Kayabyte

HubSpot GDPR request: export a contact’s files

By Kayabyte

When someone asks for the data you hold about them, the properties and activity in HubSpot are the easy part. Files attached to their records are the part teams forget. This guide covers what HubSpot’s contact export includes, how to collect attached files and what an app can add. It is not legal advice: whether and what you must include is for you, as controller, and your data protection adviser to decide. Last verified 11 November 2026.

What HubSpot’s contact export includes

HubSpot’s help article on exporting contact data lists properties, property history, activities such as emails and notes, and associations. It does not say that attached files are included, so do not assume they are. Check an export of a test contact before you rely on it.

Collect the files manually

Open the contact, click View all attachments, tick the files and choose Download (HubSpot’s article, updated 22 December 2025). Do the same on the company and any deals or tickets the person is associated with if those records hold their files. Attachments follow the view permissions for notes and tasks, so you may need a user with the right access. This is fine for one request. Write down which record each file came from.

Use the API

For a developer: read the engagements associated with the contact, read hs_attachment_ids, and fetch each file through the Files API with a signed URL. See the API guide. You need the files read and hidden-files read scopes.

Use the record card of an app

Attachment Exporter has a free card, “Download attachments”, for contacts, companies, deals and tickets. It exports the files of the open record as one zip with a CSV list, up to 300 files per record. Any HubSpot user who can open the record can use it. For a person who has several records, run it on each. Full disclosure: we built it. The app installs from our site, not the HubSpot Marketplace, and only reads from HubSpot.

Many people, or a bulk review

For a large review (for example a data audit across many contacts), Attachment Exporter: Bulk File Download exports the attachments of all contacts, a list or a date range as zips with a manifest, and its free audit mode lists files whose names or types suggest passports, IDs, contracts or payslips without downloading them. Files HubSpot marks sensitive are listed as restricted rather than downloaded.

Deleting files

HubSpot’s Files API documents a GDPR delete for files; use it only as your deletion process requires. An export app does not delete anything: Attachment Exporter has read-only access.

Who answers the request

If you use HubSpot to hold your customers’ data, you are normally the controller and HubSpot a processor; the request goes to you. Read HubSpot’s own privacy pages for its role.

FAQ

Must attachments be included in an access request? That is a legal question for you and your adviser. This guide only shows how to collect them.

Does HubSpot’s contact export include files? Its help article lists properties, history, activities and associations and does not say files are included.

Can I do it for free? Yes: the per-record download, or the free record card of Attachment Exporter.

Does the app delete files? No, it is read-only.

Questions or corrections: support@kayabyte.dev. HubSpot is a registered trademark of HubSpot, Inc. Kayabyte is an independent developer and is not affiliated with HubSpot or the other products named here.