Web Scraping Compliance for Enterprises: 2026 Guide

 

Introduction

Web scraping compliance for enterprises comes down to five things your reviewers must be able to sign off: the data is publicly available, personal data is excluded or lawfully handled, your intended use (internal analysis, display, caching, resale) fits the source's rights, retention and security are documented, and both sides are bound by an NDA and, where needed, a DPA.

Those five points come straight from the written questions we receive. In recent enterprise inquiries – from consulting firms, FMCG and beverage multinationals, large retailers and travel companies – procurement, legal and information-security teams asked before any trial: Can we display product titles and images in our app? Can we cache the data? Is it public data only? How long do you keep it? Will you sign our NDA and complete our security questionnaire?

This guide walks through each question, what reviewers are really checking, and the evidence a credible web data vendor should hand over. Use it as a due-diligence checklist whether you work with Actowiz or anyone else.

Why do enterprise buyers ask compliance questions before a trial?

For a large company, buying web data is a third-party risk decision, not just a data decision. The data may flow into pricing systems, investor reports, customer-facing apps or AI models, so several teams must approve the vendor.

• Procurement wants a standard contract, clear pricing and a vendor that passes onboarding (company registration, insurance, tax forms).

• Legal wants to know where the data comes from, who owns it, and what the company may do with it – especially display, redistribution and AI training.

• Information security wants evidence of controls: encryption, access management, incident response and any certifications.

• Privacy / DPO wants to confirm whether any personal data is involved and, if so, the controller–processor roles under GDPR.

• The business team (pricing, strategy, category, revenue management) simply wants a sample fast – which is why answering the first four early shortens the deal.

Good web scraping compliance for enterprises is therefore a shared file of answers, not one signature. Settling these questions in writing before a pilot avoids the common pattern where a successful trial stalls for weeks in legal review.

The 10 questions enterprise reviewers ask a web data vendor

These are the questions that appear most often in enterprise security questionnaires and contract redlines we receive. The table shows what each reviewer is really checking and the evidence to request.

• 1. Is this public data only? — No logins, paywalls or private areas bypassed — Evidence to request: Written scope: sources, pages, fields; statement on logged-out collection

• 2. Is any personal data collected? — GDPR / UK GDPR / CCPA / DPDP exposure — Evidence to request: Field list showing no personal data, or a PII-filtering and minimisation note

• 3. Can we display titles, prices and images? — Copyright, trademarks and site terms — Evidence to request: Usage-rights discussion with your counsel; vendor's position in writing

• 4. Can we cache or store history? — Database rights, retention limits — Evidence to request: Agreed retention period and archive format

• 5. Can we resell or redistribute the data? — Licence scope — Evidence to request: Contract clause defining permitted use

• 6. How long does the vendor keep our data? — Retention and deletion — Evidence to request: Retention policy; deletion on request / at contract end

• 7. Will you sign our NDA and DPA? — Confidentiality of requirements and outputs — Evidence to request: Signed mutual NDA; DPA if personal data is in scope

• 8. Which security controls and certifications do you have? — Vendor security posture — Evidence to request: Certificate copies with scope and expiry; questionnaire answers

• 9. Where is the data processed and stored? — Data residency, sub-processors — Evidence to request: Hosting regions and sub-processor list

• 10. What happens if a source changes or objects? — Continuity and takedown handling — Evidence to request: SLA, change process, takedown / opt-out procedure

Public data only: what it means in practice

"Public data" means information any visitor can see without logging in, paying, or getting around a technical barrier. For most enterprise projects – product prices, availability, ratings counts, menu items, hotel rates, store locations – that is exactly the data needed.

A defensible public-data scope usually includes these commitments:

• No login-walled or paywalled content. Collection runs logged out, without creating accounts to reach restricted pages.

• No circumvention of access controls. Rate limits and polite crawling instead of overloading a site.

