Protecting customer data when franchising in Mexico

When franchising a business in Mexico, sharing a brand does not mean you can freely share customer data. Bookings, orders, loyalty programmes and service records may pass between separate companies. Before adding a new outlet to your franchise network, establish who makes decisions about that data, what it is used for and what safeguards must accompany it.

1. Identify what data will pass between companies

Start with a simple map of how information flows. It is not enough to note that every outlet will use the same system: you need to know who collects the data, where it is stored and who can view or download it.

Review every customer touchpoint:

• Bookings and orders: names, telephone numbers, addresses and purchase histories.
• Invoicing: tax details and channels for delivering invoices and receipts.
• Loyalty schemes and promotions: preferences, relevant dates and applicable permissions.
• Specialist services: information that could include sensitive personal data, such as health information.

For each process, record its purpose, the company carrying it out, the recipients and the planned retention period. Also distinguish personal data from aggregated reports that do not allow individuals to be identified.

The key question is what information the franchisor actually needs. To compare sales across outlets, totals by product and time of day may be enough. Routinely receiving names and telephone numbers increases exposure without necessarily improving management.

2. Define responsibilities under Mexican law

Mexico specifically regulates franchising through the Federal Law for the Protection of Industrial Property (Ley Federal de Protección a la Propiedad Industrial, or LFPPI). Article 246 requires a written contract and sets out minimum content, including criteria and procedures for information provision and supervision. That requirement does not, in itself, authorise unrestricted access to customer data.

The processing of personal data by private businesses is also subject to the Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares). Requirements include data processing principles, privacy notices, security measures and the rights of access, rectification, cancellation and objection, known in Mexico as ARCO rights.

Define roles according to what actually happens:

• The controller (responsable) decides how personal data is processed.
• The processor (encargado) processes data on the controller’s behalf and in accordance with its instructions.

A franchisor does not automatically become a processor simply by providing a platform. If it decides to use the information for its own campaigns, its responsibilities, purposes and legal basis for that activity need to be assessed separately.

Nor does every exchange between franchisor and franchisee receive the same legal treatment. Seek specialist advice to determine whether an arrangement constitutes a data transfer or processing on another party’s behalf, and which conditions apply. Do not assume that the original outlet’s privacy notice covers every company that subsequently operates under the brand.

3. Document permitted uses and specific access rights

Prepare a data processing schedule aligned with the franchise agreement and the technology platform’s documentation. Its purpose is to turn legal responsibilities into practical instructions, not to replace privacy notices or obligations towards customers.

Include, at a minimum:

• Authorised purposes: fulfilling orders, managing bookings or administering a loyalty programme, as applicable.
• Role-based permissions: who can view, amend, export or delete information.
• Restricted uses: for example, downloading customer lists for businesses outside the franchise.
• Technology providers: who appoints them, what access they will have and how their obligations will be managed.
• Retention and deletion: criteria for retaining information to meet applicable obligations and deleting it when it is no longer needed.
• Handling requests: the contact channel and people responsible for handling ARCO rights requests.

Avoid trying to settle the issue with a phrase such as “the database belongs to the brand”. That statement does not remove individuals’ rights or, on its own, determine who may use their data.

4. Test safeguards before sharing real information

Run a test with fictitious data before giving the first outlet access. Confirm that a reception account cannot download the entire database and that one outlet cannot see another’s customers without a defined need and justification.

Use individual accounts, limited permissions and a procedure for revoking access when someone changes role or leaves the company. Also check what happens to downloaded copies and devices used for work.

Establish an incident response procedure: who to notify internally, how to contain unauthorised access and how to document what happened. The law provides for notifying individuals of breaches that significantly affect their economic or non-material rights; the response must assess whether that threshold is met, rather than simply repair the system.

In practice: before franchising, have a data map, an allocation of responsibilities and an access test in place. Sharing technology should help the network operate, not make every customer record available to everyone.