Is buying company data in Luxembourg legal under GDPR?
B2B contact data is regulated in Luxembourg like anywhere else in the EU. Buying it is not forbidden, but you take on obligations the moment you use it. This is a practical summary, not legal advice.
Company data and personal data are not the same thing
A general company address such as info@ is not personal data. A named person's work address is. Most B2B datasets contain both, so treat the file as containing personal data and handle it accordingly.
You need a lawful basis
For B2B outreach, legitimate interest is the basis most senders rely on: you can show why the recipient would reasonably expect a relevant business message from you. Write that reasoning down before your first send.
Marketing to businesses also sits under national electronic communications rules in Luxembourg, which can be stricter than the GDPR itself for unsolicited email.
What every message must do
Whatever your basis, each message needs to be honest about who is writing and easy to stop.
- Identify your company clearly
- Say where you got the contact details
- Offer a working unsubscribe or opt-out in every message
- Act on objections and deletion requests without delay
Keep records
Keep the source, the date and the version of the list you used, plus your opt-out log. If somebody complains, that record is your defence.
Frequently asked questions
- Can I email companies in Luxembourg without prior consent?
- Business-to-business email is generally possible on a legitimate-interest basis when the message is relevant to the recipient's work and includes a clear opt-out, but national electronic marketing rules apply and can be stricter.
- Where does the Luxembourg data come from?
- It is compiled from official company registry and public business sources, and refreshed weekly.
- What if somebody asks to be removed?
- Remove them from your sending list immediately and keep a record of the request.
Luxembourg
Get the Luxembourg company dataset
48,206 companies, 57,403 unique email addresses, sourced from official registry data.