• Field-level scope. The contract lists the exact fields (for example product_title, price, pack_size, availability), so reviewers can see nothing extra is collected.

• Personal data excluded by default. Reviewer names, seller contact details and other personal data are dropped unless there is a documented lawful basis and the client's counsel approves.

Actowiz's position: we collect publicly available business data – prices, catalogues, availability, listings – and we do not take on projects to collect personal data of private individuals. Our privacy policy states that our systems "actively discourage and filter out the harvesting of Personally Identifiable Information (PII)".

Usage rights: displaying titles and images, caching and resale

Within web scraping compliance for enterprises, usage rights are the question legal teams care about most and the one vendors answer least clearly. The key point: a data vendor can deliver data, but it cannot grant rights it does not own. Product images, descriptions and logos usually belong to the brand, retailer or photographer; facts such as a price or a stock status are treated differently from creative content in most legal systems.

In the EU, collections of data can also be protected by the sui generis database right under Directive 96/9/EC, which can restrict extracting or re-using a substantial part of a database (https://eur-lex.europa.eu/eli/dir/1996/9/oj). Site terms of use add a contractual layer. That is why the intended use matters as much as the collection method.

• Internal analytics and dashboards: Lowest-risk use; data stays inside the company — Practical approach to discuss with counsel: Most enterprise price, assortment and availability projects sit here

• Displaying product titles and prices in an app: Site terms; database rights in the EU — Practical approach to discuss with counsel: Display factual fields; link back to the source; avoid copying full catalogues wholesale

• Displaying product images: Copyright in photographs; trademarks — Practical approach to discuss with counsel: Use image URLs or brand-supplied/licensed assets; get counsel sign-off. Actowiz does not supply licensed image datasets or IP indemnity for images

• Caching and keeping price history: Retention, database right — Practical approach to discuss with counsel: Agree retention period; store derived metrics rather than full page copies where possible

• Reselling or redistributing raw data: Licence scope, database right — Practical approach to discuss with counsel: Usually needs a specific legal review; derived insights carry less risk than raw dumps

• Training AI / ML models: Copyright, personal data, emerging AI rules — Practical approach to discuss with counsel: Exclude personal data; document sources; follow regulator guidance such as the UK ICO's generative AI consultation response

Our practical advice to buyers is to state the intended use in the statement of work. It lets both sides design the dataset around it – for example, delivering image URLs instead of image files, or weekly derived price indices instead of full raw history.

GDPR and personal data: roles, lawful basis and DPAs

If no personal data is collected, GDPR largely falls away for the dataset itself. Most price, catalogue and availability projects are designed that way. When personal data is unavoidable – for example, the public name of a business owner on a listing – reviewers will look at three things.

• Roles. Under GDPR Article 28 a processor acts on the controller's documented instructions under a written contract. Actowiz's privacy policy describes Actowiz as operating as a data processor and states that DPAs are offered to enterprise clients.

• Lawful basis and principles. Article 6 (lawful basis) and Article 5 (data minimisation, purpose limitation, storage limitation) apply. Legitimate interests is the basis most often discussed for scraping, and the UK ICO has stressed that it requires a genuine balancing test and transparency.

• Transparency to data subjects. Article 14 covers information duties when data is not obtained from the person directly – one reason most enterprise projects simply exclude personal data.

Security, retention and confidentiality: what to request

Security reviewers want evidence, not adjectives. These are the items to ask any vendor for, with Actowiz's current position.

• Encryption. Actowiz's privacy policy states AES-256 encryption at rest and TLS 1.3 in transit, role-based access controls and regular security audits.

• Certifications. The Actowiz privacy policy states that the company holds ISO 27001 certification for information security management. Confirm certifications with management: current ISO/IEC 27001 version (2022 transition), certificate scope, certifying body, certificate number and expiry; whether ISO 9001 is held; do NOT mention SOC 2 unless a report exists.

