LEGAL FRAMEWORK
Data protection and commercial prospecting
Commercial prospecting is recognised and regulated under European data protection law. This page sets out what the rules say, how the use of public professional data fits within them, and which practices give effect to those rules.
Updated: August 2026
The starting point
The General Data Protection Regulation does not prohibit commercial outreach. Recital 47 expressly acknowledges that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.
The law requires each processing activity to be assessed: identify a legal basis, provide information where required and honour individual rights. Legitimate interest may apply in some professional contexts, but it is not automatic and does not replace specific rules on commercial communications.
Leadquiry collects publicly available information and identifies its source. That traceability helps document the processing, but does not by itself make every later use lawful.
Applicable rules
Three bodies of law converge in Spain. It helps to know what each one governs.
GDPR
Regulation (EU) 2016/679
Governs the processing of personal data across the European Union: legal bases, information duties and data subject rights.
LOPDGDD
Organic Law 3/2018
Implements the GDPR in Spain. Article 19 deals specifically with contact data of professionals and sole traders.
LSSI-CE
Law 34/2002, article 21
Governs commercial communications by electronic means: what may be sent, with what identification and on what conditions.
What the law says, article by article
Specific references for anyone who wants to check the source.
Legitimate interest as a basis
Allows processing where necessary for the legitimate interests of the controller, provided the rights and freedoms of the data subject do not override them. That balancing exercise is best documented in writing.
Direct marketing and legitimate interest
Expressly acknowledges that processing for direct marketing purposes may be regarded as carried out for a legitimate interest, with the data subject’s reasonable expectations at collection as the guiding criterion.
Professional contact data
Presumes legitimate interest covers the processing of contact details and role information where the purpose is to maintain relations of any kind with the legal entity the individual works for.
Information where data is not obtained from the subject
Sets out what must be communicated when data was not collected directly: controller identity, purposes, legal basis, categories, source and rights. Usually satisfied through the privacy policy plus a reference in the message.
Right to object to direct marketing
A person may object at any time to processing for direct marketing. Once exercised, the data must no longer be processed for that purpose. The right is immediate and requires no justification.
Commercial communications by electronic means
Requires the communication to be identifiable as such and to state clearly who is sending it, and in all cases to provide a simple, free means of objecting.
Records of processing activities
Requires a record of processing activities, with exemptions for organisations under 250 employees depending on the nature and regularity of processing. Worth checking once whether it applies to you.
Data minimisation
Data must be adequate, relevant and limited to what is necessary. In prospecting, that means working with the contact details you need and not accumulating information you will not use.
How this works in practice
Operational recommendations that give effect to the above.
Document your legitimate interest assessment
One page is enough: who you target, what you offer, why it relates to their professional activity and what impact it has. Writing it down clarifies your own criteria.
Keep the origin traceable
Being able to say where each record came from and in what context it was public underpins everything else. Leadquiry records the source of every result.
Address the professional sphere
The framework described concerns professional contact data and offers related to the recipient’s activity. Communications aimed at private consumers fall under a stricter regime.
Identify yourself clearly
Company name, contact route and reason for writing. Beyond what the LSSI requires, it is what works: messages that say plainly who is writing and why get more replies.
Offer a simple opt-out
One line at the end of the message is enough, provided it works and you act on it. Keep a suppression list and honour it across channels.
Keep volume proportionate
Two or three spaced messages is a reasonable pattern, and also the one that performs best. Persistence wears down the brand without improving conversion.
Reflect the processing in your privacy policy
State that you process professional contact data from public sources, for what purpose and what rights apply. It satisfies article 14 and reassures anyone who checks.
Frequently asked questions
Can I email a business without prior consent?+
As a general rule, no. In Spain, the LSSI (Article 21) prohibits sending advertising by email that has not been previously requested or authorised, including when the recipient is a business. The exception is your existing customers, for products or services similar to those they already bought. Legitimate interest under the GDPR does not replace this rule, and a published email address is not permission either.
What is the difference between contacting a business and a private individual?+
The regime described rests on the professional relationship between recipient and legal entity. Where the communication is addressed to someone as a consumer, consent requirements are considerably higher. Keep the two audiences separate.
What if someone asks me to stop contacting them?+
Act without delay and keep a record. Article 21(2) GDPR makes objection to direct marketing an immediately effective right. Retaining minimal data on a suppression list is the usual way to ensure it does not happen again.
What is Leadquiry’s role in this?+
Leadquiry collects publicly available information and shows the source of each result. We are responsible for that collection: anyone can ask us to delete their data by emailing team@leadquiry.com. What you do afterwards with exported data is your responsibility: who you contact, through which channel, on what legal basis and how you handle unsubscribe requests.
Do I need a record of processing activities?+
It depends on the size of your organisation and the nature and regularity of processing, under article 30 GDPR. A simple check worth doing once.
Scope of this information
This content is informational and does not constitute legal advice. How the rules apply depends on the sector, the jurisdiction and the circumstances of each processing operation. To assess your case, consult a qualified data protection professional.
Public data, identified source
100 trial credits included. No card required.