The sequence
First — natural or legal person?
Several Member States, Portugal among them, draw the primary distinction here rather than by channel. Where they do, mixing natural and legal persons in one list means applying one regime to two situations.
Second — consent, objection, or another lawful basis?
Determined by the national regime of the market served, not by the place of establishment. Where the model is objection, the operation must consult the relevant national register; where it is consent, the register is irrelevant and the proof of consent is everything.
Third — does the existing-customer exception hold?
The four conditions of article 13(2) are cumulative: details obtained from the customers themselves, in the context of a sale, for the provider’s own and similar products, with free and easy refusal at collection and in every message. Group membership does not extend the exception, because the products must be the provider’s own and each company is a distinct legal person.
Fourth — has anyone objected?
Article 21(2) of Regulation (EU) 2016/679 gives an unconditional right to object to direct marketing, and article 21(3) requires processing for that purpose to stop. This applies in every Member State, whatever the national model, and takes effect across every channel — not only the one on which the objection was made.
National registers, where they exist
Where a Member State operates the objection model, it typically maintains a register, and the duty attached to it varies more than the register itself. Italy requires operators to register with the system, to submit their calling lists in advance, and to consult monthly and in any event before each campaign. Portugal maintains a national register of legal persons, which the Directorate-General for Consumer Affairs updates monthly and which promoters are required to consult.
Assuming that a register covers consumers and assuming that consulting it once a year suffices are the two most common errors — and both are errors of not reading the national rule attached to the register.
Article 13(1) requires prior consent for automated calling systems without human intervention in every Member State, without national choice. An outbound campaign run by a voicebot therefore requires consent even in jurisdictions that apply the objection model to human-operated calls — and, since 2 August 2026, must also disclose that the interlocutor is interacting with an AI system.
Apply this to your operation
A general framework is no substitute for a concrete assessment. The diagnostic determines what applies to your operation.