Franchising in Greece: protecting customer data

When an existing business expands through franchising, its customer database cannot simply become a shared folder for every partner. Bookings, online orders and loyalty schemes create different responsibilities for each party. In a well-run franchise network, personal data protection needs to be planned before the first franchisee gains access to the systems — not after the first customer complaint.

1. Map your information before granting access

Start with the existing business. Record what information you collect, where it comes from, what it is used for and who can see it. Look beyond your central software: include paper appointment forms, social media messages, complaint records and contact lists kept by employees.

For each process, create a brief record covering:

• the categories of data and the specific purpose for which they are used,
• the company collecting the data and its recipients,
• the storage system and access permissions,
• the lawful basis for processing and the retention period,
• how data can be corrected or deleted, or access restricted.

Distinguish operational needs from management convenience. The franchisor may need aggregated order figures without needing customers’ names or telephone numbers. Where genuinely anonymous data is sufficient, choose that option. Simply replacing a name with a code does not necessarily amount to anonymisation.

2. Establish the legal roles for each process

Greece has no dedicated law comprehensively regulating franchising as a distinct type of contract, nor a specific franchise register or mandatory statutory pre-contractual disclosure document. Franchise agreements rely mainly on the general provisions of the Greek Civil Code governing contracts and obligations. This does not, however, exempt the relationship from specific rules in other areas of law.

Personal data is governed by the General Data Protection Regulation, Regulation (EU) 2016/679, and Greek Law 4624/2019. Electronic marketing communications also require consideration of Greek Law 3471/2006. A general clause stating that ‘all parties comply with the law’ is therefore not enough.

The controller determines the purposes and essential means of processing. The processor handles data on the controller’s behalf and in accordance with its instructions. Where two businesses jointly determine the purposes and means, they may be joint controllers.

These roles depend on how the business actually operates, not on the labels used in the agreement. A franchisee may be an independent controller for its own customer records, while a central loyalty scheme requires a separate assessment. A shared brand does not automatically make everyone a single entity. Obtain a legal review of each process and put the appropriate agreements in place, such as an Article 28 contract or an Article 26 arrangement, where the relevant conditions apply.

3. Turn responsibilities into contractual and technical rules

Before the first franchise partner signs, link the franchise agreement to a clear data management schedule. Set out who provides privacy information to customers, who responds to their requests, who manages technology providers and who takes each action when a security incident is identified.

Provide individual user accounts, role-based access and immediate account deactivation when an employee leaves. Someone working at one outlet should not be able to see another outlet’s customer database simply because they use the same software. Also check where data is stored and whether any transfers outside the European Economic Area require additional safeguards.

Do not treat consent as a universal solution. Fulfilling an order and sending marketing messages are different purposes. The lawful basis and privacy information must be considered separately for each purpose, and where consent is required, you need evidence of it and an easy way to withdraw it.

Also specify what happens to records when the franchise relationship ends. A provision stating that ‘the customer database belongs to the network’ is not enough. Any retention, transfer or deletion must be consistent with the lawful basis and any mandatory retention periods.

4. Test the process before expanding

Run a test at your existing outlet using dummy data: a customer requests access to their information, an employee leaves, and a message containing order details is sent to the wrong recipient. Check whether the team knows whom to contact and can act without improvising.

For personal data breaches, establish an immediate internal reporting procedure and assign responsibility for assessment. The GDPR requires notification to the supervisory authority, where necessary, without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Not every incident automatically requires notification, but every breach must be documented and assessed.

Practical takeaway: before giving a new franchisee access, complete a data map, confirm the parties’ roles and test user permissions. Secure shared operations start with clearly assigned responsibilities, not a shared password.