Benelux market-entry GTM stack guide

Netherlands email and SMS. Article 11.7 starts with prior consent for unsolicited electronic commercial messages, including business recipients. Its business-address exception requires the recipient to designate and publish electronic contact details for unsolicited communications, and use within the stated purpose. Publication of an ordinary contact address is not that test. The customer exception covers electronic details obtained during a sale for your own similar products or services, with a simple free objection at collection and in every message. Identify the sender and provide a valid termination contact.[1]

Netherlands phone. Prior consent is the starting rule for live sales calls to consumers and structures without legal personality, including sole proprietors and VOF partnerships. Article 11.7(3)(a) provides a narrow business-contact exception where the recipient specifically designates and publishes the number for unsolicited communications within its stated purpose. An ordinary website number or Chamber of Commerce listing does not meet that test. Government guidance permits calls to companies with legal personality. The ordinary consumer customer-relationship exception ended on 1 July 2026; software vendors should not use an old customer flag as permission. Caller identification, sales-purpose disclosure and objections still matter. Automated calls without human intervention are under Article 11.7's separate consent-or-exception rule, not the corporate live-call allowance.[2][3][1][4]

Belgium email. Prior consent is the rule for advertising to a natural person, including an employee's named work address and a sole trader. The legal-person exception is for genuinely impersonal electronic addresses, not every address on a company domain. The offer must target the legal person. A functional address can still identify a person, so a label such as sales@ is not conclusive. Existing-customer email requires direct collection during a sale, your own analogous products or services, and free simple objections at collection and in subsequent messages.[5][6]

Belgium phone. The APD distinguishes human live calls, generally possible absent objection, from SMS and automated calls subject to the electronic-marketing regime. FPS Economy requires screening the Do Not Call Me list and your internal objections before each marketing campaign. Protection extends to every Belgian telephone subscriber, including businesses and associations. A later specific consent can override an earlier national-list objection under the guidance, but its chronology and any subsequent withdrawal must be provable. A clean list result is not proof of a GDPR lawful basis.[7][6][10]

Luxembourg email and phone. Article 11 requires prior consent for electronic mail, automated calls and other unsolicited direct-marketing communications, including human calls, with paragraphs 1 and 3 scoped by paragraph 5 to natural-person subscribers. Sole traders cannot be treated as legal persons. The email customer exception requires sale-collected details, your own analogous offerings, and a free easy objection at collection and with every message. Sender concealment and omission of a valid stop-contact address are prohibited. The natural-person limitation is not evidence that every employee address or personal mobile is a corporate channel. Our assessment is to require verified subscriber identity before considering a legal-person route.[8][10]

LinkedIn gates remain separate. In the Netherlands, the electronic-message rule is broader than email, so our assessment is to apply its consent-or-exception gate to promotional direct messages. In Belgium, do not transplant the impersonal legal-person inbox exception to an individual's LinkedIn profile. In Luxembourg, the natural-person subscriber rules warrant a consent-first policy for personal-profile prospecting. These are conservative implementation assessments, not country-specific platform rulings. LinkedIn separately forbids unauthorized bots for sending messages and scraping profiles. A connection acceptance is not evidence of permission for another channel.[1][6][8][9]

For all three countries, GDPR protects identifiable people, including business contacts, rather than corporate information alone. Article 6 legitimate interest requires necessity and a balancing assessment; it is not marketing consent. The Belgian APD expressly rejects choosing another GDPR basis where electronic-marketing consent is required. For indirectly sourced contacts, Article 14 normally requires notice within one month, at first communication if earlier, or at first disclosure if earlier, subject to its exceptions. Article 21 requires stopping direct-marketing processing after objection. Our assessment is to store source, notice status, recipient classification and channel evidence separately, with suppression enforced before any export.[10][6]

