Buying a franchise: check your responsibilities for personal data

When you buy a franchise, you become part of a network, but your business still has obligations of its own. This is particularly true of personal data held in booking systems, loyalty schemes and digital point-of-sale systems. A central system does not automatically mean that the franchisor takes full responsibility for data protection. Before signing, you need to understand what data your business handles, who decides how it is used and what you must be able to do yourself.

1. Map the data before assessing responsibility

Ask the franchisor to show you how personal data flows through a typical customer interaction: from booking or purchase through to payment, follow-up and any complaint. Include external suppliers and central functions. A system demonstration is often more useful than a general assurance that the network complies with data protection rules.

Draw up a simple checklist for each system:

• What personal data is collected, and why?
• Which company determines the purposes and essential means of processing?
• Which people and companies have access to the data?
• How long is the data retained, and who deletes it?
• In which countries is the data stored or made accessible?

Distinguish between different uses of the same piece of data. An email address may be needed for a booking confirmation, but that does not mean it can be freely used for every centrally run marketing campaign. Each processing activity needs a clear purpose and a lawful basis.

Also check whether other franchisees can see your customers’ data. Cooperation within the network is not, in itself, a reason to give everyone access to everything. Ask for an explanation of access permissions and how access is limited to what is necessary.

2. Check the roles under the GDPR and Swedish law

The EU’s General Data Protection Regulation, or GDPR, applies alongside Swedish legislation, including Act (2018:218), which supplements the GDPR. The Swedish Authority for Privacy Protection, IMY, is Sweden’s supervisory authority. These rules apply even where use of the system is compulsory within the franchise network.

A data controller determines the purposes and essential means of processing. A data processor processes data on the controller’s behalf and according to its instructions. If two companies jointly determine the purposes and means, they may be joint controllers.

These roles depend on how things actually work, not just the labels used in the contract. Your business may be the controller for local customer management, while the franchisor has a different role in a central loyalty scheme. Assess each processing activity separately.

Sweden also has Act (2006:484) on franchisors’ disclosure obligations. It requires the franchisor, well before the agreement is concluded, to provide clear written information about what the agreement entails and any other matters necessary in the circumstances. It does not replace the GDPR or give your business any general exemption from its data protection responsibilities. Sweden has no comprehensive franchise law governing every aspect of the relationship.

3. Request agreements that reflect how things work in practice

If the franchisor or a system provider acts as a data processor for your business, a data processing agreement is required under the GDPR. Among other things, it must address instructions, security, sub-processors, assistance with individuals’ rights and what happens to the data when the service ends.

For joint controllers, an arrangement is needed instead that transparently allocates responsibilities under the GDPR. If the companies are independent controllers, any disclosure of data between them must still have a lawful basis. A data processing agreement is therefore not a universal solution.

Before signing, request:

• relevant data protection agreements and a clear allocation of roles;
• information about suppliers and sub-processors;
• procedures for access, rectification and erasure;
• a description of security measures and breach reporting;
• documentation of any transfers outside the EU/EEA and the legal basis for them.

Review the costs too. Is assistance with subject access requests, security incidents and compliance checks included, or billed separately? Can your business obtain the logs and supporting documentation it needs without unpredictable extra charges? A central system should not make it practically impossible to meet local obligations.

4. Test the procedures with two concrete scenarios

Ask the franchisor to explain what happens if a customer requests access to their personal data. Who receives the request, checks the customer’s identity, searches the systems and responds? The GDPR normally requires a response within one month. Passing requests between companies in the network must not result in them being lost.

Next, test a personal data breach scenario, such as an employee gaining access to another outlet’s customer list. Who blocks access, preserves the evidence and assesses the risk? A processor must notify the controller without undue delay. Where the breach must be reported, the controller must notify IMY within 72 hours of becoming aware of it, where feasible.

Finally, ask an existing franchisee to describe how the procedures work day to day, without sharing customer data. Check that the written promises match the access and support actually available.

Practical takeaway: Do not simply buy access to a customer system. Make sure your business also gets the agreements, permissions and procedures it needs to meet its data protection responsibilities.