Buying a Franchise in Egypt: Who Is Responsible for Customer Data?

A franchise may provide a ready-made booking system and customer loyalty programme, but it does not automatically relieve you of responsibility for the data your outlet collects. Names, phone numbers, addresses and order histories may pass between the outlet, the franchisor and service providers without clear boundaries of responsibility. Before entering Egypt’s franchise market, examine this as a legal and operational obligation, not merely a technical feature of the brand’s offering.

1. Map the data flow before agreeing to the system

Start with a practical question: what data will the outlet collect, why, and where will it go? Ask for a demonstration of the system using test data, rather than accepting assurances that it is secure or used across all outlets. You do not need access to real customers’ names or phone numbers during your checks.

Draw up a list covering order, delivery, booking, complaint and loyalty data, as well as any images or recordings linked to identifiable individuals. For each category, establish:

• Who collects it, and who decides what it will be used for?
• Is it stored at the outlet, with the franchisor or with another provider?
• Who can view it or download a copy?
• Is it sent outside Egypt, including through hosting or technical support arrangements?
• When is it deleted, and why is it retained?

Distinguish between the franchisor’s need to know the outlet’s sales figures and its need to know buyers’ names. Aggregated reports that do not identify customers may be sufficient for monitoring performance. If the franchisor insists on receiving detailed data, ask it to explain the purpose and legal basis, rather than simply referring to a brand-wide policy.

2. Understand Egyptian rules and the limits of contractual protection

Egypt has no standalone franchise law, general mandatory disclosure regime or dedicated registration authority for franchise agreements. The relationship is governed by general legal rules, principally Civil Code Law No. 131 of 1948 and Commercial Law No. 17 of 1999, depending on the nature of the obligations. Other specific rules may also apply, depending on the agreement’s terms and the business activity.

Electronic processing of customers’ personal data requires a review of Personal Data Protection Law No. 151 of 2020, taking account of its scope, exemptions and the implementing rules in force. This is not a franchise-specific law, but it may apply to the outlet’s operations, systems and data sharing.

This framework distinguishes between those who determine the purposes and means of processing and those who process data on another party’s behalf. Do not assume that the franchisor bears sole responsibility because it selected the software, or that you are merely a user with no obligations. Each party’s actual role is the starting point and requires legal assessment.

Nor should a statement that ‘the data belongs to the franchisor’ replace a clear definition of data subjects’ rights and the legal basis for using their data. The franchisor’s approval to send data abroad is not, on its own, enough to establish that the transfer is lawful. Before operations begin, ask a lawyer to review the requirements for data transfers and electronic marketing, along with any licences or permits needed in your circumstances.

3. Ask for practical evidence of protection, not a general promise

Before signing, request the privacy notice that will be shown to the outlet’s customers, consent forms where needed, and the relevant data processing agreements. These documents should reflect the actual customer journey: what do customers see when they register? Is signing up for promotional messages kept separate from providing the information needed to fulfil an order?

Also request a list of service providers that receive or can access the data, such as hosting, delivery, messaging and technical support providers. If their contracts contain commercially confidential information, ask for summaries or redacted copies that disclose the key obligations without revealing unnecessary details.

With a technical specialist, review clear evidence of:

• Separate staff accounts with access permissions appropriate to each person’s duties.
• Procedures for revoking access when an employee leaves.
• Access logs, backups and a data recovery process.
• A channel for receiving customers’ requests about their data and forwarding them to the responsible party.
• A plan for dealing with a lost device, a file sent in error or a compromised account.

Include the cost of these measures in your operating budget: subscriptions, training, support, legal review and incident response. Ask for clarity on what the fees paid to the franchisor cover and what you must pay for separately, so that data protection requirements do not become unbudgeted expenses after opening.

4. Put the allocation of responsibilities into a binding addendum

Negotiate a data protection addendum setting out the purposes of processing, the types of data involved, the parties allowed access, retention periods and the conditions for engaging other service providers. These are practical points for negotiation; do not assume they are rights your franchise agreement automatically gives you.

Specify who receives customer complaints, who investigates incidents and who handles any notification required by law. Set internal deadlines for reporting and cooperation that help the parties meet the applicable statutory deadlines, while keeping contractual deadlines distinct from those set by law.

Allocate costs according to the cause of the incident and each party’s responsibility for it, rather than accepting that the outlet must bear every consequence even when the fault lies in a system controlled solely by the franchisor. However, do not assume that allocating responsibility between you prevents a competent authority or an affected individual from asserting their legal rights.

Finally, specify what happens to the data when the relationship ends: what must be deleted, what must be retained by law, and how access will be revoked and the steps documented. The practical takeaway: do not sign until you understand where customer data goes, each party’s role, the cost of protecting it and who takes action when something goes wrong.