The Ultimate Data Privacy Playbook for Revenue Teams

Privacy law, explained like you’re five

Think of every prospect as a house. Every country has its own rules for knocking on the door. Some say “knock, but leave if they ask you to.” Some say “only knock if you were invited.” One says “don’t buy a map of who lives here at all.”

You don’t need to memorize 21 rulebooks. Before you reach out, know three things: which rule applies, which channel is open, and whether you can prove it. This playbook gives you all three for every country, and shows how LeadGenius makes the proof automatic.

Before every outreach, ask:

1. Where does this person work? The country’s law follows them, not you.
2. Which consent model applies?
3. Which channel? Email is usually stricter than phone.
4. Did I scrub the do-not-call list?
5. Can I prove it if a regulator asks?

Every country fits one of four buckets

Opt-out

Tell people their data was collected and give them an easy way to say no. If they don’t object, you can proceed.

Like: “We’ll call. Tell us if you’d rather we didn’t.”

Partial opt-in

Some channels, usually email, need a real yes. A relevant B2B call can work with notice and a documented reason.

Like: “Ring the bell, but don’t walk in uninvited.”

Explicit opt-in

A clear, affirmative yes is required before data is shared or used — and someone must be able to prove it.

Like: “Only knock with an invitation — and keep it.”

Restricted

Buying or selling personal data is prohibited. Build first-party opt-ins so people raise their hand for your brand.

Like: “Don’t buy a map. Put up a sign.”

Find your market in seconds

Find your country below, then go to its full playbook.

Country-specific procedures and protocols

Each playbook answers what privacy teams actually ask: not just whether a vendor can comply, but how.

Latin America

Argentina

Opt-out · Standard risk

In Argentina you can reach out as long as people were told their details were collected and were given an easy way to say no. Before you call, check the “No Llame” list.

• Email: Yes — notified contacts, honor opt-outs
• Phone: Yes — after No Llame scrub

Laws: Personal Data Protection Law 25.326 and Regulatory Decree 1558/2001; AAIP (Agency for Access to Public Information); Consumer Protection Act; Fair Trade Act

Do-Not-Contact: National “No Llame” (Do Not Call) Registry

How LeadGenius delivers it:

• Opt-out notice delivered at collection and logged against each record.
• Every phone number scrubbed against the No Llame registry before delivery.
• Opt-out subset flagged in your delivery file so suppressed people never reach a sequence.

Brazil

Explicit opt-in · High risk

Brazil wants a clear “yes” before anyone passes a person’s details along — and proof that the yes really happened. No yes, no hand-off.

• Email: Opted-in contacts only
• Phone: Opted-in contacts only

Jan 2026: The EU and Brazil adopted mutual adequacy decisions, so personal data can now move between the EEA and Brazil without extra transfer clauses. The ANPD’s 2026–2027 priority map signals more active sanctioning; fines reach 2% of Brazil revenue, capped at R$50M per infraction.

Laws: LGPD — Lei Geral de Proteção de Dados (Law 13.709/2018); Enforced by the ANPD

Do-Not-Contact: Your internal suppression lists, plus any registry you ask us to apply

How LeadGenius delivers it:

• We run a Portuguese-language Permission Pass: every sourced contact gets a clear opt-in / opt-out email, with a 5-day response window.
• Each response is timestamped and kept as consent evidence you can pull for an audit or a data-subject request.
• We deliver the full sourced set with the explicit opt-in subset flagged, so reps know exactly who is cleared for outreach.

Chile

Opt-out · Elevated risk

Today Chile works like Argentina: tell people, let them say no, and check the do-not-call list. But on 1 December 2026 a much stricter, GDPR-style law switches on — so plan for tighter rules now.

• Email: Yes — notified contacts, honor opt-outs
• Phone: Yes — after No Molestar scrub

1 Dec 2026: Law 21.719 takes full effect — extraterritorial reach, new data subject rights including portability, a new Data Protection Agency, and revenue-based sanctions (roughly 2–4% of revenue for serious cases).

