← Back to the blog Legal 
GDPR and proxies — what you need to know
Roles, metadata, legal basis, and why the vendor chain matters.
· 8 min · ProxyAPI
01
Start with the roles
You normally determine the purpose of the traffic and remain responsible for a legal basis. Where ProxyAPI processes personal data on your behalf, that processing is governed by our Data Processing Agreement.
02
Minimise in the design
Send only what is needed, limit retention in your own application, and avoid personal data in URLs or logs. A proxy does not turn an unlawful collection purpose into a lawful one.