Free resource

The GDPR-Compliant Outbound Checklist for Portuguese B2B SaaS

Most GDPR guides for cold outreach are written for the EU average. Portugal isn't average. Here's what actually holds up under CNPD's enforcement posture.

The finding most guides miss

Portugal's CNPD has explicitly ruled that legitimate interest (GDPR Art. 6(1)(f)) is not a valid basis for using contact details for direct marketing, and has fined an organization €107,000 for unsolicited direct marketing. Build your outreach for this reading, not the lenient one.

Before you send anything

Document a necessity-and-proportionality assessment per campaign type: why this contact, why email, why now.
Confirm every contact is a business address tied to a professional role, never a personal or consumer address.
Write down where the data came from (public profile, business database) so you can answer honestly if asked.

Every email, every time

Real sender name and company identity. No disguised "from" fields.
A working one-click or reply-based opt-out. "Reply no and you will never hear from us again" satisfies the rule and converts better than a footer link.
A valid physical mailing address in the footer.
Process opt-outs within 48 hours and suppress permanently, across every campaign you run.

LinkedIn outreach

Human-paced, human-approved messages on real accounts. Automation-at-scale is a platform-restriction risk, not just a compliance one.
Scraped profile data for personalization only, never republished or resold.
Only business-role-relevant messages. Never contact personal, non-business profiles.

If a prospect asks "how did you get my information?"

Have a straight, true answer ready: public profile or business database, stated plainly.
Honor deletion or objection requests within 48 hours, and log that you did.

Want this built into your outbound from day one?

This is exactly how we run every campaign at Farol Partners. If you'd rather not build and police this yourself, let's talk.

Book a pilot call