LEGAL FRAMEWORK
Data protection and commercial prospecting
Commercial prospecting is recognised and regulated under European data protection law. This page sets out what the rules say, how the use of public professional data fits within them, and which practices give effect to those rules.
Updated: August 2026
The starting point
The General Data Protection Regulation does not prohibit commercial outreach. Recital 47 expressly acknowledges that processing personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.
What the law sets out is a method: identify a legal basis, inform about the processing, and honour the rights of the individuals concerned. Once that is in place, prospecting is an ordinary and entirely legitimate commercial activity.
Leadquiry collects only information businesses have themselves published in order to be contacted — a venue’s Google Maps listing, the contact address on a professional profile. The origin is identified and the context is commercial, which are precisely the two elements the law asks you to be able to evidence.
Applicable rules
Three bodies of law converge in Spain. It helps to know what each one governs.
GDPR
Regulation (EU) 2016/679
Governs the processing of personal data across the European Union: legal bases, information duties and data subject rights.
LOPDGDD
Organic Law 3/2018
Implements the GDPR in Spain. Article 19 deals specifically with contact data of professionals and sole traders.
LSSI-CE
Law 34/2002, article 21
Governs commercial communications by electronic means: what may be sent, with what identification and on what conditions.
What the law says, article by article
Specific references for anyone who wants to check the source.
Legitimate interest as a basis
Allows processing where necessary for the legitimate interests of the controller, provided the rights and freedoms of the data subject do not override them. That balancing exercise is best documented in writing.
Direct marketing and legitimate interest
Expressly acknowledges that processing for direct marketing purposes may be regarded as carried out for a legitimate interest, with the data subject’s reasonable expectations at collection as the guiding criterion.
Professional contact data
Presumes legitimate interest covers the processing of contact details and role information where the purpose is to maintain relations of any kind with the legal entity the individual works for.
Information where data is not obtained from the subject
Sets out what must be communicated when data was not collected directly: controller identity, purposes, legal basis, categories, source and rights. Usually satisfied through the privacy policy plus a reference in the message.
Right to object to direct marketing
A person may object at any time to processing for direct marketing. Once exercised, the data must no longer be processed for that purpose. The right is immediate and requires no justification.
Commercial communications by electronic means
Requires the communication to be identifiable as such and to state clearly who is sending it, and in all cases to provide a simple, free means of objecting.
Records of processing activities
Requires a record of processing activities, with exemptions for organisations under 250 employees depending on the nature and regularity of processing. Worth checking once whether it applies to you.
Data minimisation
Data must be adequate, relevant and limited to what is necessary. In prospecting, that means working with the contact details you need and not accumulating information you will not use.
How this works in practice
Operational recommendations that give effect to the above.
Document your legitimate interest assessment
One page is enough: who you target, what you offer, why it relates to their professional activity and what impact it has. Writing it down clarifies your own criteria.
Keep the origin traceable
Being able to say where each record came from and in what context it was public underpins everything else. Leadquiry records the source of every result.
Address the professional sphere
The framework described concerns professional contact data and offers related to the recipient’s activity. Communications aimed at private consumers fall under a stricter regime.
Identify yourself clearly
Company name, contact route and reason for writing. Beyond what the LSSI requires, it is what works: messages that say plainly who is writing and why get more replies.
Offer a simple opt-out
One line at the end of the message is enough, provided it works and you act on it. Keep a suppression list and honour it across channels.
Keep volume proportionate
Two or three spaced messages is a reasonable pattern, and also the one that performs best. Persistence wears down the brand without improving conversion.
Reflect the processing in your privacy policy
State that you process professional contact data from public sources, for what purpose and what rights apply. It satisfies article 14 and reassures anyone who checks.
Frequently asked questions
Can I email a business without prior consent?+
In the professional sphere, the LOPDGDD presumes legitimate interest covers processing contact data to maintain relations with the legal entity the person works for. The LSSI requirements on sender identification and opt-out apply alongside it. Together they define the operating margin.
What is the difference between contacting a business and a private individual?+
The regime described rests on the professional relationship between recipient and legal entity. Where the communication is addressed to someone as a consumer, consent requirements are considerably higher. Keep the two audiences separate.
What if someone asks me to stop contacting them?+
Act without delay and keep a record. Article 21(2) GDPR makes objection to direct marketing an immediately effective right. Retaining minimal data on a suppression list is the usual way to ensure it does not happen again.
What is Leadquiry’s role in this?+
Leadquiry is a tool for collecting information published by businesses themselves, and it identifies the source of each result. Any later processing — who you write to, what you offer and how you honour their rights — is for the user, who is the controller of that processing.
Do I need a record of processing activities?+
It depends on the size of your organisation and the nature and regularity of processing, under article 30 GDPR. A simple check worth doing once.
Scope of this information
This content is informational and does not constitute legal advice. How the rules apply depends on the sector, the jurisdiction and the circumstances of each processing operation. To assess your case, consult a qualified data protection professional.
Public data, identified source
Two searches included so you can test the system. No card required.