The first instinct of anyone starting to prospect new companies is to ask whether it is even legal. It is — within concrete rules. GDPR does not ban contacting companies that have never heard of you; it regulates how you collect, use and store the data you need to do it.
This article is general guidance, not legal advice. For your specific case, confirm with a lawyer or DPO.
A professional contact is not the same as a personal one
An address like info@company.com or hello@company.com identifies the company, not a person. An address like jane.smith@company.com is already personal data, even though it is professional — it is tied to an identifiable individual. That does not make the second case off-limits, but it demands more care: the message has to be relevant to that person's role, and it cannot be treated like a consumer mailing list.
The most common legal basis is legitimate interest
For B2B commercial contact, the most commonly used legal basis is not prior consent — it is legitimate interest. In plain terms: a company can contact another to propose something relevant to its business, as long as the commercial interest does not disproportionately override the rights of the person contacted. In practice that means three things: the offer has to be genuinely relevant to the recipient, the contact has to be proportionate (reaching 50 qualified companies is not the same as blasting 50,000 at random), and there always has to be a simple way to say no.
What this requires in practice
What to avoid entirely
Purchased lists of unknown origin are the biggest risk — there is usually no way to prove the data was collected legitimately, and the responsibility to verify that falls on whoever uses it, not whoever sold it. Blasting the same message in bulk, with no filtering at all, also weakens the legitimate-interest argument: it becomes harder to justify that the contact was relevant and proportionate when it was fired at thousands of addresses at once.
Ignoring a removal request, or continuing to contact someone after an explicit opt-out, stops being a grey area — it becomes a clear violation.
Where that leaves you
B2B prospecting in Portugal is a common, legal practice, done every day by companies of every size. What separates a well-run campaign from a problem is not the number of contacts — it is the quality of the qualification, where the data came from, and whether an opt-out is actually respected.
Qualified contacts, from verifiable public sources.
Studiminds Scout works only with signals and data from public sources — no purchased lists of unknown origin.
See Scout running