How to Plan Your KVKK Responsibilities Before Franchising

The customer records system you use in your existing business begins to serve a different legal relationship when your first franchise opens. Although head office may technically be able to view all records, this does not mean that access to every piece of data is necessary or lawful. Before expanding your franchise network, you need to establish who will process personal data, for what purposes and within what limits. This preparation involves more than simply drafting a confidentiality clause.

1. Start by mapping data flows and identifying each party’s role

The first step is to map personal data flows in your existing business. Review your point-of-sale software, online booking system, loyalty programme, staff management tools and technical support tools separately. For each tool, record the data collected, its purpose, who can access it and the service providers to which it is sent.

Your worksheet should answer the following questions:

• Who does the record relate to: a customer, an employee or another individual?
• Who initially collects the data, and why?
• Which fields can head office see, and does it genuinely need all of them?
• Where is the record stored, and is it transferred to another country?
• What happens to the record when its purpose has been fulfilled?

Distinguish between the data controller and the data processor based on how things work in practice, not the labels used in the contract. The party that determines the purposes and means of processing personal data is the data controller. A party that processes data on the controller’s behalf and under its authority may be a data processor. Neither the franchisee’s status as an independent business nor head office’s ownership of the software determines, on its own, the parties’ roles across all processing activities.

For example, a franchisee may manage its own employees’ personnel records and procedures, while head office determines the purposes of a shared loyalty programme. The same party may take on different roles in different processes. Avoid trying to describe the entire relationship through a single role definition.

2. Establish the correct legal framework in Türkiye

Türkiye has no dedicated franchise law governing franchise relationships exclusively. Nor is there a general public registration requirement specifically for granting franchises or a standardised mandatory pre-contractual disclosure regime. However, duties to provide accurate information arising from the principle of good faith still apply. The absence of specific regulation does not mean unlimited legal freedom.

Depending on the nature of the relationship, the relevant legislation includes the Turkish Code of Obligations No. 6098, the Turkish Commercial Code No. 6102, the Law on the Protection of Competition No. 4054 and the Industrial Property Law No. 6769. For personal data processing, the principal legislation is the Personal Data Protection Law No. 6698 (KVKK).

Identify the appropriate legal basis for each processing activity. Explicit consent is not a blanket permission that automatically makes all processing lawful. Whether other grounds, such as the conclusion or performance of a contract, apply must be assessed in relation to the specific activity and the individual concerned. The agreement between head office and the franchisee is not, by itself, sufficient justification for sharing customer data.

Privacy notices must also reflect actual practice. They should explain the identity of the data controller, the purposes of processing, the recipients of transfers, the method and legal basis of collection, and individuals’ rights. Registration with VERBİS, Türkiye’s Data Controllers’ Registry, is not franchise registration: the applicable obligations and exemptions must be assessed separately for each business.

3. Minimise sharing and restrict software access

Head office does not always need customer names, telephone numbers or employee details to monitor business performance. Define the purpose of each report first, then select the smallest dataset that meets that purpose. If daily sales totals are sufficient, do not request customer-level records. Also check that aggregated reports do not allow individuals to be re-identified.

Set up role-based access in the software. Franchisees should only see the records necessary for their own businesses, while head office staff should have access limited to their duties. Use individual accounts rather than shared logins. Define account deactivation procedures for staff departures, role changes and the end of technical support access.

When choosing a cloud service, do not simply ask where the server is located. Investigate remote access from abroad, backup locations and subcontracted service providers as well. If data is transferred abroad, an appropriate mechanism must be identified under the KVKK’s transfer provisions. Do not rely solely on a software provider’s generic claim of “KVKK compliance”.

Set retention criteria for each category of records. Rather than applying one retention period to all customer and employee records, assess their purposes and any statutory retention requirements. Clarify how deletion, destruction or anonymisation will also be carried out in backups and by service providers.

4. Incorporate responsibilities into a contractual schedule and pre-opening checks

Turn your data map into a practical data protection schedule attached to the franchise agreement. For each process, the schedule should set out the parties’ roles, the categories of data to be shared, the purposes, access permissions, security measures and conditions for using service providers. Its operational requirements must be consistent with the software settings.

Specify where data subject requests should be sent and how a request received by the wrong party will be redirected. Set out who must notify whom if a data breach is suspected, how records will be preserved and who will lead the assessment. Internal notification arrangements between the parties do not replace statutory notification obligations.

Before opening, run tests using sample records rather than real customer data. Can the franchisee see another business’s records? Can head office access unnecessary fields? Does a deactivated user account still work? Can the responsible person be reached when testing data subject request and breach scenarios?

Practical takeaway: Complete your data flow map, process-specific responsibilities schedule and access testing before opening your first franchise. Do not put the system into use until any unresolved data-sharing issues have been addressed with legal and information security specialists.