Laws: Law 19.628 on the Protection of Private Life (in force until 30 Nov 2026); Law 21.719 — new Personal Data Protection Law (in force 1 Dec 2026)

Do-Not-Contact: SERNAC “No Molestar” registry

How LeadGenius delivers it:

• Opt-out notice at collection, logged per record.
• Phone numbers scrubbed against “No Molestar” before delivery.
• Opt-out subset flagged in every delivery.

Colombia

Explicit opt-in · High risk

Like Brazil: before a person’s details can be shared with you, they need to have said yes — and someone needs to be able to prove it.

• Email: Opted-in contacts only
• Phone: Opted-in contacts only

Laws: Statutory Law 1581 of 2012 and Decree 1377 of 2013; Enforced by the SIC (Superintendence of Industry and Commerce)

Do-Not-Contact: Your internal suppression lists, plus any registry you ask us to apply

How LeadGenius delivers it:

• Spanish-language Permission Pass with explicit opt-in and opt-out options and a 5-day response window.
• Consent evidence stored per record and retrievable on request.
• Full sourced set delivered with the explicit opt-in subset flagged.

Peru

Opt-out · Elevated risk

Peru lets you knock on the door once to ask if it’s okay to talk. If they don’t say yes, you don’t knock again. And if a vendor gets it wrong, the law assumes you — the company benefiting — are responsible.

• Email: First touch only, as a consent ask
• Phone: First touch only, after registry scrub

Mar 2025: Peru’s new regulation confirms a single first contact to obtain consent is allowed — but if consent isn’t given, further contact is unlawful. Liability for commercial prospecting is presumed to sit with the beneficiary. Qualifying incidents must be reported to the authority within 48 hours.

Laws: Personal Data Protection Law 29733; New Regulation — Supreme Decree 016-2024-JUS (in force 30 March 2025)

Do-Not-Contact: “Gracias… No Insista” registry (INDECOPI)

How LeadGenius delivers it:

• Opt-out notice delivered at collection and logged per record.
• Phone numbers scrubbed against the national Do Not Call registry before delivery.
• We help you design the first-touch consent ask so your opening email or call doubles as the permission request the new regulation expects.

Europe (EMEA)

Austria

Explicit opt-in · High risk

Austria wants the person’s yes before their data is processed and sold — and anyone on the Robinson List is off-limits.

• Email: Consented contacts only
• Phone: Consented contacts only

Laws: GDPR + Austrian Data Protection Act (DSG); Telecommunications Act 2021 (TKG) §174 — electronic marketing; Trade Regulation Act (GewO) §151 — address publishers and direct-marketing companies

Do-Not-Contact: Robinson List (maintained under GewO §151)

How LeadGenius delivers it:

• German-language Permission Pass with explicit opt-in, logged per record.
• Robinson List scrubbing built into our standard Do-Not-Contact process for Austria.
• GewO §151 obligations addressed in our sourcing process and documented for your review.

Germany

Partial opt-in · High risk

Germany has two gatekeepers. GDPR decides whether you may hold someone’s data. The UWG decides whether you may contact them. For business calls, a good, documented reason they’d care is enough. For email, you need a real “yes” first.

• Email: Express consent only
• Phone: B2B with documented presumed consent

Watch: Automated or AI-voiced calls need prior express consent even in B2B. Unlawful advertising calls can draw fines of up to €300,000, and competitors can sue directly under the UWG.

Laws: GDPR + Federal Data Protection Act (BDSG); Act Against Unfair Competition (UWG) — §7 governs email and phone advertising

Do-Not-Contact: Your internal suppression lists, plus any registry you ask us to apply

Your options:

• Option 1: Buy only vendor-consented data; give the GDPR Art. 14 notice on your first call.
• Option 2: Buy data the vendor has Art. 14-notified; call and give your own notice.
• Option 3: As Option 2, and ask on the first call to email. Documented yes opens email.
• Option 4 (higher risk): Notified data, then a first email with the Art. 14 notice asking for consent.

