The GDPR (General Data Protection Regulation) is the EU's data-protection law, governing how personal data belonging to EU residents is collected and processed — including data pulled by a scraper, since GDPR applies based on whose data it is, not where the scraping happens or whether the source page was public.
A public LinkedIn profile, a public social media post, or a business-directory listing can still be personal data under GDPR if it relates to an identifiable person — publicity affects which legal basis applies, not whether the regulation applies at all. That surprises a lot of scraping projects that assume "publicly visible" means "unregulated."
Consent, GDPR's most familiar legal basis, is generally not workable for scraping at scale — you can't practically ask millions of unrelated data subjects for permission before collecting their data, and the regulation doesn't treat scraping first and asking later as valid consent.
Article 6(1)(f)'s legitimate interest is the realistic legal basis for most scraping of public personal data: identify a legitimate purpose, show the processing is necessary for it, and balance your interest against the individual's rights. Regulators expect this to be documented as a written legitimate interest assessment — the absence of one is itself treated as a compliance gap, not a neutral default.
Even under a valid legitimate-interest basis, individuals keep rights that don't disappear — most notably the right to object under Article 21, which a controller has to be able to honor. Non-compliance carries real exposure: fines can reach up to 4% of global annual turnover, which is why GDPR analysis belongs in scoping any project touching EU residents' data, not as an afterthought.
How Crawlora handles this
GDPR scope is exactly why Crawlora's acceptable-use policy draws a hard line around personal-data-heavy targets and why structured endpoints are built around public, non-sensitive business and product data rather than social-profile harvesting at scale — the legal basis question is easier to answer when the data itself is the kind GDPR treats as lower-risk.
Related reading
FAQ
Yes, if it relates to an identifiable person — public visibility doesn't remove GDPR's scope, it just affects which legal basis (typically legitimate interest, not consent) is realistic to rely on.
Yes, if you're processing personal data belonging to people in the EU — GDPR's territorial scope is based on whose data it is and where they are, not where the company processing it is headquartered.
It's the written analysis documenting your purpose, necessity, and the balancing test against the individual's rights — the standard evidence regulators expect if you're relying on legitimate interest as your legal basis for scraping personal data at scale.
Beyond GDPR, Crawlora's own docs cover the rest of the stack — browse the APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.