, data sovereignty, and how much scrutiny you give a vendor's privacy policy before you sign up.

What Different SaaS Data Models Actually Do With Your Data

Not every CRM vendor treats customer data the same way. The table below sets out three broad approaches, based on how HubSpot's withdrawn Contact Discovery terms were reported and on the publicly available privacy positions of major CRM vendors.

ApproachHow it treats your dataDefault setting
Pooled enrichment (HubSpot's withdrawn model)Business-card-level contact data from your CRM feeds a shared dataset used to enrich other customers' recordsOpt-out, applied automatically
Third-party data broker enrichmentYour records are matched against externally purchased or scraped datasets, not built from your own customer baseVaries by vendor and licence
Zoho's stated privacy positionZoho states it does not sell personal data to third parties and does not use customer data for advertisingNot applicable, no cross-customer data pooling programme

I do not have a verified source confirming that every SaaS vendor in the market avoids cross-customer data pooling entirely, so treat the third row as Zoho's own stated position rather than an independently audited guarantee. It is still worth reading any vendor's current privacy policy yourself before relying on a summary, including this one.

How CRM Data Enrichment Actually Works

Data enrichment is not inherently a problem. Most CRMs use it to fill gaps in a contact record, adding a job title, a company size, or a verified email address so your sales team spends less time on manual research. The question that HubSpot's July announcement raised was not whether enrichment happens, but where the enrichment data comes from and who else benefits from it.

What Counts as Enrichment Data

According to HubSpot's own communications at the time, the fields in scope included names, job titles, company affiliations, work email addresses, and company-level data. Records such as deal notes, call recordings, and custom fields were reportedly excluded. That distinction between "business card" data and deeper CRM content is one worth checking with any vendor, because the line between the two is a policy decision, not a technical necessity.

Where the Shared Dataset Comes In

The reported HubSpot model would have used enrichment data drawn from participating customer accounts to improve records across other customers' accounts too, effectively pooling contact intelligence across the platform. That is a different proposition from enrichment sourced purely from public records or licensed third-party data, because it turns each customer's own CRM into a contributor to everyone else's dataset.

Why GDPR Sits at the Centre of This

Under UK GDPR and the EU GDPR, personal data collected for one purpose, such as running your own sales pipeline, generally needs a proper lawful basis before it is repurposed for another, such as improving a third party's dataset. Vendors often rely on "legitimate interests" as that basis, which requires a genuine balancing test against the individual's rights, not just a line in a terms update. I am not a lawyer and this is not legal advice, so if your business relies on a vendor's enrichment features, it is worth having your data protection officer or legal adviser review the current terms directly rather than relying on any summary, including this article.

The terms of service you accepted on day one rarely stay fixed. The real safeguard is knowing how to check, and how often.

Where This Shows Up in Your Business

Sales
Prospecting lists built on borrowed data

If your outbound lists lean on platform-wide enrichment, a policy change elsewhere in the vendor's business can quietly alter where those contacts came from.

Marketing
Consent records that do not travel with the data

A contact who consented to hear from you specifically may not have consented to appear in someone else's enrichment pool, even indirectly.

RevOps
Settings that change without a clear trail

Enrichment, AI training, and tracking-code sharing settings are often buried several menus deep, and defaults can shift with a terms update.

Compliance
Sub-processor lists that need active monitoring

A vendor's data processing addendum names the sub-processors handling your data today, not necessarily the ones handling it in a year.

Four Steps to Check Your Own CRM Data Governance

1
Find your current enrichment and AI training settings

Locate the specific menu in your CRM admin settings and confirm what is switched on today, rather than assuming the defaults from setup.

2
Read the current Data Processing Addendum

Check which sub-processors are named, where data is hosted, and whether cross-border transfer safeguards such as the UK Addendum or Standard Contractual Clauses are in place.

3
Confirm your lawful basis for each use of contact data

Sales outreach, marketing automation, and any enrichment sharing may each need their own lawful basis, not one blanket assumption.