How LeadGenius delivers it:

• We support Options 1–4; only consent captured by a LeadGenius-placed phone call is outside scope.
• Explicit opt-in subset flagged so reps can see who is cleared for email.
• Art. 14 notification and consent records kept per contact and available on request.

Ireland

Partial opt-in · Elevated risk

Ireland asks for consent to share with a vendor’s customers — it doesn’t have to name you — and you skip anyone who opted out on the National Directory Database.

• Email: Consented contacts
• Phone: Yes — after NDD scrub

Laws: GDPR + Data Protection Act 2018; ePrivacy Regulations 2011 (S.I. 336/2011)

Do-Not-Contact: National Directory Database (NDD) marketing opt-out

How LeadGenius delivers it:

• Consent captured and logged per record.
• NDD scrubbing built into the standard Irish Do-Not-Contact process.
• Explicit opt-in subset flagged; optional content syndication.

Spain

Explicit opt-in · High risk

Spain says no marketing email unless the person asked for it or is already your customer. And before any campaign, check the Robinson exclusion list — Spain’s regulator fines people who skip it.

• Email: Consent, or existing customer for similar products
• Phone: Yes — after Robinson scrub

Enforcement: Spain’s Supreme Court upheld a €40,000 AEPD fine against an insurer for marketing to a person on the Robinson List.

Laws: GDPR + Organic Law 3/2018 (LOPDGDD); Law 34/2002 on Information Society Services and E-Commerce (LSSI-CE), Art. 21

Do-Not-Contact: Advertising exclusion systems published by the AEPD (Lista Robinson)

How LeadGenius delivers it:

• Spanish-language Permission Pass with explicit opt-in, logged per record.
• Robinson List and AEPD-published exclusion systems applied in our standard Spanish process.
• Explicit opt-in subset flagged; content syndication to lift opt-in conversion.

Switzerland

Partial opt-in · Elevated risk

Switzerland gives you two paths: either the vendor gets permission up front, or you ask for it in your very first message. Either way, people must know who has their data and why.

• Email: Consented, or consent in first touch
• Phone: Yes, with notice and opt-out

Laws: Revised Federal Act on Data Protection (revFADP / nDSG, in force 1 Sep 2023); Federal Act against Unfair Competition of 19 Dec 1986 (UWG; SR 241)

Do-Not-Contact: Your internal suppression lists; respect the “no advertising” star (*) in phone directories

Your options:

• Option 1: Vendor collects consent to sell the data to its customers. You buy only consented data, then send your own privacy notice (who you are, where you got the data, why) with an opt-out.
• Option 2: If the vendor doesn’t collect consent, you capture consent in your first communication.

How LeadGenius delivers it:

• We support both Option 1 and Option 2 based on your preference.
• For Option 2, we help draft a first-touch message that carries the notice and the consent request in one.
• Explicit opt-in subset flagged; optional content syndication available.

United Kingdom

Partial opt-in · Elevated risk

In the UK, our playbook standard is simple: the person agreed to share their details with you by name, and anyone on the TPS or CTPS phone lists gets skipped.

• Email: Named consent (playbook standard)
• Phone: Yes — after TPS/CTPS scrub

DUAA 2025: Maximum PECR fines rose from £500,000 to £17.5M or 4% of global turnover, whichever is higher — direct-marketing mistakes now carry GDPR-level risk.

Laws: UK GDPR + Data Protection Act 2018 (regulator: ICO); PECR — Privacy and Electronic Communications Regulations 2003; Data (Use and Access) Act 2025

Do-Not-Contact: Telephone Preference Service (TPS) and Corporate TPS (CTPS)

How LeadGenius delivers it:

• Consent language names your company, captured and logged per record.
• TPS and CTPS scrubbing applied as standard for UK phone numbers.
• Explicit opt-in subset flagged; optional content syndication.

