What should an SME check before sending a commercial email campaign?

Before launching a commercial email campaign, an SME should be able to answer two questions: why it may contact each recipient and how that recipient can stop receiving messages. In Spain, the review must take into account both the rules on electronic commercial communications under the LSSI and the applicable data protection obligations. The fact that an email address appears online or belongs to a business contact does not, by itself, mean it can be used to send advertising.

Checklist before sending

1. Check where each contact came from

• Identify the source of the address: your own form, a business relationship, or another source. Do not consider an address valid just because it is publicly available or appears on a professional network.
• Review external or purchased lists with particular care. The company running the campaign must be able to justify why each contact may receive those messages; it is not enough for the provider to describe the database as “legal.”
• Check the applicable advertising opt-out systems for the channel and campaign, and apply the relevant exclusions. Being registered on a list does not amount to consent to receive advertising.

2. Confirm what permits you to send the message

To send advertising by email, the general rule is that you must have prior consent or an express request from the recipient. The existing-customer exception is limited: there must be a previous contractual relationship, the contact details must have been lawfully obtained in that context, and the promotion must concern similar products or services of your own to those previously purchased.

• If you rely on consent, verify that the person accepted through an affirmative action and was clearly informed that their address would be used for commercial purposes. Silence or a pre-ticked box does not demonstrate acceptance.
• If you rely on the existing-customer exception, check that all its conditions are met. Do not automatically extend it to prospective contacts, former business contacts without a substantiated contractual relationship, or third-party offers.
• If the recipient is a professional or a business, also assess the channel and the type of address. The fact that an address is corporate does not, by itself, remove the LSSI rules; if it identifies a natural person, it may also be personal data.

3. Review the message content and sender identity

• Clearly identify the company sending the email or on whose behalf the communication is made.
• Make the commercial nature of the message recognizable; avoid subject lines or senders that present it as a personal conversation when it is advertising.
• Make information about data processing and people’s rights accessible, for example, by clearly referring to the applicable privacy information.

4. Test the opt-out before scheduling the campaign

• Include a simple and free way to object or unsubscribe in every email.
• Check that the mechanism works and that requests are applied promptly to the lists and sending tools.
• Also offer the option to object when you collect the data if you rely on the existing-customer exception. This option must be repeated in every communication.
• Make sure that unsubscribes and objections prevent further commercial messages from being sent to the contact through the relevant channel. If it is necessary to retain minimal data to prevent the person from being added to the list again, restrict its use to that purpose.

Keep useful evidence

Keep records that make it possible to explain how each address was obtained and why it was included in the campaign. Depending on the case, these may include the date and source of registration, the wording and version of the form, the affirmative consent action, or information about the contractual relationship and the similarity of the products being promoted. Also keep records of unsubscribes, objections, and the controls applied to the lists.

The documentation must make it possible to reconstruct the decision without retaining more data than necessary. An email marketing provider can help record these events, but hiring a tool or purchasing a database does not automatically transfer responsibility for justifying the sending to third parties.

Scope and limitations

This checklist provides general guidance for commercial email campaigns in Spain. The legal basis for processing data and the possibility of sending advertising are related but not identical issues: complying with one does not necessarily resolve the other. The specific application may depend, among other factors, on the type of recipient, the source of the data, the message, and the prior relationship. For third-party lists, complex B2B campaigns, or questions about the customer exception, it is advisable to seek specialist advice.