Answers to the questions that arise most often, with the article cited alongside wherever the answer follows from a rule.
Questions and answers
Does the law distinguish between calling and emailing?
No. Article 13 of Directive 2002/58/EC sets a single regime for unsolicited communications for direct marketing purposes, and the national transpositions follow it. What varies between Member States is not the channel but the choice the Directive expressly left to national law in article 13(3): whether communications not covered by paragraphs 1 and 2 require consent or merely the absence of objection. In Portugal, the criterion is the recipient: prior express consent for natural persons, opt-out for legal persons, whatever the channel.
Article 13 of Directive 2002/58/EC
We serve Spanish customers from Portugal. Does Spanish law apply to us?
Very likely. Ley 10/2025 of 26 December applies to undertakings established in Spain or in another State, provided they operate in Spanish territory. It covers providers of services of general interest and all large undertakings — 250 or more employees, turnover above €50 million or a balance sheet above €43 million. It has been fully enforceable since 28 December 2026 and its waiting-time and human-attention requirements are markedly more demanding than the Portuguese ones.
Ley 10/2025 (Spain)
Our customer service is outsourced. Who is responsible?
The undertaking that offers the service to the consumer. Outsourcing distributes execution, not liability to the consumer, without prejudice to any allocation of liability agreed between the parties. Where personal data is processed, the outsourcing provider is generally a processor and a contract under article 28 of the General Data Protection Regulation is required.
Article 28 of Regulation (EU) 2016/679
How many regimes apply to a contact centre?
Six, and they do not cross-refer. The national customer service regime, where one exists; the rules on the cost of consumer contact lines; consumer law as it applies to service and to distance contracting; data protection, as regards recording, logging and unsolicited communications; accessibility of support services; and transparency of automated interaction systems. Each layer has its own instrument, its own timetable and its own authority, and none of them refers to the others.
Your question is not here
Put it directly. Recurring questions are added to this page.