Franchising in Hong Kong: Defining Member Data Sharing and Privacy Responsibilities

A shared membership system may seem convenient for company-owned outlets. But once independently operated franchisees join the network, questions about who collects data, who can view purchase histories and who can send promotional offers can no longer be left to informal understandings. Before launching a franchise operation in Hong Kong, businesses should establish rules for sharing member data—not wait until franchisees have received the entire customer list before putting the paperwork in place.

1. Map data flows and clarify legal responsibilities

Hong Kong currently has no legislation specifically governing franchising, nor a generally applicable statutory regime for franchise disclosure, franchise registration or a mandatory franchise code. However, franchise arrangements remain subject to general contract law, the Misrepresentation Ordinance and the Competition Ordinance, among other laws. Handling membership data that identifies customers must also comply with the Personal Data (Privacy) Ordinance (Cap. 486). The absence of franchise-specific legislation does not give head office free rein to decide how all data is used.

Under the Ordinance, the key question in identifying a ‘data user’ is who controls the collection, holding, processing or use of personal data—not whom the agreement labels the ‘data owner’. Head office and franchisees may be data users separately or jointly, depending on how the business actually operates.

Before introducing franchising, document the flows of names, telephone numbers, transaction records, loyalty points and complaint information:

• At which touchpoint does the customer provide the data? Which legal entity collects it?
• Is the data stored in head office’s system, on franchise outlet devices or on an outsourced service provider’s platform?
• Why do head office and franchisees each need access? Do they need to see the complete record?
• Who is responsible for correcting data, handling access requests and carrying out deletions?

For example, a franchise outlet redeeming loyalty points may only need to see a membership number and the available points balance—not the customer’s entire purchase history across other branches. Narrow the scope of the data first, then design the sharing arrangements.

2. Check the original collection purposes: franchising is not automatic authorisation

The data protection principles under the Personal Data (Privacy) Ordinance require data to be collected for a lawful and directly related purpose, and to be adequate but not excessive. At the point of collection, all practicable steps must also be taken to inform customers of matters including the purposes of use, the classes of people to whom data may be transferred, and the arrangements for accessing and correcting it.

Simply stating in a franchise agreement that ‘member data is shared across all outlets’ does not mean customers have consented. The franchise agreement binds the contracting parties; it cannot replace customer notices or any required consent.

Brands should compare their existing Personal Information Collection Statements against each proposed franchise-related use. If telephone numbers originally collected solely for bookings at company-owned outlets are passed to independent franchisees to promote other services, this may constitute a new purpose. Unless an applicable exemption applies, using data for a purpose other than the original purpose or a directly related one requires the data subject’s prescribed consent. Unilaterally updating a privacy policy may not be enough.

Direct marketing is separately regulated under Part VIA of the Ordinance. Before using personal data for direct marketing, businesses must meet specified notification and consent requirements and provide an opt-out mechanism; consent may include an indication of no objection. Providing data to another person for that person’s direct marketing involves additional requirements, including written consent. Where head office sends messages on behalf of franchisees, responsibility should not be assessed solely by looking at the sender’s name.

3. Turn sharing rules into a contractual schedule and system permissions

Data clauses should go beyond saying that ‘both parties must comply with privacy legislation’. Put a practical data-processing schedule in place, specifying data categories, permitted uses, authorised users, retention arrangements and outsourcing restrictions. Ensure that system settings match the contractual terms.

Allocate access according to job requirements. Shop staff should have only the permissions needed to handle the current transaction; managers may handle membership enquiries for their own outlet. Access to other outlets’ records and bulk exports should require a reason, approval and an audit trail. Avoid shared accounts, and promptly adjust access rights when employees leave or change roles.

Restrict separate customer lists. Explicitly prohibit franchisees from downloading members’ telephone numbers to personal devices without authorisation, uploading them to independently chosen marketing platforms or using them for other businesses. Where exports are genuinely needed for operations, specify file-protection and deletion procedures.

Set retention rules and review procedures. ‘It might be useful later’ is not a justification for keeping data indefinitely. Establish retention criteria based on the purpose and relevant legal requirements, and regularly delete or irreversibly anonymise data that is no longer needed.

Where a data processor, such as a membership system provider, is engaged, the relevant data user must use contractual or other means to prevent excessive retention and unauthorised or accidental access, processing, erasure, loss or use. Outsourcing the work does not mean outsourcing responsibility.

4. Rehearse customer requests and data incidents before expanding

Choose a pilot outlet and use fictitious test data to rehearse three scenarios: a customer requests access to their data, a customer opts out of marketing, and a staff member accidentally emails a membership list to an external recipient. The point is not to check whether forms exist, but to confirm that frontline staff know whom to contact, head office can trace what happened, and all systems can act consistently.

Data access requests generally must be handled within 40 days of receipt, subject to statutory exceptions and specific procedures. Internal referral deadlines should be shorter, so that head office and franchisees do not miss the deadline while passing responsibility back and forth. Direct marketing opt-out requests must result in the relevant use stopping as required by law—not merely removal from one outlet’s mailing list.

Incident procedures should cover internal reporting, restricting access, preserving logs, assessing the extent of a breach and taking remedial action. Whether to notify the Office of the Privacy Commissioner for Personal Data and affected individuals should be assessed against the incident’s risks, applicable law and the Commissioner’s guidance. Internal contractual deadlines should not be presented as statutory notification deadlines.

Practical takeaway: Before recruiting the first franchisees, complete a data-flow map, review customer notices, prepare a data-processing schedule and rehearse incident response. Have a Hong Kong lawyer review the arrangements against the systems actually in use, so that ‘shared membership services’ become a clearly bounded, auditable form of collaboration across the franchise network.