B2B prospecting in Belgium within the rules of the GDPR

Anyone in Belgium who wants to approach companies that are not yet customers has to deal with two sets of rules. The GDPR determines when you may process personal data, such as the name and email address of a business owner. The Code of Economic Law also determines how you may send advertising by email and how telephone sales must be conducted. The first set of rules is supervised by the Data Protection Authority (GBA), the second by the FPS Economy.

A common belief is that the GDPR does not apply to business contacts. That is only partly true. The GDPR protects natural persons. A business owner or a buyer remains a natural person, at work as well. Below we set out what is allowed. This article is an overview and does not replace legal advice for your specific situation.

Legitimate interest as a legal basis

To use personal data for direct marketing you need a legal basis. The two most commonly used are consent and legitimate interest. According to the Data Protection Authority, there is no hierarchy between those legal bases and direct marketing can take place on the basis of legitimate interest.

Legitimate interest is no free pass. You must be able to demonstrate three things:

• you have a legitimate interest, such as promoting your services;
• the processing is necessary to achieve that interest;
• the interests and rights of the person you contact do not outweigh your interest.

In that last assessment the reasonable expectation of the data subject plays a major role. In its recommendation 01/2025 on direct marketing, the GBA points out that prospects usually have no relationship with your company yet and so in principle do not expect a marketing message. That is different if the prospect has already contacted you. The stronger the link between your offer and the person's role, the better your assessment holds up. Record that assessment in writing.

Anyone relying on legitimate interest must, according to the GBA, inform the data subject of their right to object from the very first contact. Objecting must be easy. As soon as someone objects, you stop the processing.

Business email: impersonal addresses

For advertising by email, Belgium applies a stricter rule than the GDPR alone. According to the FPS Economy, advertising by electronic mail in principle requires prior consent. There are two exceptions. The first applies to messages to your own customers about similar products or services. The second applies to messages to legal persons.

The exception for legal persons also applies if the company is not yet a customer. The distinction lies in the address. General addresses such as info@, contact@ or sales@ are addresses of the legal person. You may send advertising to them without prior consent. Personal addresses of employees, such as firstname.lastname@company.be, are regarded by the FPS Economy as addresses of natural persons, even if they are used only for work. For advertising to those addresses you need prior consent.

In recommendation 01/2025 the GBA adds a warning: even a functional address can be personal data if in practice it is managed by one person. At a small business where info@ is read only by the owner, caution is therefore advisable.

A first email asking for consent is allowed, under conditions. According to the FPS Economy, such a message may not itself contain advertising, the subject must be clear and you may not send a new request for consent to someone who does not reply within a reasonable period of 2 years.

Every advertising email must also be recognisable as advertising, clearly identify the sender and offer a simple way to unsubscribe.

Telephone prospecting and the Do Not Call Me list

For telephone prospecting you do not in principle need prior consent. You do have to check your call list against the Do Not Call Me list (Bel-me-niet-meer-lijst). According to the FPS Economy, companies may no longer call a number on that list to offer their products and services.

That list applies to B2B as well. According to DNCM, the non-profit that manages the list, every Belgian telephone subscriber can register their number, including companies. The telemarketing legislation also applies to both B2C and B2B campaigns. Existing customers on the list may only be called for a commercial offer if they have given explicit consent. A call about a delivery or a technical problem does not fall under the list.

Access to the list requires a paid licence. For an advertiser with 250 employees or fewer, DNCM charges 600 euros per year or 60 euros for a monthly licence, excl. VAT. During an inspection you must be able to show that you consult the list. According to DNCM, penalties range from a warning to fines of 80,000 euros.

Where does your prospect list come from?

The origin of your data partly determines whether your processing is lawful. If you buy a file, ask how the data was collected and whether the data subjects were informed. If you compile a list yourself from public sources, such as a company's website, you must inform the data subject at the first contact about who you are, where you found their data and how they can object.

Keep your list limited to what you need: name, position, company and a business contact detail. Do not keep data on prospects who do not respond indefinitely. Remove anyone who objects from all lists immediately.

What you can do now

• Split your prospect list into general company addresses and personal addresses. For the latter, use only a consent request or a phone call.
• Check your call list against the Do Not Call Me list before you start a round of calls.
• Write down your legitimate interest assessment on a single sheet and keep it with your prospecting file.

From Ghent we set up prospecting processes for SMEs across Flanders that stay within these rules. On our page about lead generation you can read how we do that, while hetgeobureau.be makes sure companies find you themselves in the answers of ChatGPT and Google.