Scraping Contacts From Websites: What Is Lawful

This is a topic where the technical question is secondary: collecting contacts is easy, using them lawfully is not. Here are the boundaries.

Two different categories

Conflating them causes most of the trouble.

Organisational data. A general phone number, an enquiries address, a registered address, company registration details. This belongs to a legal entity, is published deliberately, and collecting it from open sources is usually acceptable.

Personal data. A name, a job title, a specific employee work email, their phone number. This is personal data and its processing is regulated.

The key point: publication does not authorise any processing. The law distinguishes “the data is publicly available” from “there is a lawful basis to process it”. A database assembled from open sources remains a database of personal data with every requirement that entails.

What the law requires

The main points applicable to processing personal data:

• A lawful basis is required. Consent from the data subject or another statutory basis. “Found it on the internet” is not one.
• A stated purpose is required, and the data must match it in scope: collecting more than the purpose needs is not permitted.
• The subject has rights. To learn what data about them is processed and to demand deletion. That means you need a process, not just a file.
• Storage requirements apply. Protection, restricted access, retention limits.
• Bulk mailing without consent is separately prohibited under advertising law.

The practical conclusion: collecting personal data without legal groundwork is a risk that does not pay. If the task is commercial, settle it with a lawyer before development, not after a complaint from someone whose data you collected.

What is lawful

Tasks that do not run into personal data:

Collecting company data. Registration details, general contacts, addresses, lines of business - for counterparty checks, market analysis, sales preparation.

Checking your own data. Whether your contact details are current on platforms where you are listed.

Market analysis. How many companies operate in a segment, how they present themselves, what services they list.

Enriching an existing database. You already have customers with a lawful basis and you supplement information about their companies.

Monitoring mentions and public activity of organisations.

What these share: organisational data rather than individuals, and a purpose unrelated to mailing.

Why mailing a scraped list does not work

Even setting the law aside, the practical picture is poor:

Mail systems recognise it. Bulk sending to addresses that never subscribed produces complaints, and complaints cost your domain reputation. Recovering it is slow and expensive, and all your correspondence suffers, not just the campaign.

Response rates approach zero. Unsolicited email is read by very few.

Company reputation. Being seen as a spammer costs more than any number of collected addresses.

Collected addresses go stale fast. People change jobs, addresses stop existing, and some are traps placed deliberately to identify collectors.

The workable alternative: collect company data for preparation and make contact through a route that implies consent. Slower, and it works.

Practical constraints when collecting

If the task fits within lawful bounds:

• Collect the minimum. Only what the stated purpose requires.
• Do not sweep up personal data alongside it. A name and job title beside a general address is already a different category.
• Respect site rules. Most forbid automated collection.
• Do not create load on somebody else’s server.
• Store the source and date for every record. If you ever have to explain where data came from, that is the only thing that helps.
• Provide for deletion on request.

The overall legal picture is in the scraping guide. Technically: scraping in Python.