Franchising in Hong Kong: Defining Member Data Sharing and Privacy Responsibilities

When a business expands from company-owned shops into franchising, it often wants to retain a single membership system so customers can earn points and enjoy offers across outlets. Yet sharing a brand does not mean every outlet can freely access customer data. Building a franchise network based on mutual trust starts with three questions: who decides how data is used, who needs access, and who handles problems when they arise?

1. Map data flows before allocating legal responsibilities

Hong Kong has no legislation specifically governing franchising, nor a franchise-specific statutory disclosure or registration regime. Franchise arrangements are nevertheless subject to general contract law and other relevant legislation. For members’ personal data, the key legislation is the Personal Data (Privacy) Ordinance (Cap. 486). Its Data Protection Principles cover collection, accuracy, retention, use, security, transparency, and access to and correction of data.

Before opening the business to franchisees, head office should identify the data involved in member registration, bookings, payments, loyalty points, customer service and promotional messages. Each process should specify who collects and uses the data, where it is stored, and whether it is passed to a system provider for processing. Simply stating that ‘all data belongs to head office’ is not enough: contractual ownership cannot replace an assessment of statutory responsibilities.

Whether a party is a ‘data user’ depends on who controls the collection, holding, processing or use of data, rather than the label used in the franchise agreement. Head office and franchisees may bear responsibilities separately or jointly. If a franchisee exports a membership list for its own marketing, it cannot rely solely on head office’s privacy policy to avoid responsibility. Legal advisers should confirm each party’s role based on how the business actually operates.

2. Design cross-outlet services and marketing separately

First, define what data cross-outlet services genuinely require. For example, verifying membership and redeeming points may not require every franchisee to see a customer’s full purchase history, address or complaint records. The system should provide only the minimum data needed for each task, rather than giving all outlets access to every record by default.

When collecting personal data, provide a clear, accessible Personal Information Collection Statement explaining the purposes of collection, the classes of people who may receive the data, whether providing it is mandatory, and the contact arrangements for data access and correction requests. If the brand’s existing statement covers only company-owned shops, do not assume it remains sufficient once independent franchise operators join the network.

Data Protection Principle 3 under the Personal Data (Privacy) Ordinance restricts the use of data for a new purpose. Use for a purpose other than the original purpose or a directly related one generally requires prescribed consent, unless an applicable exemption exists. Whether existing member data can be passed to franchisees should be assessed against each intended use and the original notices. Merely updating the website’s privacy policy is not enough.

Direct marketing is subject to separate requirements. Using members’ telephone numbers or email addresses to send promotional messages requires the prescribed notification and necessary consent, as well as a free means of opting out. Providing data to another operator for its direct marketing involves additional requirements, including written consent. Joining a loyalty points scheme should not automatically be treated as agreement to receive promotions from every franchisee.

3. Turn data rules into contractual terms and system controls

The franchise agreement should include specific data-handling arrangements consistent with member-facing statements and system settings. These should cover at least the following:

• Permitted uses: Specify which membership services the data may support, and prohibit unauthorised marketing lists or transfers to other businesses.
• Access management: Set viewing, editing and export permissions by job role, and promptly revoke or adjust them when staff leave or change roles.
• Security measures: Use individual accounts, appropriate authentication and activity logs, rather than a shared password for the entire outlet.
• Outsourced processing: Specify the system provider’s security measures, retention periods, deletion procedures and subcontracting arrangements. Outsourcing does not relieve a data user of responsibility.
• Costs and accountability: Clarify who carries out and pays for system maintenance, data checks and incident investigations. Broad disclaimers are no substitute for proper safeguards.

Operating procedures should explain what staff must do in practice. For example, when a customer requests access to their data, a designated person should first verify their identity and record the date of receipt, then forward the request to the responsible team. This helps avoid identity card photographs or membership screenshots being circulated in shop staff messaging groups. Statutory data access requests generally need to be handled in accordance with the Ordinance within 40 days of receipt; internal forwarding is no excuse for delay.

4. Pilot breach response and exit arrangements

Before formally recruiting franchisees, use test data at a pilot outlet to check whether staff can see records they do not need for their work, whether list exports are logged, and whether login access can be revoked immediately when the relationship ends. Verify that the system can deliver before committing to these safeguards in franchise documents.

Data incident procedures should cover situations such as membership lists sent to the wrong recipient, compromised accounts, lost devices and improper downloads. Specify internal reporting deadlines, record preservation and restrictions on further access. Identify who will co-ordinate the investigation and assess whether to notify the Office of the Privacy Commissioner for Personal Data or affected individuals. Do not present internally agreed reporting deadlines as statutory requirements in Hong Kong, and do not wait for disputes over responsibility to be resolved before taking protective action.

When a franchise relationship ends, arrange for access to be revoked and data that is no longer needed to be returned or deleted. Address backups, copies held by contractors and confirmation of deletion. If some records must be retained to meet legal requirements, restrict their use and access rather than allowing the departing outlet to continue using them for marketing. The allocation of responsibilities between head office and franchisees must not diminish customers’ statutory rights.

Practical takeaway: Start by mapping member data flows, then check each flow against the collection statement, franchise agreement and system permissions. Only when all three align should a membership scheme for company-owned shops be extended to franchisees.