How to Choose a Web Scraping Provider in Germany: GDPR & Procurement Guide (2026)

Introduction

German companies rarely buy web data on price alone. Before a contract is signed, Einkauf wants a clear scope and SLA, the Datenschutzbeauftragte wants to know whether personal data is involved, and IT security wants to see how data reaches your systems. A good web scraping provider in Germany should make all three conversations easy.

Short answer: To choose a web scraping provider in Germany, confirm five things in writing: which public sources and fields are in scope, whether any personal data is collected (this decides if you need an Art. 28 AVV), how database-right and site-terms questions are handled, where data is processed and delivered (EU options), and which SLA, QA checks and pilot you get before committing.

This guide covers the German sources that matter, the legal basics with official sources, a due-diligence table for your RFP, and a sensible pilot. It is general information, not legal advice; involve your own counsel and DPO.

Why do German companies buy web data from an external provider?

Most demand comes from pricing, category and channel teams that need one reliable view of many shops:

• Price and promotion monitoring. Daily or intraday EUR prices across Amazon.de, Otto, Kaufland.de and MediaMarkt, including strike-through prices and coupons.
• UVP and channel compliance. Brands check how sellers price against the recommended retail price (UVP).
• Assortment and availability. Listings, stock status and delivery promises by retailer.
• Mittelstand market intelligence. Spare parts, tools and B2B product prices on public shops.

Building this in-house means maintaining scrapers, handling layout changes and matching products by EAN/GTIN. That is why many teams prefer a managed feed from a web scraping provider, and why procurement treats the choice as a vendor-risk decision.

Which German retailers and marketplaces should a provider cover?

Coverage is the first filter. Ask each provider to confirm the exact sources, the fields per source, and the refresh frequency they can support. The table below shows the platforms German buyers ask about most often, with typical public fields and practical notes.

Write two points into the contract: public pages only, with no login to customer accounts, and a fixed field list per source, so nobody adds personal data later "because it was on the page".

What data fields should be in the scope document?

A clear field list prevents most disputes. A typical German price-intelligence feed covers:

• Product identifiers. Retailer product ID, EAN/GTIN where shown, brand, model, variant attributes.
• Prices in EUR. Selling price, former or strike-through price, UVP where shown, unit price (Grundpreis) for grocery and drugstore.
• Promotion details. Coupon flags, bundle deals, promotion labels and validity dates where visible.
• Availability. In stock, out of stock, delivery time, shipping cost.
• Seller information (business sellers only). Seller name and type, with a rule for private sellers.
• Metadata. Source URL, capture timestamp (CET/CEST), postcode or store context.

Ask how products are matched: EAN first, then model and attributes, with confidence scores and manual review.

When is an Art. 28 data processing agreement (AVV) needed?

This is usually the first question from the DPO. The GDPR (DSGVO) applies only to personal data, meaning information about an identified or identifiable natural person (Art. 4(1) GDPR, https://eur-lex.europa.eu/eli/reg/2016/679/oj).

A contract under Art. 28 GDPR, called an Auftragsverarbeitungsvertrag (AVV) in Germany, is needed when a provider processes personal data on your behalf and on your instructions. The EDPB explains how to decide who is controller and who is processor in its Guidelines 07/2020 (https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en). The German federal commissioner, the BfDI (https://www.bfdi.bund.de), and the state data protection authorities publish guidance in German as well.

In practice, three situations come up:

Two more points for the DPO:

• Role matters. A provider building a dataset on your instructions may be your processor; one selling a standard dataset built for its own purposes may be a separate controller.
• Scraping guidance is developing. The EDPB published draft Guidelines 03/2026 on web scraping in the context of generative AI, open for consultation until 30 October 2026 (https://www.edpb.europa.eu/public-consultations/guidelines-on-web-scraping_en). They target AI training, but their themes (data minimisation, filters at collection, documented balancing tests) are useful for any project.

For a deeper look at lawful basis and BDSG specifics, see our guide on GDPR and BDSG web scraping compliance in Germany (link in Related reading).

What about the database right and text and data mining in Germany?

Data protection is only one part. German law also protects databases and copyright works. These rules are summarised neutrally here; whether they apply depends on the facts, so ask your counsel.

