A franchise network handles a lot of personal data: customer bookings and enquiries, staff records, franchisee applications and, increasingly, shared systems that hold all of it in one place. Because the brand is shared but each franchise is usually a separate business, franchise GDPR compliance raises a question that a single company never has to answer: who is responsible for which data? Getting that answer right, and writing it into the franchise documents, is the core of data protection in franchising.
Note that the Information Commissioner’s Office (ICO) says parts of its guidance are under review following the Data (Use and Access) Act 2025, which came into law on 19 June 2025. Check the current ICO guidance and take advice before relying on any detail.
Controller, joint controller or processor
UK GDPR assigns responsibility according to role. The ICO explains the terms as follows:
- A controller determines the purposes and means of processing personal data, alone or jointly with others. Controllers are responsible for complying with UK GDPR and must be able to demonstrate compliance.
- Joint controllers decide the purposes and means of processing together, for the same or shared purposes. Controllers processing the same data for different purposes are not joint controllers.
- A processor processes personal data on behalf of a controller and should act only on the controller’s instructions. A processor that starts deciding the purposes and means of processing for itself becomes a controller for that processing, with the same liability.
In a franchise these roles depend on how the network actually works, not on labels in the agreement. Franchise law firm Phillips Solicitors lists identifying the data controller in a franchise model, and structuring controller and processor relationships between franchisor and franchisees, as the first thing it advises franchisors on.
| Typical arrangement | Questions to ask | Roles to consider |
|---|---|---|
| Each franchisee runs its own customer records and decides how to use them | Does the franchisee decide why and how customer data is used? | Franchisee as controller of its own customer data |
| Franchisor runs a central booking system or CRM that franchisees use | Who decides what is collected and how it is used? Does the franchisor use the data for its own purposes too? | Joint controllers, or franchisor as controller with franchisees acting under its instructions, depending on the facts |
| Franchisor generates leads nationally and passes them to franchisees | Are the purposes shared or separate once the lead is passed on? | Possibly separate controllers for different stages |
| A software or marketing supplier holds data for the network | Does the supplier only follow instructions? | Supplier as processor, with a written contract |
| Franchisee recruitment applications | Who decides how applicant data is used? | Usually the franchisor as controller |
Points that often cause confusion
Three details from the ICO’s guidance are worth knowing in a franchise context. First, a controller can be an individual as well as a company: the ICO gives sole traders and partners in unincorporated partnerships as examples, so a franchisee trading as a sole trader is still responsible for the data it controls. Second, employees acting within their duties are not processors; they act as part of their employer. Third, a processor may want to subcontract work to another processor, often called a sub-processor, which the contract needs to deal with. Franchise software suppliers commonly rely on hosting and other sub-processors, so ask them for a list.
Put it in writing
Once roles are clear, they need to be documented. Where one party processes data for another, UK GDPR requires a written contract. The ICO’s guidance on contracts between controllers and processors lists minimum terms, including processing only on the controller’s documented instructions, a duty of confidence, appropriate security measures, rules on using sub-processors, help with data subjects’ rights, end-of-contract provisions, and audits and inspections.
For a franchise, this usually means data protection clauses in the franchise agreement, a data processing agreement where a party acts as processor, and data sharing provisions where data moves between independent controllers. Phillips Solicitors lists drafting data processing agreements and data sharing provisions, and creating privacy policies for franchise systems, among its franchisor services. You can find other firms under franchise agreement solicitors.
Practical steps for franchisors
Map the data
List what personal data the network handles, where it is stored, who can see it and which systems move it between head office and franchisees. Central software makes this easier to see but also concentrates the risk.
Set common procedures
Phillips Solicitors highlights data handling protocols and training requirements, managing customer data rights across multiple locations, and incident response procedures for breaches as areas franchisors need to cover. A customer who asks a franchisee for their data, or to have it deleted, should get the same answer wherever they ask.
Plan for breaches
The ICO says that where a personal data breach must be reported, organisations are legally required to report within 72 hours, providing what information they have and updating later if needed. The ICO also publishes a short guide for small companies and sole traders on responding in the first 72 hours, which is useful for franchisees. Decide in advance who reports a breach that affects a shared system, and how franchisees alert head office.
Check the data protection fee
The ICO states that, under the Data Protection (Charges and Information) Regulations 2018, organisations that use personal information, including sole traders, need to pay a data protection fee unless exempt. Each franchisee business should check whether it needs to pay; the ICO has a self-assessment tool.
Cover international expansion
Franchisors expanding abroad or using overseas suppliers need to consider cross-border data transfers, another area Phillips Solicitors lists in its franchise data protection services.
Practical steps for franchisees
- Read the data protection clauses in your franchise agreement and any data processing agreement before signing, and ask which role you play.
- Follow the network’s procedures for collecting, storing and deleting data, and train your staff on them.
- Know how to recognise and escalate a breach quickly, given the 72-hour reporting rule.
- Check whether your business must pay the ICO data protection fee.
Suppliers who can help
Most franchise networks need a mix of legal advice and well-configured systems. Franchise solicitors can map roles and draft the documents. Franchise CRM and intranet providers can explain how their systems separate each franchisee’s data, which matters when deciding roles. HR providers can help with staff data and training. Good data handling also supports consistent standards across the network, covered in our guide to franchise brand standards.