Classify CRM and enrichment vendor roles from the actual processing, not the product label. Article 28 requires a processor contract when a provider acts on your behalf. GDPR permits third-country transfers through applicable adequacy decisions or safeguards such as standard contractual clauses; these provisions do not establish a blanket Benelux-only hosting requirement. EU exporters retain responsibility for onward transfers and non-EEA remote access. For Article 46 tools, assess relevant destination laws and practices, document supplementary measures where needed, and suspend transfers that cannot meet the required protection. An EU hosting selection alone does not settle the access question.[10][11]

Apollo documents person-location and company-headquarters filters as different choices. A contact in the Netherlands can therefore match a search without representing a Dutch buying entity. Its email documentation distinguishes verified, unverified, unavailable and catch-all addresses. These are vendor statuses, not consent or audited regional recall. The checked documentation does not establish separate Netherlands, Belgium or Luxembourg fill rates. Our assessment is to sample named accounts in each country and record current role, contracting entity, location, email status and subscriber classification before buying a larger export.[12][13]

Clay documents a Work Email waterfall that tries providers in sequence and stops at an accepted result. Validation settings change that acceptance; with validation success disabled, inconclusive results may pass. Its documented inference step constructs an address from a name and domain. Neither this workflow nor the checked Apollo pages establishes Benelux-specific accuracy. Our assessment is to preserve provider provenance and guessed-versus-found status, measure incremental usable records country by country, and never convert an inferred employee address into a Belgian impersonal-inbox exception.[14][5]

Our assessment is to launch Dutch-language discovery and implementation material for the Netherlands, with English available by buyer preference. In Belgium, create Dutch and French handoff queues, confirm language with each buying group, and arrange German support where the target account needs it. Do not infer personal preference from an email domain. Each opportunity should name the demo language, procurement language, support owner and language of the security questionnaire before an SDR passes it to sales. Require the AE to obtain a named CS owner's acceptance of support language, staffed hours and onboarding milestones before signature. This is a rollout recommendation, not a claim that every enterprise rejects English.

Luxembourg's government describes French as the principal workplace language and English as especially relevant in international and financial sectors. Our assessment is to prepare French and English procurement and security packs, then confirm the buyer's actual preference rather than route Luxembourg into either the Dutch or Belgian French queue automatically. Keep one approved product claim set across translations. Evaluate qualified opportunities by country and handoff language, not only pooled meeting volume.[15]

Belgium's structured e-invoicing mandate took effect on 1 January 2026 for in-scope domestic transactions between Belgian VAT-liable enterprises. An emailed PDF is not the required structured invoice. The official scope page describes Peppol BIS over Peppol, with an agreed EN16931-compliant alternative possible. Exceptions include exclusively Article 44-exempt businesses and Article 44-exempt transactions. Non-established taxable persons without a Belgian fixed establishment are excluded even when Belgian VAT-identified. A foreign SaaS exporter must classify its establishment and transaction, not assume every Belgian customer creates the domestic mandate. Public procurement has a separate regime.[16]

Netherlands requires e-invoices for supplies to central government. Local and regional public bodies may require them through procurement terms, and covered public bodies must receive and process them. Luxembourg requires compliant invoices and credit notes for public procurement and concession contracts, with specified exclusions, across all economic operators since 18 March 2023. Peppol and MyGuichet are the authorized submission routes; email is not. From 1 October 2026, Luxembourg no longer accepts XRechnung versions older than 3.0. These public-sector scopes are not a general private B2B mandate or a domestic-supplier exemption for foreign SaaS vendors.[17][18]

Our assessment is to keep payment collection separate from invoice compliance. Before closing, Finance should record the seller's establishment, buyer VAT status, public-contract status, purchase-order reference, accepted structured format and delivery endpoint. Choose a Peppol-capable accounting connection when that transaction requires it. Do not describe card collection, a CRM-generated PDF or a successful payment as evidence that a Belgian domestic or Luxembourg public invoice was legally delivered.[16][17][18]