GDPR is the European Union's data protection law, governing how personal data may be collected, processed, and stored, including personal data gathered through web scraping. Scraping operations that collect names, emails, or other personal identifiers can fall within GDPR's scope even when the company doing the scraping is based outside the EU, for example where the processing involves monitoring the behaviour of people in the EU.

GDPR compliance for scraping generally requires a valid legal basis for processing personal data, clear purpose limitation, and mechanisms for individuals to request data deletion, which is why it makes sense to avoid collecting personal data unless it's specifically required for the task, in line with GDPR's data minimisation principle.

GDPR's reach isn't limited to companies based in the EU. Organizations outside the EU can fall under it when they process the personal data of people in the EU in connection with offering them goods or services or monitoring their behaviour there.