Most B2B lead databases start from the same place you can go yourself: the official company registers that every European country keeps. A register tells you that a company exists, what it is called, where it is registered, what it does (as an industry code) and whether it is still active. That makes it the most reliable first column of any prospect list (you still need a contact), and in a growing number of countries it is free.
This guide covers where to get register data in Europe, what each source really contains, how to turn a register extract into a short list worth contacting, and the opt-out flags that you are legally required to respect.
Why start from a register instead of a bought list
A bought list is a snapshot of someone else's register extract, enriched and resold. Starting from the source has three practical advantages:
- You know where every row came from. If a recipient asks "where did you get my company's details?", you can answer with the register name, which matters under GDPR Article 14 when the data includes personal data such as a director's name.
- Status is current. Registers mark companies as dissolved, in liquidation or struck off. Bought lists often lag, which is how you end up emailing companies that no longer exist.
- Industry codes are standardised. Almost every EU register classifies companies with NACE Rev. 2 or a national version of it (SNI in Sweden, NAF in France, TOL in Finland). One code list lets you search consistently across countries.
The limitation is just as clear: a register rarely gives you a person to write to or an email address. Treat the register as the account list, then find the right role at each company separately (see how to verify B2B email addresses before you send).
The EU rules that opened up company data
Two pieces of EU law matter here.
The Open Data Directive (Directive (EU) 2019/1024) created the category of "high-value datasets": public data with high economic value that member states must publish free of charge, in machine-readable formats and via APIs. "Companies and company ownership" is one of the six categories. The detailed list is in Commission Implementing Regulation (EU) 2023/138, which has applied since 9 June 2024. For companies it covers basic attributes such as name, registration number, legal form, registered address, status and the main activity.
The Business Registers Interconnection System (BRIS) links the national registers so you can search a company in any member state from the European e-Justice Portal. BRIS is a lookup tool, not a bulk download, so it is useful for checking a single company and not for building a list.
In practice implementation is uneven: some countries publish full bulk files under open licences, others require a free account, and some still charge. The table below reflects what our team found when we connected these sources in October 2026.
Where to get register data, country by country
| Country | Source | Access | What you get |
|---|---|---|---|
| Sweden | Bolagsverket and SCB high-value dataset files | Free bulk download, CC BY 4.0 | Companies, legal form, address, SNI industry code, advertising opt-out flag |
| Norway | Brønnøysund Register Centre (Enhetsregisteret) | Free API and bulk files, NLOD | Organisation number, name, address, industry code, employee band |
| Finland | PRH / YTJ open data | Free API and bulk file, CC BY 4.0 | Business ID, name, address, TOL industry code, status |
| France | INSEE Sirene (recherche-entreprises.api.gouv.fr) | Free API, Licence Ouverte | SIREN/SIRET, name, address, NAF code, headcount band |
| Estonia | e-Business Register open data | Free bulk files, CC BY 4.0 | Registry code, name, address, EMTAK code, status |
| Ireland | Companies Registration Office open data | Free bulk files, CC BY 4.0 | Company number, name, address, status, NACE |
| United Kingdom | Companies House | Free bulk product and API, OGL | Company number, name, registered office, SIC code, status |
| Denmark | CVR (Erhvervsstyrelsen) | Free, but needs credentials | CVR number, name, address, industry code, advertising protection flag |
| Germany, Austria, Netherlands, Italy | National registers | Mostly paid or no structured bulk list | Single lookups are possible; bulk lists usually are not |
Links to every source: Bolagsverket high-value datasets, Brønnøysund open data, PRH open data, Sirene API, Estonian open data, CRO open data, Companies House data products, CVR access options.
Two global sources fill gaps where no free national register exists: the GLEIF Legal Entity Identifier database (companies that have an LEI, mostly those active in financial markets) and open places data such as OpenStreetMap. Both are useful but less complete than a register.
Filter before you prospect
A full register is millions of rows. The point is to get from "every company in the country" to "the 200 companies that plausibly need what we sell". Work through the filters in this order:
- Status. Keep active companies only. Every register has a status field; drop anything dissolved, in liquidation, bankrupt or struck off.
- Legal form. Exclude sole traders (enskild firma, ENK, toiminimi, entrepreneur individuel). Their "company" data is personal data about one identifiable person, and several countries' email rules treat them as consumers. More on this in B2B cold email rules by country.
- Industry code. Pick the NACE codes that match your ideal customer. Use the four-digit class where the register has it, for example 43.21 (electrical installation) and 43.22 (plumbing, heat and air-conditioning installation), and resist the urge to add vaguely related codes.
- Size. Some registers carry an employee band (Norway, France). Where they do not, legal form is a rough proxy: a public limited company is usually larger than a private one.
- Geography. Postal code or municipality, if you sell locally or need to be in the same time zone.
- Opt-out flags. Remove companies that have asked not to receive marketing. This step is not optional; see the next section.
At the end you should have a list you could read through by hand. If you cannot, the filters are too loose.
Respect the advertising opt-out flags
Some registers let companies mark themselves as unwilling to receive direct marketing, and the flag travels with the data.
- Denmark: reklamebeskyttelse. A company can register advertising protection in CVR. According to Erhvervsstyrelsen, private entities must check the marking before using CVR data for direct marketing, may not use a protected company's basic data for that purpose, and must clearly pass the marking on if they share the data. Note that Danish law also bans unsolicited marketing email to businesses in general, so Danish register data is mainly useful for research, not cold email.
- Sweden: reklamspärr. The SCB business register file carries an advertising-block marker for companies that have opted out. When we imported the file on 29 October 2026, 4,308 companies carried it; we drop them before anything else happens.
- France: diffusion status. Sirene records can be "partially disseminated" (diffusion partielle) when the person behind the company has asked for their data to be withheld. The API redacts those fields; do not try to reconstruct them from other sources.
If you re-use a list later, re-check the flags. They change.
What a register will not give you
Be realistic about the gaps:
- No contact person. Registers list directors or board members in some countries, but a board member is rarely the right person for a sales conversation, and their name is personal data. You will still need to identify the right role (operations manager, head of marketing) from the company's website or a professional network.
- No email address. A handful of registers include an email or website field, filled in by the company itself and often out of date. Expect to find addresses yourself and to verify every address before sending.
- No buying signal. A register tells you a company exists, not that it is looking for a supplier. Combine it with signals such as recent hiring, a new location or a change of management.
- Lag. Registers update daily to monthly. A company founded last week may not be in last month's bulk file.
GDPR still applies to company data
A company's name and registration number are not personal data. A director's name, a sole trader's details or a named employee's work email are. Once you add people to the list, you need a lawful basis (usually legitimate interests for B2B outreach, documented in a legitimate interests assessment), you must tell the person where you got their data at the latest when you first contact them (GDPR Article 14(3)), and you must honour objections immediately. Keeping the register as the source column of your CRM makes the Article 14 notice easy to write: "We found your company in the Swedish companies register (Bolagsverket)."
This is general information, not legal advice. Check the rules for the countries you target with a lawyer before you start sending.
A workflow that holds up
- Pick one country and one or two NACE classes.
- Download or query the register, keep active limited companies, and drop flagged opt-outs.
- Read the list and remove anything that obviously does not fit.
- For each remaining company, find one person in the right role and one verified address.
- Check the email rules for that country before writing a word.
- Write to a small batch, read every reply, and adjust the filters.
That is roughly what Outvori automates: it searches 23 free registers and open data sources, drops sole traders and opt-out flags, stores the source with every company, and never prospects in countries where B2B cold email needs prior consent. You can try the free brand scan to see which companies in the registers match your offer.
