{"id":27728,"date":"2026-11-12T09:30:00","date_gmt":"2026-11-12T08:30:00","guid":{"rendered":"https:\/\/www.hellomrlead.com\/?p=27728"},"modified":"2026-11-12T09:30:08","modified_gmt":"2026-11-12T08:30:08","slug":"is-b2b-cold-email-legal-spain","status":"publish","type":"post","link":"https:\/\/www.hellomrlead.com\/en\/is-b2b-cold-email-legal-spain\/","title":{"rendered":"Is B2B cold email legal in Spain? What GDPR and the LSSI actually say"},"content":{"rendered":"

Short answer:<\/strong> in Spain, B2B cold email isn’t a free-for-all, and it isn’t flatly banned either. GDPR lets you process business contact data on legitimate interest, but Spain’s LSSI requires prior consent for commercial email, business recipients included. A relevant, one-to-one email with clear identification and an easy opt-out lowers the risk. It doesn’t remove it.<\/p>\n

\n

Disclaimer:<\/strong> this article is for information only and isn’t legal advice. It summarises public legal texts as we read them on 01\/11\/2026. Before you launch a campaign, talk to a lawyer who specialises in data protection.<\/p>\n<\/blockquote>\n

“It’s B2B, so you can email anyone you like.” We hear it on almost every first call with a new client. In Spain, that’s not what the law says.<\/p>\n

The opposite isn’t true either. Not every cold email is illegal. The answer sits in the middle, and it depends on two laws people tend to mix up: GDPR, which covers what you do with personal data, and the LSSI, which covers how you send commercial messages electronically. You can comply with one and break the other without noticing.<\/p>\n

This isn’t legal advice. What we do is run outbound campaigns every week. Here’s how we read these rules, with a link to each official text so you can check it yourself.<\/p>\n

Which laws apply to B2B cold email in Spain?<\/h2>\n
\n\n\n\n\n\n\n\n\n
Law<\/th>\nWhat it covers<\/th>\nWhat it asks of you in practice<\/th>\n<\/tr>\n<\/thead>\n
GDPR (Regulation (EU) 2016\/679)<\/a><\/td>\nProcessing personal data, including a professional’s name and work email<\/td>\nA legal basis (legitimate interest, art. 6(1)(f)), telling the contact (art. 14) and honouring objections (art. 21)<\/td>\n<\/tr>\n
LSSI (Law 34\/2002)<\/a><\/td>\nCommercial communications by email in Spain<\/td>\nPrior consent unless there’s a previous contract (art. 21), identifying yourself (art. 20) and a free opt-out (art. 22)<\/td>\n<\/tr>\n
ePrivacy Directive (2002\/58\/EC)<\/a><\/td>\nThe EU framework the LSSI comes from<\/td>\nLets each country decide how it protects legal persons (art. 13(5))<\/td>\n<\/tr>\n
LOPDGDD (Organic Law 3\/2018)<\/a><\/td>\nSpain’s GDPR implementing law<\/td>\nBusiness contact data (art. 19) and advertising opt-out lists such as the Lista Robinson (art. 23)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

Does GDPR let you use legitimate interest for prospecting?<\/h2>\n

Yes, with conditions. Recital 47 of GDPR<\/a> says processing for direct marketing may<\/em> be regarded as carried out for a legitimate interest. “May” is the word that matters. It isn’t automatic.<\/p>\n

To rely on article 6(1)(f) you need to pass a three-step balancing test, which the EDPB explains in its Guidelines 1\/2024 on legitimate interest<\/a>:<\/p>\n

    \n
  1. Your interest is legitimate, real and specific. Selling your service to companies is.<\/li>\n
  2. The processing is necessary for that interest. If you only need a work email and a job title, don’t keep a personal mobile or a full profile copy.<\/li>\n
  3. Your interest doesn’t outweigh the contact’s rights. This is where reasonable expectations come in.<\/li>\n<\/ol>\n

