Bright Data

GDPR overview

GDPR and CCPA compliance is claimed explicitly: the Trust Center states Bright Data is fully committed to complying with both, and the privacy policy, last reviewed on 14 May 2026, lists the seven EU rights (confirmation and access, portability, rectification, erasure, objection, restriction, complaint to a supervisory authority), exercised in writing at privacy@brightdata.com where a Privacy Officer investigates. The company is established in Israel and limits transfers outside the EEA to countries the European Commission recognises as adequate or to recipients covered by contractual safeguards. Article 27 representatives are named for both jurisdictions: EDPO in Brussels for the EU, EDPO UK in London for the UK. A Data Protection Addendum is published, and the security posture is backed by ISO 27001, 27017, 27018 and 27701, SOC 2 Type II, SOC 3, CSA STAR and a PwC assurance report.

Who owns the data?

The agreement draws a sharp line. Bright Data states it does not rent or sell User Data, and it never discloses one customer's IP address to another. For the data a customer collects through the service, however, the Master Service Agreement reserves broad rights: Bright Data may retain that data and use it for its own purposes at its sole discretion, and the same wording covers the Web Scraper IDE. Delivered datasets and exports are kept only for a limited Review Period, after which they may be deleted with no obligation to store or re-deliver them. Where personal data is processed, Bright Data acts as processor under a published Data Protection Addendum and the customer remains the controller.

Reuse rights

Customers may use the data they collect and the datasets they buy for their own lawful business purposes without asking permission each time, subject to three limits. Datasets may only serve legally valid purposes and must comply with applicable privacy and marketing legislation; they may not be distributed, transmitted, reproduced, published, licensed, transferred or sold in order to offer a similar or competing product; and an individual dataset may carry additional terms of its own. Insights produced by Bright Data may not be shared with third parties without prior written approval, and changes to a dataset need Bright Data's approval and may cost extra. On its own side, Bright Data uses account data to run and support the service, to communicate and market, and for statistical and analytical research; it processes publicly posted personal data on a legitimate interest basis in order to serve customers; and its CCPA notice states that identifiers may have been sold to third parties for commercial purposes over the previous twelve months.

Data retention & training

Hosting summary

Bright Data hosts on Amazon Web Services across multiple Availability Zones, with a disaster recovery site, encrypted backups taken every few minutes and distributed across several locations, and a recovery plan tested annually. Data in transit is protected with TLS 1.3, with support for at least TLS 1.2; data at rest uses AES-256 or stronger; credentials are salted and hashed. Independent auditors run annual application and infrastructure penetration tests, and a private bug bounty programme is in place. What the documentation never does is name a country or a region: no hosting jurisdiction, no EU or US region and no data centre location appears anywhere in the Trust Center. The company itself is established in Israel, and its privacy policy limits transfers outside the European Economic Area to countries the European Commission recognises as providing an adequate level of protection, or to recipients covered by contractual safeguards. Organisations with a data residency requirement will therefore need to obtain the hosting location in writing rather than from the published pages.