4
Set a recurring review, not a one-off check

Vendor terms change. A quarterly review of privacy policy updates and settings changes catches shifts before they become a live issue.

What This Means for UK and Irish Businesses

The HubSpot reversal was fast, and the company's public apology was direct, but the underlying tension has not gone away. As CRM vendors build more AI-driven prospecting and enrichment features, the value of pooling data across customers keeps growing, and so does the pressure to find a version of that idea customers will accept. Duncan Lennox, HubSpot's Chief Product and Technology Officer, said the company still believes in the underlying goal of better-targeted outreach, and intends to revisit it with what he described as a fully and transparently opt-in model, though with no confirmed date.

For businesses operating under UK GDPR, this is a reasonable moment to ask a vendor directly, in writing, exactly how enrichment, AI model training, and cross-customer data sharing work in your account today, and where your data is hosted. Zoho publishes its privacy and GDPR positions openly, including its stated commitment not to sell personal data or use it for advertising, and offers EU-region hosting and a GDPR-aligned Data Processing Addendum on request. That does not remove your own responsibility as data controller, but it does give you a clearer starting point for the conversation.

If you are reviewing your CRM setup, your data processing agreements, or simply want a second pair of eyes on your current privacy and enrichment settings, we are happy to have that conversation without the sales pressure.

Related reading

HubSpotZoho CRMData GovernanceData SovereigntyGDPRZoho Partner UKCRM Data PrivacyBusiness Automation

Not sure what your CRM does with your data?

We can walk through your current Zoho or CRM data settings, sub-processors, and GDPR position with you, no obligation attached.

Book a Zoho Discovery Call
]]>Mon, 06 Jul 2026 16:30:00 +0000<![CDATA[Data Sovereignty: What It Is and Why It Matters]]>https://www.1cloudconsultants.com/blogs/post/data-sovereignty-what-it-is-and-why-it-mattersZoho used its June 2026 Partner Inspire conference to put data sovereignty at the centre of its pitch, and here is what the term means for your business.]]>

Data Sovereignty: What It Is and Why It Matters

Zoho Partner News · 22 June 2026

Last week, Zoho held its Partner Inspire conference on 15 and 16 June 2026, and one theme ran through the sessions more than any other: data sovereignty. Zoho positioned it not as a compliance checkbox but as what its own materials called a foundational architecture, built around European data centres, a business model that does not monetise customer data, independent private ownership, and full control of its own technology stack.

That is a confident pitch, and worth unpacking on its own terms rather than taking at face value. Data sovereignty has become a genuine boardroom topic in the last two years, not a buzzword invented for a partner conference. If you run a UK or Irish business on any cloud platform, from CRM to email to file storage, the question of whose laws actually govern your data is worth understanding properly, whichever vendor you use.

Data Sovereignty vs Data Residency vs Data Protection

These three terms get used interchangeably, but they describe different things. Understanding the distinction matters because a vendor can tick one box and not the others.

TermWhat it actually coversCommon gap
Data residencyThe physical or geographic location where your data is storedServers can sit in the EU while the parent company remains subject to another country's laws
Data protectionThe rules governing how personal data is collected, used, and secured, such as UK GDPRProtection rules do not by themselves stop a foreign government compelling access to a vendor
Data sovereigntyWhich country's laws actually have authority over your data and the vendor holding it, regardless of server locationOften the least visible of the three, and the one most businesses never ask about

A vendor can offer strong data residency and solid GDPR-aligned data protection while still being legally exposed to a foreign jurisdiction's reach through its corporate ownership or headquarters. That gap is the specific problem data sovereignty is meant to address.

Why This Conversation Has Moved Up the Agenda

Data sovereignty was a niche topic in public-sector procurement a few years ago. It is now a mainstream one, driven by a small number of specific, reported events that made the abstract risk feel concrete.

Whose Laws Actually Apply to Your Vendor

US law gives American authorities potential access to data held by US-headquartered vendors, regardless of where the underlying servers physically sit. That single fact is the crux of the sovereignty debate: a European data centre does not automatically place data outside the reach of a foreign government if the company operating it is subject to that government's jurisdiction.

