Short answer: in Spain, B2B cold email isn’t a free-for-all, and it isn’t flatly banned either. GDPR lets you process business contact data on legitimate interest, but Spain’s LSSI requires prior consent for commercial email, business recipients included. A relevant, one-to-one email with clear identification and an easy opt-out lowers the risk. It doesn’t remove it.
Disclaimer: this article is for information only and isn’t legal advice. It summarises public legal texts as we read them on 01/11/2026. Before you launch a campaign, talk to a lawyer who specialises in data protection.
“It’s B2B, so you can email anyone you like.” We hear it on almost every first call with a new client. In Spain, that’s not what the law says.
The opposite isn’t true either. Not every cold email is illegal. The answer sits in the middle, and it depends on two laws people tend to mix up: GDPR, which covers what you do with personal data, and the LSSI, which covers how you send commercial messages electronically. You can comply with one and break the other without noticing.
This isn’t legal advice. What we do is run outbound campaigns every week. Here’s how we read these rules, with a link to each official text so you can check it yourself.
Which laws apply to B2B cold email in Spain?
| Law | What it covers | What it asks of you in practice |
|---|---|---|
| GDPR (Regulation (EU) 2016/679) | Processing personal data, including a professional’s name and work email | A legal basis (legitimate interest, art. 6(1)(f)), telling the contact (art. 14) and honouring objections (art. 21) |
| LSSI (Law 34/2002) | Commercial communications by email in Spain | Prior consent unless there’s a previous contract (art. 21), identifying yourself (art. 20) and a free opt-out (art. 22) |
| ePrivacy Directive (2002/58/EC) | The EU framework the LSSI comes from | Lets each country decide how it protects legal persons (art. 13(5)) |
| LOPDGDD (Organic Law 3/2018) | Spain’s GDPR implementing law | Business contact data (art. 19) and advertising opt-out lists such as the Lista Robinson (art. 23) |
Does GDPR let you use legitimate interest for prospecting?
Yes, with conditions. Recital 47 of GDPR says processing for direct marketing may be regarded as carried out for a legitimate interest. “May” is the word that matters. It isn’t automatic.
To rely on article 6(1)(f) you need to pass a three-step balancing test, which the EDPB explains in its Guidelines 1/2024 on legitimate interest:
- Your interest is legitimate, real and specific. Selling your service to companies is.
- The processing is necessary for that interest. If you only need a work email and a job title, don’t keep a personal mobile or a full profile copy.
- Your interest doesn’t outweigh the contact’s rights. This is where reasonable expectations come in.
That last step is where we see most campaigns fail. A head of procurement can expect a supplier to email them about procurement. A maintenance technician doesn’t expect your pitch for accounting software because their address turned up in a list you bought.
I’d write the balancing test down. If the AEPD ever asks you for an explanation, that document is the first thing they’ll want. We keep one with every campaign.
Why is the LSSI the tricky part in Spain?
Because article 21 of the LSSI bans advertising or promotional emails that recipients haven’t requested or expressly authorised. The only exception is an existing contractual relationship where you offer products or services similar to what they bought.
The LSSI doesn’t separate consumers from companies. Article 13(5) of the ePrivacy Directive lets each member state decide how it protects legal persons, and Spain didn’t carve out a B2B exception. Some other countries did. That’s why the English-language articles saying B2B cold email “is legal in Europe” don’t carry over to Spain as they stand.
So how do outbound agencies like ours work in Spain? The debate is over what counts as a “commercial communication”. A personal email, written for one person and one role, proposing a conversation about a problem their company has, looks very little like a promotional newsletter blasted to thousands of addresses. Some argue the first falls outside article 21. The AEPD, though, has fined companies for unsolicited commercial emails sent to business addresses; you can search its decisions in the AEPD’s resolutions database.
My reading is cautious, and it’s the one we apply for our clients: write every first email as if the AEPD were going to read it. If yours wouldn’t survive that, don’t send it.
What does every email need to include?
Whatever you make of article 21, some requirements aren’t up for debate. These are the ones we apply to every campaign, and the ones I’d ask of you if I were your client:
| Element | Where it comes from | How we do it |
|---|---|---|
| Who’s sending | LSSI art. 20 and GDPR art. 14 | A real person’s name, company and website in the signature |
| That it’s commercial | LSSI art. 20 | No subject lines faking an earlier conversation |
| Why you’re writing and where you got their data | GDPR art. 14 | One line with the source and a link to the privacy notice |
| How to opt out | LSSI art. 22 and GDPR art. 21 | Opt out by replying or by a link, free and without asking for data |
| What happens when they say no | GDPR art. 21(3) | A suppression list applied to every campaign, future ones included |
Article 14 of GDPR says you must inform people when you didn’t get their data from them, at the latest in your first message. In practice it fits in two lines at the bottom with a link to the full notice.