Asia-Pacific (APJ)

Australia

Partial opt-in · Elevated risk

Australia wants the person’s okay, a simple way to stop hearing from you, and no calls to numbers on the Do Not Call Register. Subject to change.

• Email: Consent + working unsubscribe (Spam Act)
• Phone: Yes — after DNCR wash

10 Jun 2025: A new statutory tort for serious invasions of privacy commenced. 10 Dec 2026: Privacy policies must disclose automated decision-making that uses personal information.

Laws: Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024; Spam Act 2003 — email and SMS; Do Not Call Register Act 2006 — telephone

Do-Not-Contact: Do Not Call Register (DNCR)

How LeadGenius delivers it:

• Consent and opt-out notification captured and logged per record.
• DNCR washing applied to Australian numbers as standard.
• Explicit opt-in subset flagged; optional content syndication.

India

Partial opt-in · Elevated risk

India is switching on a brand-new privacy law in stages. If the data came from places the person made public themselves, a notice with a way to opt out works. If not, the person needs to have said yes. Subject to change.

• Email: Yes — opt-out notice in first email
• Phone: Yes — with opt-out

Timeline: Consent-manager registration opens 14 Nov 2026. The core notice, consent and breach obligations apply from May 2027. Consent must be free, specific, informed and as easy to withdraw as to give.

Laws: Digital Personal Data Protection Act 2023 (DPDP Act); DPDP Rules 2025 (notified 13 Nov 2025, phased to May 2027)

Do-Not-Contact: Your internal suppression lists; TRAI commercial-communication preferences for telecom

Your options:

• If the vendor uses publicly available data and can reveal the public sources: it can sell with an opt-out notice, and you send an opt-out notice in your first email.
• If the vendor can’t reveal the public sources: contractually require that you only buy consented data, and reconfirm with an opt-out option in your first email.

How LeadGenius delivers it:

• Source URLs recorded for every public-source data point, so the public-availability path is provable.
• Where sources can’t be shown, we deliver only consented contacts.
• Explicit opt-in subset flagged; optional content syndication.

Indonesia

Opt-out · Elevated risk

Indonesia wants people told the whole story — why their data is used, what kind, for how long, and their rights — plus an easy way to opt out. Subject to change.

• Email: Yes — after full notice, honor opt-outs
• Phone: Yes — after full notice

Watch: The PDP Law has been fully enforceable since Oct 2024, but the dedicated PDP Agency was still being set up as of 2026. Expect enforcement to rise once it’s operational.

Laws: Personal Data Protection Law No. 27 of 2022 (PDP Law), fully effective 17 Oct 2024

Do-Not-Contact: Your internal suppression lists

How LeadGenius delivers it:

• Full-disclosure notification template covering every PDP Law element, sent and logged per record.
• One-click opt-out honored before delivery.
• Opt-out subset flagged. Recent Permission Pass campaigns in Indonesia have reached about a 5% explicit opt-in rate.

Malaysia

Explicit opt-in · High risk

Malaysia needs the person’s yes to sell their data, plus a written notice in both English and Bahasa Malaysia.

• Email: Consented contacts only
• Phone: Consented contacts only

2025: Amendments phased in — data processors directly bound by the security principle (Apr 2025); mandatory DPO appointment and breach notification (Jun 2025); higher maximum penalties.

Laws: Personal Data Protection Act 2010 (PDPA), as amended by the PDP (Amendment) Act 2024

Do-Not-Contact: Your internal suppression lists

How LeadGenius delivers it:

• Bilingual (English + Bahasa Malaysia) Section 7 notice and consent request, approved by you before launch.
• Consent and notice evidence logged per record.
• Explicit opt-in subset flagged; content syndication to lift opt-in conversion.

