Franchising in Denmark: Allocate Responsibility for Customer Data

When you turn an existing business into a franchise network, your customer management system may need to change. Information previously used within a single business may now need to be shared between independent businesses. Before the first franchisee gains access to bookings, loyalty schemes or order histories, you should therefore decide who may use the information, for what purposes and on what legal basis.

Map customer data before choosing a shared system

Start with the customer journey through your existing business. Where is information collected, who uses it and where is it sent? Include both the main customer database and less visible tools such as contact forms, spreadsheets, booking systems and support tickets.

Create an overview with one row for each personal data processing activity. Describe:

• What information is processed, such as names, contact details and purchase histories.
• Why the processing is necessary.
• Which business determines the purposes and essential means of processing.
• Who needs access.
• When the information must be deleted or anonymised.

Distinguish between local and shared needs. A franchisee may need a customer's telephone number to change a booking. That does not mean every other outlet needs access to it. A franchisor's wish to compare outlets can often be met using aggregate sales figures without information about identifiable customers.

This mapping should come before system selection. Otherwise, you risk shaping the allocation of responsibilities around software that gives more people access than necessary.

Define roles based on what actually happens

Denmark has no specific franchise law. Franchise agreements are governed, among other things, by the Danish Contracts Act and general principles of contract law. There is also no specific requirement to register franchise agreements or provide a statutory franchise disclosure package. However, general duties of good faith and disclosure may require material information to be disclosed before an agreement is signed.

Customer data is subject to the General Data Protection Regulation (GDPR), supplemented by the Danish Data Protection Act. A franchise agreement cannot override these rules. Nor can the parties simply choose a role that does not reflect the actual processing arrangements.

There are three relevant situations:

Independent controllers: The franchisee determines the purposes and essential means of processing, for example for its local customer administration. If information is disclosed to the franchisor for its own purposes, both the disclosure and the subsequent processing must have a lawful basis.

Processing on instructions: The franchisor processes information solely on the franchisee's behalf and under its instructions. In this case, the franchisor may be a processor, and a data processing agreement must be put in place under Article 28 of the GDPR.

Joint controllers: The parties jointly determine the purposes and essential means of processing, for example for a shared loyalty scheme. They must then have an arrangement under Article 26 of the GDPR allocating their responsibilities. The essence of that arrangement must be made available to customers.

The same businesses may have different roles for different processing activities. Using a shared system therefore does not automatically make them joint controllers.

Turn responsibilities into specific agreements

Use your data mapping to put the necessary agreements in place. The franchise agreement can set out obligations to use particular systems and follow security requirements. It does not replace a required data processing agreement or joint controller arrangement.

Agree specifically who will handle customers' requests for access, rectification and erasure. Also explain how an employee should forward a request if it reaches the wrong business. An internal division of responsibilities must not restrict customers' rights.

Establish a procedure for data breaches too. Who should be contacted, what information must be provided and who will assess whether the breach must be reported to the Danish Data Protection Agency (Datatilsynet)? For the controller, the notification deadline may be 72 hours after becoming aware of the breach, unless it is unlikely to pose a risk to individuals' rights and freedoms.

Review your system providers' terms as well. Check their use of sub-processors, deletion functions and any transfers outside the EU/EEA. A system is not lawful simply because its provider describes it as GDPR-compliant.

Test access and customer privacy information before opening

Create test users with the roles you intend to use across the franchise network. Check that a local employee can only see relevant information and that their access can be revoked when they leave. Use fictional customer data for testing.

Then update your customer privacy information to reflect the businesses, purposes, recipients and rights actually involved. Customers should not have to guess who the controller is because several businesses use the same name and branding.

Pay particular attention to marketing. Access to a customer database does not, in itself, give you the right to send marketing emails or text messages. You must also consider the Danish Marketing Practices Act's rules on electronic marketing. Existing consent does not automatically cover new independent businesses or new purposes.

Practical takeaway: Only give a franchisee access once you have mapped the processing activities, defined the roles, put the necessary agreements in place and tested access restrictions. This makes responsibilities clear from the first customer interaction.