What happens when someone opts out?
They go on your suppression list and never hear from you again. Not from that campaign, and not from the next one.
Article 21(3) of GDPR is clear: when someone objects to direct marketing, you stop processing their data for that purpose. There’s no balancing test here. It’s an absolute right.
The mistake we run into most is technical, not legal. A company uses several tools, the opt-out gets logged in one, and the next campaign goes out from another. That’s why we keep a single suppression list and check every new list against it before we load it into Instantly. We’d also treat any “please stop emailing me” reply as an opt-out, even if they didn’t click the link.
Where can you get contact data?
The source matters for two reasons: you have to tell the contact where their data came from (GDPR art. 14), and it shapes your legitimate-interest balancing test.
These are the questions we ask before we use any source, and I’d suggest you copy them:
- Is it business data (work email, title, company) or personal data? Article 19 of the LOPDGDD presumes it’s lawful to process business contact details to reach someone at their company, but it doesn’t expressly extend that to sales prospecting. Don’t treat it as a blanket permission.
- Can the provider show how they got the data? If they can’t tell you, you won’t know what to tell the person when they ask.
- Does the address exist? At HelloMrLead we verify every address with MillionVerifier before the first send and enrich with BetterContact. A verified email isn’t a legal email, but a wave of bounces does tell you someone bought a list without looking.
- Have you checked the Lista Robinson? Article 23(4) of the LOPDGDD requires you to check advertising opt-out systems before sending commercial messages to people who haven’t consented.
Bought databases “with consent for everything” cause the most trouble. That consent almost never covers your company or your specific purpose. We don’t use them.
How much can getting it wrong cost?
The LSSI grades offences as minor, serious and very serious in its articles 38 and 39. Sending unsolicited commercial email in bulk, or repeatedly, can be a serious offence, with fines of up to €150,000; minor ones go up to €30,000. GDPR has its own regime in article 83, with much higher ceilings.
Before any fine, there’s a cost that hits you sooner: recipient complaints and spam reports. They also damage your domains’ reputation, and you’ll feel that in the deliverability of the whole campaign.
How do we handle it at HelloMrLead?
We won’t tell you our method is “100% legal”. Nobody in Spain can promise that without a lawyer looking at each case. Here’s what we do with every client:
- We email people whose role fits what our client sells. If we can’t explain in one sentence why we’re writing to them, they don’t make the list.
- We send low, spread-out volumes: 30 emails per mailbox per day, across at least 10 mailboxes. No bulk sends from a single domain.
- Every email has a real sender, privacy information and an opt-out that works with a plain reply.
- We keep one suppression list shared across all of a client’s campaigns.
- We document the legitimate-interest test and the data source for each campaign.
- The client’s legal adviser reviews the privacy wording before the first send.
That doesn’t take the risk to zero. It lowers it, and it leaves a record that you thought about it.
Mistakes we see around cold email legality
- Copying another country’s rules. What’s fine where there’s no LSSI doesn’t simply carry over to Spain.
- Leaning on “it’s B2B”. The LSSI doesn’t make that exception.
- Not saying where the data came from. It’s the easiest complaint to make.
- Handling opt-outs by hand, in a single tool.
- Blasting generic addresses like info@ on the idea that there’s no personal data involved. GDPR may apply differently, but the LSSI still does.
FAQ
Is B2B cold email legal in Spain?
It depends on your case. GDPR allows legitimate interest for direct marketing, but the LSSI requires prior consent for commercial email, business recipients included. A one-to-one email that’s relevant to the role, with clear identification and an opt-out, lowers the risk. Check with your lawyer before you launch.
Do I need consent to email a professional?
Under article 21 of the LSSI, for commercial email, yes, unless there’s a previous contract. Whether your first email counts as a commercial communication is exactly what your legal adviser should assess.
Do I need an unsubscribe link in every email?
Yes. Article 22 of the LSSI requires a simple, free way to opt out in every communication. We’d also treat any reply asking to stop as an opt-out.
Can I buy a B2B contact database?
You can, but the risk becomes yours. Ask the provider where the data came from, verify the emails and check the Lista Robinson. If you can’t tell a contact where you got their data, don’t use it.
Is cold email the same as spam?
Not legally. Spam is bulk unsolicited commercial email. A one-to-one email to a relevant person looks little like that, although in Spain both can fall under the LSSI if they’re commercial.
If you’d rather build your own SDR process
If you’d prefer to keep outbound in-house, the Pack SDR brings together the templates and the process we use to prepare campaigns, so your SDR doesn’t start from scratch. Get the Pack SDR.