• Retention and deletion. The privacy policy states that Actowiz does not maintain long-term repositories of web data extracted on behalf of clients; output is routed to the client when a workflow finishes.

• Confidentiality. We sign mutual NDAs before you share detailed requirements. The privacy policy states that no confidential business information is disclosed without prior written consent.

• Data location and sub-processors. The privacy policy states that third-party providers are contractually bound to protect client data.

• Security questionnaires. Actowiz completes client security questionnaires (e.g. SIG Lite / custom) – typical turnaround.

• Service levels. SLA with delivery team – delivery schedule, fix time when a source changes, support hours. Avoid any vendor promising "100% accuracy" or "zero legal risk".

The legal landscape in brief (and its limits)

Enterprise reviewers often ask whether web scraping is legal. The honest answer is that it depends on what is collected, how, where, and what you do with it. A few reference points are widely cited:

• hiQ Labs v. LinkedIn (US). In April 2022 the Ninth Circuit reaffirmed that scraping publicly available profile data was unlikely to be access "without authorization" under the Computer Fraud and Abuse Act. Later in 2022, however, the district court found hiQ had breached LinkedIn's User Agreement, and the parties settled. The lesson commentators draw: public-data access is one question; contract terms and how data is used are another (summary: https://en.wikipedia.org/wiki/HiQ_Labs_v._LinkedIn; Morgan Lewis analysis, December 2022).

• EU database right. Directive 96/9/EC can protect substantial investment in a database, which matters most for bulk re-use and redistribution.

• Privacy laws. GDPR, UK GDPR, CCPA/CPRA and India's DPDP Act apply when personal data is involved – see our GDPR vs CCPA vs DPDP checklist .

• Site terms and robots.txt. Terms of use are contracts that may bind users who accept them; robots.txt signals the site owner's crawling preferences. Both should be reviewed as part of the source assessment.

How Actowiz supports enterprise legal and security review

Web scraping compliance for enterprises should not slow a project down. We aim to make the compliance review as short as the technical pilot. A typical enterprise onboarding runs like this:

• Mutual NDA first. Signed before you share requirements, target sources or internal SKU lists.

• Written scope. Sources, countries, fields, cadence and the explicit exclusion of personal data, in a statement of work your counsel can review.

• Intended-use note. You tell us whether data is for internal analysis, display, caching or model training; we shape the deliverable accordingly.

• Security pack. Privacy policy, certification evidence, questionnaire answers and DPA where needed.

• Sample on your fields. A sample from your named sources so the business team can validate quality while legal review runs in parallel sample within 24 hours.

Frequently Asked Questions

Is web scraping legal for enterprises?

Collecting publicly available, non-personal business data is common practice, and in hiQ v. LinkedIn the US Ninth Circuit held that scraping public pages was unlikely to breach the CFAA. But legality depends on the source's terms, the data collected, the country and your use. Have your counsel review your specific use case; this guide is not legal advice.

Can we display scraped product titles and images in our app?

Factual fields such as titles and prices are lower risk than images, which are usually protected by copyright. Many buyers display factual data with a link back and use brand-licensed images. Confirm your display plan with legal counsel before launch.

Does Actowiz collect personal data?

No, not by default. We collect public business data such as prices, catalogues and availability, and we do not collect personal data of private individuals. Where a public business contact is unavoidable, it is excluded unless your counsel approves a lawful basis.

Will Actowiz sign our NDA and Data Processing Agreement?

Yes. We sign mutual NDAs before detailed requirements are shared, and our privacy policy states that DPAs are offered to enterprise clients.

How long does Actowiz keep the data it collects for us?

Our privacy policy states that we do not keep long-term repositories of client-extracted data; output is delivered to you when each workflow finishes.

Which security certifications does Actowiz hold?

Our privacy policy states ISO 27001 certification for information security management.

Conclusion

You can also reach us for all your mobile app scraping, data collection, web scraping, and instant data scraper service requirements!