Buying leads and GDPR: what the law says in Spain

Buying leads is perfectly legal in Spain. What marks the difference between a compliant practice and a serious risk is how that data is captured, processed and contacted. This guide summarises, jargon-free, what GDPR requires when buying leads. (This is not legal advice: consult your DPO or advisor for your case.)

The key question: lawful basis

GDPR does not prohibit processing personal data; it requires a lawful basis to do so. When buying leads, the two relevant ones are usually the data subject consent and legitimate interest, depending on the case and the type of contact. A serious provider can demonstrate which applies to each lead.

What to require from your provider

• Data origin: where it comes from and on what basis it was captured.
• Traceability: record of consent or source per lead.
• Data processor agreement: the legal framework between you and the provider.
• Information to the subject: that they have been informed of the processing.
• Opt-out mechanisms: respecting the right to object and erasure.

Your obligations as a buyer

Receiving the lead is not the end of your duties, it is the beginning:

1. Inform the contact in your first communication who you are and why you contact them.
2. Respect the rights: access, rectification, erasure, objection.
3. Document your lawful basis to process that data.
4. Secure the data: controlled access and deletion when appropriate.

Signs of a compliant provider

A compliant provider works with prior verification, per-lead traceability and processing agreements, and does not promise "unlimited data" of opaque origin. Serious data infrastructure, like that of Funneld and the layer of Data Layer, is designed with privacy and compliance from the source (GDPR by design).

The legal red flags

• Mass lists with no explanation of origin or legal basis.
• Absence of a data processor agreement.
• Sensitive data (health, ideology) handled carelessly.
• A provider that does not allow exercising opt-out rights.