• Database maker's right (§§ 87a ff. UrhG). Germany implements the EU Database Directive 96/9/EC (https://eur-lex.europa.eu/eli/dir/1996/9/oj). A database that required a substantial investment is protected (§ 87a, https://www.gesetze-im-internet.de/urhg/__87a.html). The maker has exclusive rights over reproducing or distributing the database as a whole or a substantial part of it. Repeated and systematic use of insubstantial parts can also be covered if it conflicts with normal exploitation of the database (§ 87b, https://www.gesetze-im-internet.de/urhg/__87b.html).
• Text and data mining exception (§ 44b UrhG). TDM means automated analysis of digital works to find patterns, trends and correlations. Copies of lawfully accessible works are allowed for TDM and must be deleted when no longer needed. For works online, the rights holder can reserve this use, but only in machine-readable form (https://www.gesetze-im-internet.de/urhg/__44b.html). The exception comes from Art. 4 of the EU DSM Directive 2019/790.
• Site terms and technical signals. Website terms of use, robots.txt and other machine-readable reservations can matter for both topics.

For buyers, this means asking your web scraping provider how it limits extraction to the fields and volumes you need, how it respects machine-readable reservations and site terms, and how it handles an objection from a source. A provider that collects "everything just in case" creates risk for you.

Which security standards do German buyers ask about?

German IT security teams usually send a questionnaire first. Expect questions on:

• ISO/IEC 27001. The most common information security management certification requested in vendor reviews.
• BSI C5. The German Federal Office for Information Security (BSI) Cloud Computing Compliance Criteria Catalogue. The BSI lists C5:2026 as the current version (https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5_node.html). It is mainly relevant for cloud services, but buyers often use it as a reference.
• TISAX. Automotive suppliers in the Mittelstand may ask about it if data flows touch their automotive customers.
• Practical controls. Encryption, access control and MFA, logging, deletion on contract end and incident notification times.

Actowiz Solutions' security documentation and any certifications. Do not accept vague claims from any provider; ask for the certificate, its scope and its validity date.

Where is the data processed and delivered?

Data residency is often a requirement in German RFPs, even when the data is not personal. Discuss these options with your provider:

• Delivery into your EU cloud. For example Amazon S3 in Frankfurt (eu-central-1), Azure Germany West Central, Google Cloud in Frankfurt (europe-west3), or Snowflake or BigQuery in an EU region.
• Formats. CSV, JSON or Parquet files, or a REST API, with a fixed schema and versioning.
• Processing location. Ask where collection and cleaning happen. If personal data is in scope and processing happens outside the EU or EEA, the GDPR's rules on international transfers (Chapter V, for example standard contractual clauses) apply.

Actowiz delivery options and processing locations for German projects

How should you plan for German sale seasons?

Peak seasons stress every pipeline. Agree higher refresh rates and support cover in advance.

Put peak-season refresh, delivery and fix times into the SLA.

What should your due-diligence checklist include?

Copy this table into your RFP when assessing any web scraping provider in Germany.

How do you run a pilot before signing?

A short pilot answers most questions faster than long RFP rounds:

• Pick 2–4 retailers and 100–500 SKUs that matter most, for example Amazon.de, Otto and MediaMarkt for a consumer electronics brand.
• Fix the field list and refresh rate using the scope template above.
• Receive a sample within 48 hours in your format (CSV, JSON or API) and compare it against manual spot checks.
• Review QA reports for coverage, match rates and missing values.
• Let the DPO and IT security review the real sample and delivery route, then agree the SLA and peak-season plan.

Frequently Asked Questions

Do we need an AVV to buy price data from a web scraping provider in Germany?

Not always. Prices, EANs and stock data about companies are generally not personal data, so Art. 28 GDPR may not apply to the data itself. If private-seller names, reviewer details or other personal data are in scope, agree roles and an AVV with your DPO.

Is web scraping legal in Germany?

Collecting publicly available business data can be lawful, but it depends on the data, the volume and the source. GDPR, the database maker's right (§§ 87a ff. UrhG), § 44b UrhG and site terms can all be relevant. This guide is not legal advice; ask your counsel.

Can data be delivered only within the EU?

Yes, this is a common requirement. Discuss delivery into your own EU cloud, for example S3 in Frankfurt or Azure Germany West Central, and ask where collection and processing take place.

Which German platforms can a web scraping provider monitor?

Typical scopes include Amazon.de, Otto, Kaufland.de, MediaMarkt/Saturn, idealo, Zalando, eBay.de, REWE, EDEKA, dm and Rossmann, using public pages only. Confirm fields and refresh rates per source.

How quickly can we test a provider?

A focused pilot on a few retailers and a few hundred SKUs can produce a sample within 48 hours. Use it to check accuracy, matching and delivery before you sign.

Conclusion

You can also reach us for all your mobile app scraping, data collection, web scraping, and instant data scraper service requirements!