    That last step is where we see most campaigns fail. A head of procurement can expect a supplier to email them about procurement. A maintenance technician doesn’t expect your pitch for accounting software because their address turned up in a list you bought.<\/p>\n

    I’d write the balancing test down. If the AEPD ever asks you for an explanation, that document is the first thing they’ll want. We keep one with every campaign.<\/p>\n

    Why is the LSSI the tricky part in Spain?<\/h2>\n

    Because article 21 of the LSSI<\/a> bans advertising or promotional emails that recipients haven’t requested or expressly authorised. The only exception is an existing contractual relationship where you offer products or services similar to what they bought.<\/p>\n

    The LSSI doesn’t separate consumers from companies. Article 13(5) of the ePrivacy Directive lets each member state decide how it protects legal persons, and Spain didn’t carve out a B2B exception. Some other countries did. That’s why the English-language articles saying B2B cold email “is legal in Europe” don’t carry over to Spain as they stand.<\/p>\n

    So how do outbound agencies like ours work in Spain? The debate is over what counts as a “commercial communication”. A personal email, written for one person and one role, proposing a conversation about a problem their company has, looks very little like a promotional newsletter blasted to thousands of addresses. Some argue the first falls outside article 21. The AEPD, though, has fined companies for unsolicited commercial emails sent to business addresses; you can search its decisions in the AEPD’s resolutions database<\/a>.<\/p>\n

    My reading is cautious, and it’s the one we apply for our clients: write every first email as if the AEPD were going to read it. If yours wouldn’t survive that, don’t send it.<\/p>\n

    What does every email need to include?<\/h2>\n

    Whatever you make of article 21, some requirements aren’t up for debate. These are the ones we apply to every campaign, and the ones I’d ask of you if I were your client:<\/p>\n

    \n\n\n\n\n\n\n\n\n\n
    Element<\/th>\nWhere it comes from<\/th>\nHow we do it<\/th>\n<\/tr>\n<\/thead>\n
    Who’s sending<\/td>\nLSSI art. 20 and GDPR art. 14<\/td>\nA real person’s name, company and website in the signature<\/td>\n<\/tr>\n
    That it’s commercial<\/td>\nLSSI art. 20<\/td>\nNo subject lines faking an earlier conversation<\/td>\n<\/tr>\n
    Why you’re writing and where you got their data<\/td>\nGDPR art. 14<\/td>\nOne line with the source and a link to the privacy notice<\/td>\n<\/tr>\n
    How to opt out<\/td>\nLSSI art. 22 and GDPR art. 21<\/td>\nOpt out by replying or by a link, free and without asking for data<\/td>\n<\/tr>\n
    What happens when they say no<\/td>\nGDPR art. 21(3)<\/td>\nA suppression list applied to every campaign, future ones included<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

    Article 14 of GDPR<\/a> says you must inform people when you didn’t get their data from them, at the latest in your first message. In practice it fits in two lines at the bottom with a link to the full notice.<\/p>\n

    What happens when someone opts out?<\/h2>\n

    They go on your suppression list and never hear from you again. Not from that campaign, and not from the next one.<\/p>\n

    Article 21(3) of GDPR<\/a> is clear: when someone objects to direct marketing, you stop processing their data for that purpose. There’s no balancing test here. It’s an absolute right.<\/p>\n

    The mistake we run into most is technical, not legal. A company uses several tools, the opt-out gets logged in one, and the next campaign goes out from another. That’s why we keep a single suppression list and check every new list against it before we load it into Instantly. We’d also treat any “please stop emailing me” reply as an opt-out, even if they didn’t click the link.<\/p>\n

    Where can you get contact data?<\/h2>\n

    The source matters for two reasons: you have to tell the contact where their data came from (GDPR art. 14), and it shapes your legitimate-interest balancing test.<\/p>\n

    These are the questions we ask before we use any source, and I’d suggest you copy them:<\/p>\n