Rules and ethics
Part of Franchise opportunities rules and ethics in England
Who controls franchise prospect data, and how to document the lead sharing
Map how franchise prospect and customer data moves in England, assign controller roles, document lead sharing, and build workable privacy controls.
A franchise network can pass personal information through several hands before a local outlet opens. The right starting point is a data-flow map for the real process, not a sentence saying that all parties comply with UK GDPR. ICO guidance applies across the UK; this guide focuses on an operation in England and was checked on 5 September 2026.
What to take away
- Map prospect recruitment and end-customer operations as separate journeys with distinct data flows.
- Assign controller, processor or joint controller roles based on who actually decides purposes and means.
- Show who will receive a lead and what follows before collecting personal information.
- Use the completed data map to choose the right contract or data-sharing arrangement.
- Test the process with one fictional record to find practical gaps before a real person does.
Draw two journeys, not one database box
Map prospect recruitment separately from end-customer operations. For a prospective franchisee, include directory enquiries, webinar registrations, broker notes, financial qualification and rejected applications. For customers, trace bookings, purchases, loyalty accounts, complaints and local marketing.
Prospect and customer data journeys
- Directory enquiries, webinar registrations, broker notes
- Financial qualification and rejected applications
- Bookings, purchases, loyalty accounts, complaints
- Local marketing and end-customer operations
- Record fields, purpose, sender, recipient, system
- Retention period and deletion or suppression route
At every transfer, write down the data fields, purpose, sending entity, recipient, system, retention period and deletion or suppression route. This often reveals that the brand, franchisee and platform make different decisions for different uses of the same person's details.
Assign roles from decisions
The ICO's detailed controller and processor guidance says a controller decides the purposes and means of processing, while a processor acts for a controller. Joint controllers make relevant decisions together. An organisation may also hold different roles for separate activities.
Assign controller or processor roles
Who chose to collect the information?
controller for that activity
processor acting for a controller
Use conduct questions. Who chose to collect the information, who decides why it is used, which people are targeted, and how long records remain? Can a supplier reuse it for its own purpose, and do the brand and operator jointly design a campaign?
Record the answer for each activity, because writing "processor" in the franchise agreement cannot change the factual arrangement.
Make lead collection intelligible
The ICO's page on collecting information and generating leads warns that personal information found in public sources is not automatically free to reuse for marketing. It also covers fairness, transparency, matching and profiling.
For an opportunity-enquiry form, show who will receive the lead and what follows. Ask only for information needed at that stage. A mobile form requesting detailed financial or family information before explaining the recipient deserves challenge. If a broker sends data to several brands, the notice and actual routing should agree.
Build controls around the purpose
Recruitment follow-up, cross-selling and local promotions may be direct marketing. The ICO's current direct marketing guidance was updated on 28 April 2026 to reflect Data (Use and Access) Act changes.
It covers lawful planning, fair collection and preferences, while channel-specific electronic marketing rules may matter. Obtain advice on the proposed audience and message, rather than copying a consent box from another campaign.
Create operational controls for:
- recording the lawful basis and purpose for each use;
- issuing privacy information at the right collection point;
- passing objections to every active marketing list;
- handling access, correction and deletion requests across network systems;
- restricting staff permissions and former-user access;
- setting retention periods for unsuccessful prospects and dormant customers;
- responding to incidents with clear notification lines.
Put agreements behind the map
The ICO's accountability and governance guide says a controller using a processor needs a written contract with required terms. It also discusses records of processing and evidence such as consent and breach records.
Use the completed map to choose the right agreement. Processor terms should cover instructions, security, assistance, sub-processors, deletion and audit information. Separate controllers may need a data-sharing arrangement addressing purpose, transparency and rights handling. Joint decision-making needs its own allocation. A generic franchise clause that grants broad database access is not enough.
Finally, test the process with one fictional record. Follow an objection and an access request through every recipient. Any team unable to locate, suppress and explain that record has found a practical gap before a real person does.
Before you act
- Draw separate data-flow maps for prospect recruitment and customer operations.
- Record data fields, purpose, sender, recipient, system, retention and deletion route at each transfer.
- Assign roles from decisions, not from labels in the franchise agreement.
- Make lead collection intelligible by showing recipients and what follows.
- Build controls for lawful basis, privacy information, objections, rights and retention.
- Test the process with one fictional record through every recipient.
Common questions
How do I decide whether the brand or the franchisee is the controller?
Use questions based on conduct: who chose to collect the information, who decides why it is used, which people are targeted and how long records remain. Record the answer for each activity. Merely writing processor in the franchise agreement cannot change the factual arrangement.
What should a lead collection form tell prospects?
Show who will receive the lead and what follows. Ask only for information needed at that stage. A mobile form requesting detailed financial or family information before explaining the recipient deserves challenge. If a broker sends data to several brands, the notice and actual routing should agree.
What agreements do we need after mapping the data flows?
Use the completed map to choose the right agreement. Processor terms should cover instructions, security, assistance, sub-processors, deletion and audit information. Separate controllers may need a data-sharing arrangement addressing purpose, transparency and rights handling. Joint decision-making needs its own allocation. A generic franchise clause granting broad database access is not enough.
