Customer data in franchising: allocate GDPR responsibilities before launch

When your existing business becomes a franchise network, the way you handle customer data changes. A database previously used within one company may need to be accessed by several independent businesses. Before the first franchisee gains access to bookings, purchase histories or contact details, you need to decide who may do what — and why. Sharing a brand does not automatically give you the right to share personal data.

1. Map the data before choosing a system

Start with the customer journey, not the system supplier’s features. For example, trace a booking from the website through to the local unit, payment and any follow-up. Record which personal data is collected, which businesses have access to it and what each business uses it for.

Create a simple working checklist with the following columns:

• Situation: for example, a booking, delivery or membership.
• Data: for example, names, contact details and purchase histories.
• Purpose: the specific reason for processing the data.
• Recipients: the businesses or suppliers that receive the data.
• Storage: where the data is held and when it must be deleted.

Distinguish between data needed to fulfil the customer’s order and data you want to use for other purposes. Central analysis, local offers and a shared loyalty programme do not necessarily constitute the same processing activity.

Also consider whether the franchisor actually needs identifiable customer data. For some monitoring and reporting, aggregated data that cannot identify customers may be sufficient. This reduces both risk and the need to access local customer databases.

2. Determine the GDPR role for each processing activity

The EU’s General Data Protection Regulation, GDPR, also applies within a franchise network. In Sweden, it is supplemented by legislation including Act (2018:218) containing supplementary provisions to the EU General Data Protection Regulation. Each party’s role depends on how processing is organised in practice, not simply on the labels used in the franchise agreement.

The party that determines the purposes and essential means of processing is the data controller. A data processor, by contrast, processes data on the controller’s behalf and in accordance with its instructions.

For example, a franchisee may be the data controller for its own customer administration. If the franchisor handles that data solely on the franchisee’s documented instructions, the franchisor may be a processor for that particular activity. However, providing the system is not, in itself, enough to determine the franchisor’s role.

If the parties jointly determine the purposes and means of processing, they may be joint controllers. This requires an arrangement allocating their obligations under GDPR. If the parties are independent controllers, any disclosure of data between them must also have a lawful basis.

Assess each processing activity, rather than assigning one role to each business. The same business may have different roles for bookings, support and a loyalty programme. Also document the lawful basis and the information customers must receive. Consent is not a universal solution for sharing customer data.

3. Clarify responsibilities and system requirements before signing

Sweden has specific franchise legislation: Act (2006:484) on the Duty of Franchisors to Provide Information. It requires franchisors to provide clear, understandable written information about the agreement’s implications and other relevant circumstances in good time before it is signed. Sweden does not, however, have a comprehensive franchise law that replaces areas such as contract law or data protection rules.

If the franchisee must buy or rent a particular customer management system, this is relevant to the Act’s disclosure requirements for mandatory goods and services. System fees and other financial terms must also be described clearly. This information does not replace GDPR documentation.

Next, prepare the documents required for the roles you have identified. A controller–processor relationship requires a data processing agreement under GDPR. Joint controllership requires a different type of arrangement; do not use the same standard template for both situations.

Document the practical details too: who responds to a customer’s request for access or erasure, who contacts the system supplier and who assesses a personal data breach? Decide how data will be handled when the relationship ends. A contractual clause stating that someone ‘owns the customer database’ does not determine which processing activities are permitted under GDPR.

4. Test access permissions and customer-related procedures before opening

Run a test using fictitious customer data before connecting the first franchise unit. Check that local users can only see the data they need for their work. Also test central support accounts and how access is revoked when someone leaves.

Practise handling three situations:

• A customer requests access to their personal data.
• A message containing customer data is sent to the wrong recipient.
• A franchisee leaves the network and their system access needs to be terminated.

Follow each case from discovery through to documented closure. Is there a designated person responsible, a clear point of contact and enough information to act within the applicable deadlines? Also check that the supplier’s procedures support your decisions on security and deletion.

Practical takeaway: Do not give the first franchisee access to the customer management system until data flows, GDPR roles, necessary agreements and access permissions have been documented and tested. This gives the franchise network a more secure start and makes it clearer to customers who is responsible and whom they should contact.