The Microsoft and ICC Case

The clearest recent example cited in industry coverage involved the International Criminal Court. Following a US executive order in February 2025, the ICC's chief prosecutor reportedly lost access to his Microsoft email account. The ICC later moved away from Microsoft entirely, adopting the open-source openDesk platform instead. I have not independently verified every detail of this reporting myself, so if you plan to cite it publicly, it is worth checking the original coverage from outlets such as The Register, Computer Weekly, and Irish Legal News directly. The episode is widely credited with sharpening European concern about what some commentators call a vendor "kill switch," the idea that a US tech provider could be compelled to cut off services to a specific customer or country with little recourse for that customer.

Europe's Regulatory Response

That concern has since shown up in policy. The European Commission has been developing a Tech Sovereignty Package, including a proposed Cloud and AI Development Act intended to keep sensitive public-sector data away from vendors seen as subject to foreign government reach. France and Germany also launched a joint task force on digital sovereignty in late 2025. None of this is settled law yet, and the detail is still moving, so treat the specifics as developing rather than final.

A server in Europe does not automatically put your data beyond the reach of a foreign government. Ownership and jurisdiction matter as much as geography.

Where Sovereignty Shows Up in Real Decisions

Public Sector & Regulated Firms
Procurement rules now ask the question directly

Public bodies and regulated industries increasingly need to demonstrate which jurisdiction governs their vendor before a contract is signed, not after.

IT & Operations
Vendor ownership structure becomes a risk factor

A privately held vendor with no external pressure to sell or relocate carries different risk than one owned by a company facing shareholder or political pressure.

Legal & Compliance
Contracts need a jurisdiction answer, not just a residency one

A data processing agreement that only states where servers sit does not answer whether a foreign court or executive order could compel access.

Leadership & Strategy
Business continuity now includes vendor jurisdiction risk

If a critical system could be disrupted by a foreign government action against its vendor, that risk belongs on the same continuity register as any other.

Four Questions to Ask About Your Own Data Sovereignty

1
Where is your data physically hosted, today

Confirm the actual data centre region for each core system, rather than assuming it matches where your account was registered.

2
Where is your vendor legally headquartered

A vendor's country of incorporation determines which government can, in principle, compel it to act, independent of where its servers sit.

3
Who owns the vendor, and how stable is that

Publicly listed companies face shareholder and takeover pressure that privately held vendors do not, which can change data handling decisions over time.

4
Does your vendor own its own infrastructure stack

A vendor running on a third-party hyperscaler inherits that hyperscaler's jurisdiction exposure as well as its own.

What This Means for UK and Irish Businesses

The UK sits in an interesting position in this debate. On 19 December 2025, the European Commission renewed its UK data adequacy decisions for a further six years, to 27 December 2031, confirming that personal data can keep flowing freely between the EEA and the UK. That is a genuinely reassuring, verified development for any UK business handling EU customer data. It addresses data protection adequacy, though, not the separate question of vendor jurisdiction that sovereignty debates are really about.

Zoho's Partner Inspire positioning leaned heavily on its European data centres, its privately held ownership, and the fact that it does not run an advertising business built on customer data. Those are genuine, checkable claims, and worth verifying against Zoho's own published privacy and GDPR documentation rather than taking a conference slide as the final word. The broader lesson from the conference applies regardless of which vendor you use: ask where your data sits, ask who governs your vendor, and treat the answer as part of your risk register, not a one-off compliance tick.

If you would like a straightforward, jargon-free look at where your current systems actually sit on data residency, vendor jurisdiction, and ownership, we are happy to talk it through with you.

Related reading

Data SovereigntyZoho Partner InspireData ResidencyGDPRZoho Partner UKCloud Data GovernanceEU Tech SovereigntyBusiness Continuity

Not sure where your business data actually sits?

We can walk through data residency, vendor jurisdiction, and ownership across your current systems, no obligation attached.

Book a Zoho Discovery Call
]]>Mon, 22 Jun 2026 09:50:00 +0000