New Zealand

Partial opt-in · Elevated risk

New Zealand now says: if you got someone’s details from somebody else, you have to tell them — what you have, why, and who it goes to. Subject to change.

• Email: Consent + working unsubscribe (UEMA)
• Phone: Yes — honor name-removal lists

1 May 2026: New IPP3A requires notifying people when their information is collected indirectly (from a third party). Generic privacy-policy wording isn’t enough on its own.

Laws: Privacy Act 2020, as amended by the Privacy Amendment Act 2025; Unsolicited Electronic Messages Act 2007 — email and SMS

Do-Not-Contact: Marketing Association Do Not Call / Name Removal services (industry-run)

How LeadGenius delivers it:

• Consent and opt-out notification captured and logged per record.
• IPP3A-ready notification content prepared with you, so the indirect-collection notice is covered contractually.
• Explicit opt-in subset flagged; optional content syndication.

Philippines

Opt-out · Standard risk

Tell people their details were collected, give them an easy way to say no, and leave out numbers that asked not to be called.

• Email: Yes — honor opt-outs
• Phone: Yes — after suppression scrub

Laws: Data Privacy Act of 2012 (Republic Act 10173); Enforced by the National Privacy Commission (NPC)

Do-Not-Contact: Opt-out suppression lists and any applicable Do Not Call list

How LeadGenius delivers it:

• Opt-out notice delivered at collection and logged per record.
• Do-Not-Call suppression applied per your instructions.
• Opt-out subset flagged in every delivery.

Singapore

Opt-out · Standard risk

Singapore treats work contact details differently from personal ones. Keep proof the data was public when collected, give an opt-out, and check the DNC Register before calling.

• Email: Yes — business contact info, with unsubscribe
• Phone: Yes — after DNC Register check

Laws: Personal Data Protection Act 2012 (PDPA); Spam Control Act 2007

Do-Not-Contact: Do Not Call (DNC) Register

How LeadGenius delivers it:

• Source URL and collection timestamp stored for every data point.
• DNC Register checks applied to Singapore numbers.
• Opt-out notification sent and logged; opt-out subset flagged.

South Korea

Explicit opt-in · Very high risk

Buying and selling personal data is a very sensitive topic in Korea. The safest move is to not buy lists — and if you do, every person must have clearly agreed first.

• Email: Express consent only
• Phone: Express consent only

11 Sep 2026: PIPA amendments took effect — penalties can reach up to 10% of total revenue for repeated, intentional or large-scale violations, and the CEO is designated as ultimately responsible for data protection.

Laws: Personal Information Protection Act (PIPA), amended 2026; Act on Promotion of Information and Communications Network Utilization (Network Act)

Do-Not-Contact: Your internal suppression lists

How LeadGenius delivers it:

• If you choose not to source in South Korea, we won’t.
• If you do ask us to source, we follow the full explicit opt-in standard and deliver only the consented subset for outreach.
• Contact Activation offers a first-party route: people opt in to your content directly.

Thailand

Explicit opt-in · High risk

Thailand wants a clear yes before a person’s details are sold — and evidence of that yes you can show the regulator.

• Email: Consented contacts only
• Phone: Consented contacts only

Aug 2025: The PDPC announced eight new administrative fines across five cases, taking cumulative PDPA fines past THB 21 million — and processors were fined alongside controllers.

Laws: Personal Data Protection Act B.E. 2562 (2019), fully enforced since 1 Jun 2022; Enforced by the Personal Data Protection Committee (PDPC)

Do-Not-Contact: Your internal suppression lists

How LeadGenius delivers it:

• Thai-language Permission Pass with explicit opt-in, logged per record.
• Consent evidence retrievable on demand.
• Explicit opt-in subset flagged; content syndication to lift opt-in conversion.

Vietnam

Restricted · Restricted risk

Since January 2026, Vietnam’s law says personal data can’t be bought or sold. So don’t buy contact lists — get people to raise their hand for you instead.

