Franchising in Portugal: preparing your customer data

When turning an existing business into a franchise network, you should not treat the customer database as a file that automatically comes with the brand. Bookings, purchases, contact details and preferences may be shared between independent businesses, but each use needs an appropriate purpose and lawful basis. Planning this sharing before the first outlet opens helps prevent excessive access, inappropriate campaigns and disputes over responsibilities.

1. Map the data before choosing a platform

Start with the actual customer journey: how customers discover the business, book an appointment, make a purchase, complain and receive follow-up communications. At each stage, identify the data collected, the business receiving it and the systems where it is stored.

Create a simple table with these columns:

• Data: names, contact details, purchase histories or other information that is genuinely necessary.
• Purpose: fulfilling a booking, issuing an invoice, handling a complaint or sending advertising.
• Parties involved: company-owned outlet, franchisee, franchisor and technology providers.
• Access: who can view, change, export or delete information.
• Retention: the applicable period or the criteria used to determine it.

Separate what is necessary to serve customers from what would merely be commercially useful. An outlet may need to view its own bookings without accessing purchases made across the entire network.

Also review your existing customer database. Collecting data to provide services through the original business does not, in itself, justify passing contact details to future franchisees for their own campaigns. Avoid migrating everything first and discussing permissions later.

2. Assign responsibilities based on what happens in practice

Portugal has no specific franchising law or dedicated mandatory pre-contractual disclosure regime for this business model. Applicable legislation includes the Civil Code, with its requirements for good faith in negotiations and contract performance, rules on standard contract terms and competition law.

For personal data, the central framework is the General Data Protection Regulation (GDPR), supplemented in Portugal by Law No. 58/2019. For electronic marketing communications, you should also consider Law No. 41/2004, as amended. The European Code of Ethics for Franchising is a self-regulatory reference, not legislation that replaces these obligations.

The allocation of responsibilities depends on who determines the purposes and means of processing:

• Independent controllers: each business determines its own processing activities, as may be the case when invoicing its own customers.
• Joint controllers: two businesses jointly determine the purposes and means of processing; they must put in place the arrangement required by Article 26 of the GDPR.
• Controller and processor: one entity processes data on behalf of another, following documented instructions; Article 28 applies.

A franchisee does not become a processor simply because it uses the application chosen by the franchisor. Equally, providing a tool does not automatically make the franchisor the controller for every processing activity. Assess each operation separately, with legal advice where needed.

3. Turn decisions into rules that can be checked

The franchise agreement and specific data protection arrangements should be consistent. A phrase such as ‘the customers belong to the brand’ does not settle who can process their data or restrict individuals’ rights.

Set out in writing the purposes of data sharing, the categories of data, the recipients, authorised access and retention and deletion procedures. Also establish who receives requests for access, rectification or erasure, and how they forward them without delay.

Prepare clear privacy information for each collection point. Customers should understand which business is serving them, what it uses their data for and who it may share that data with. Do not present all the businesses as a single entity if they are legally independent.

For campaigns, distinguish messages needed to deliver the service from advertising. Do not make marketing consent an unnecessary condition of purchase. For electronic communications, check when prior consent is required and when the statutory exception for existing customers may apply; do not assume that this exception extends across the whole network.

Also require individual authentication, role-based permissions and a procedure for removing access when an employee changes roles or leaves.

4. Test requests and incidents before opening

Before making the system available to the first franchisee, simulate specific situations: one customer asks to access their data; another opts out of advertising; an employee exports contact details by mistake. Check who detects, makes decisions about, responds to and documents each event.

In the event of a personal data breach, the controller must assess whether it is required to notify Portugal’s data protection authority, the Comissão Nacional de Proteção de Dados. Where required, notification must take place, where feasible, within 72 hours of becoming aware of the breach. The processor must inform the controller without undue delay. Some cases also require the affected individuals to be informed.

Practical conclusion: before franchising, approve a data map, a responsibility matrix and a documented response test. The network will be better prepared when everyone involved knows exactly what information they can use and how they must protect it.