Collections rules in Spain, Brazil and Italy: the small lender's map
Collections law in Spain, Brazil and Italy shares one spine: speak only to the person who owes, never expose the debt to anyone else, contact at reasonable hours through legitimate channels, and keep records that prove it. Around that spine each market adds its own rules, so the safe design is one disciplined process with per-market settings, not three improvisations.
Murphy, Editorial team7 October 20267 min read
What does Spain add?
Spain frames abusive collection through the customer's constitutional rights to honour and privacy, and its data-protection regime. In practice: no tactics designed to shame, no revealing the debt to neighbours, family or employers, and careful handling of personal data at every step, because a collection process is also a data-processing operation under the GDPR and Spain's LOPDGDD. On the business side, Spain transposes the EU late-payment rules, statutory interest and recovery costs on commercial invoices, which gives a small creditor more weight in the conversation than most of them use.
Spanish courts have treated harassing or exposing collection conduct as an independent wrong. The debt being real does not license the method.
The rules differ by market; the discipline that satisfies them does not.
What does Brazil add?
The Consumer Defence Code says it directly: a customer in arrears may not be exposed to ridicule, embarrassment or threat when collected. Collection that misleads, that fakes official documents, or that charges amounts not owed also triggers the code's remedies, including the customer's right to recover improper charges. Registering a customer in credit bureaus follows its own notice rules, and the customer keeps full dispute rights throughout.
Brazilian practice also runs heavily on written channels, which suits the rules well: a message is private, timestamped and reviewable, three things a shouted doorstep visit never is.
What does Italy add?
Italy's privacy authority, the Garante, shaped collection conduct early and concretely: no communications that reveal a debt to anyone but the customer, which killed the telltale envelope, the notice on the door and the message left with whoever answered; no pre-recorded collection calls made without an operator; nothing that harms the customer's dignity; and data handling that stays inside what collection needs. How that rule on pre-recorded calls applies to an AI voice agent is a question for Italian counsel before go-live. Consumer-protection rules add the general ban on aggressive commercial practices. The practical Italian rule of thumb: collect as if the Garante will read the file, because in a complaint it will.
| Setting | Spain | Brazil | Italy |
|---|---|---|---|
| The non-negotiable | Honour and privacy: no shaming, no exposure | No ridicule, embarrassment or threat, by statute | No third-party disclosure, per the Garante |
| Watch especially | GDPR and LOPDGDD duties in every step | Credit-bureau notice rules and improper charges | Visible envelopes, door notices and pre-recorded calls |
| In your favour | EU late-payment interest and costs on B2B invoices | Clear contract terms within legal interest limits | EU late-payment rules, transposed nationally |
How does a small book stay compliant in three markets?
You don't memorise three statutes. You run one disciplined process whose settings change per market: who must be confirmed before anything is discussed, which hours and frequencies apply, what each message template may say, and what gets logged. The process carries the compliance, and the settings handle the differences between countries. That is also the plain reason automation helps here: a system applies the settings on every contact, which is the consistency a regulator expects.
If any of that work runs on AI, Europe adds two duties on top. The EU AI Act's transparency rule, Article 50, requires that a person be told they are talking to an AI system unless it is already obvious, so a voice agent discloses what it is at the start of the call. And the GDPR still governs every recording and transcript: AI debt collection is personal-data processing about people in financial difficulty, which is why a data protection impact assessment, the DPIA under Article 35, is the expected first step before a voice AI goes live in collections. Brazil's LGPD asks the same questions in its own words.
None of this replaces counsel. It tells you what to ask counsel to confirm, which is a far cheaper conversation than the one after a complaint.
Common questions
Can I tell a customer's family member about the debt?
No, in all three markets. The debt is discussed only with the person who owes it, so confirming who answered comes before any account detail. To a third party, say only who is calling and ask for the customer.
What hours can I contact someone about a debt?
Reasonable hours, and the definition varies by market and channel, so set it per market rather than by habit. What matters more than the clock is the pattern: contact that reads as harassment is a problem in Spain, Brazil and Italy alike.
Do these rules apply to small businesses too?
Yes. Consumer-protection and privacy rules bind the creditor regardless of size, and small books carry the extra risk of informality, the improvised call, the note never written down. The record that proves you behaved is the small lender's cheapest insurance.
Is it legal to use AI for debt collection calls in Spain?
In Spain, yes, inside the same rules that bind people: identification, privacy, hours, channel consent where required, and records, plus the EU AI Act's duty to say the caller is an AI. Brazil applies the same rules to any caller. In Italy, check with counsel first: the privacy authority bars pre-recorded collection calls with no operator.
Read next