• Email: First-party opt-ins only
• Phone: First-party opt-ins only

1 Jan 2026: The PDPL bans the purchase and sale of personal data. Unlawful trading draws fines of at least VND 3 billion, up to 10× the illegal revenue.

Laws: Law on Personal Data Protection No. 91/2025/QH15 (PDPL), effective 1 Jan 2026; Decree 356/2025/ND-CP (implementing decree), effective 1 Jan 2026; Replaces Decree 13/2023/ND-CP (PDPD)

Do-Not-Contact: Your internal suppression lists

How LeadGenius delivers it:

• We recommend no list sourcing for Vietnam and won’t source unless your legal team approves a lawful basis.
• Contact Activation is the recommended route: people engage with your content and opt in to your brand directly — first-party consent, not a data sale.
• Hygiene and signals on your own first-party records remain available.

Opt-in, consent and Permission Pass — built in

Most vendors act as data controllers and resell the same records to everyone. LeadGenius works as a data processor: we source uniquely for you, never resell, and match the consent model to each country.

Permission Pass

A clear opt-in / opt-out email in the contact’s language before they reach your reps, with every reply logged as evidence.

Explicit opt-in subset

Every delivery flags exactly who gave an affirmative yes, so reps know who is cleared for email.

Opt-out notification

Required transparency notices sent at collection, opt-outs honored before delivery, proof kept for every notice.

Contact Activation

Content syndication through our global publisher network turns engagement into first-party, opted-in contacts.

Do-Not-Contact scrubbing

TPS/CTPS, Robinson Lists, NDD, DNCR, No Llame and your own suppression lists, applied by country.

Audit trail and indemnification

URL-level sourcing, consent records per contact, a configurable compliance matrix, and indemnification.

How a Permission Pass works

1. Define accounts. You choose target accounts and personas.
2. Curate contacts. We source fresh contacts uniquely for you.
3. Send the pass. Opt-in / opt-out email with a 5-day window.
4. Sort responses. Opt-outs removed, opt-ins flagged, non-responders tagged.
5. Deliver with proof. Consented contacts and records land in your CRM.

Observed explicit opt-in rates run about 3% in Brazil and 5% in an Indonesia campaign — which is why we pair Permission Pass with Contact Activation to grow the consented pool.

Not just “can you comply?” — here’s how

Malaysia

Austria

Questions AEs, SDRs and counsel ask most

What is a Permission Pass?

A short email sent to sourced contacts before they reach your reps, with opt-in and opt-out buttons. After a 5-day window we deliver opted-in contacts, suppress opt-outs, and flag non-responders for your legal policy.

Can we buy contact lists for Vietnam or South Korea?

We recommend against it. Vietnam has banned buying and selling personal data since January 2026, and South Korea’s amended PIPA allows penalties up to 10% of total revenue. Use Contact Activation so people opt in to your brand directly.

Turn privacy law into pipeline

Compliant, on-demand contact data with the consent model each country requires. Connect with a Strategist or explore Contact Activation.

Sources

• LeadGenius — Executing Permission Pass Data
• LeadGenius — Privacy & Compliance
• White & Case — EU–Brazil adequacy
• Baker McKenzie — Peru regulations
• FPF — Chile Law 21.719
• Famulor — Germany UWG §7
• Carson McDowell — UK DUAA 2025
• LetsLaw — Spain Robinson List fines
• AZB & Partners — India DPDP rollout
• MinterEllison — Australia privacy reforms
• NZ Privacy Commissioner — IPP3A
• IAPP — South Korea PIPA 2026
• Tilleke & Gibbins — Vietnam PDPL
• DLA Piper — Indonesia
• Tilleke & Gibbins — Thailand PDPC fines

This playbook is general guidance for revenue teams, not legal advice. Privacy laws change often and apply differently to each organization; confirm your program with your own counsel. Last reviewed October 16, 2026.