In brief
- Applicable regulations: GDPR.
- The strength of a franchise network brand is cross-channel customer knowledge: data flows between the network head, franchisees or branches, and shared marketing tools.
- GDPR up to €20 M or 4%.
- The distinctive feature of franchise and network brands is joint liability: the flow of data between the network head and points of sale requires a clear allocation of obligations, failing which non-compliance spreads across the entire network.
Regulatory deadlines
The key dates of the regulations applicable to your sector.
May 2018
RGPDEntry into application
In forceWhy the 'Brands & retail chains' sector is concerned
A franchise network's strength lies in cross-channel customer knowledge: data flows between the network head, franchisees or branches, and shared marketing tools. This flow requires precise definition of each party's role (controller, joint controller, processor).
Joint controllership is the sensitive point: when the network head and the points of sale jointly determine the purposes and means of a processing activity (shared CRM, loyalty scheme), they must formalise a joint controllership agreement allocating their respective obligations.
Marketing personalisation generally falls under limited risk within the meaning of the AI Act, but remains governed by GDPR (profiling). Global brands must also manage international data transfers.
GDPR — cross-channel CRM and network
The network head and points of sale process shared customer data. They must clarify roles, formalise joint controllership where applicable, harmonise information notices and consent collection, and secure data flows across the network.
International transfers, common for global brands, must be properly governed.
Key obligations
- Clarifying controller / joint controller / processor.
- Joint controllership agreement for shared processing activities.
- Harmonising information and consent across the network.
- Governing international data transfers.
AI Act — cross-channel personalisation
Cross-channel personalisation and recommendation generally fall under limited risk (transparency). The main issue remains profiling within the meaning of the GDPR, which must be harmonised across the entire network.
Key obligations
- Qualify uses (personalisation = limited risk).
- Transparency on AI usage.
- Harmonisation of profiling across the network.
- Interaction with GDPR.
Comparative overview of regulations
| Regulation | Role | Flagship obligation | Max. Penalty |
|---|---|---|---|
| GDPR | Joint controller(s) | Roles + joint controllership | 20 M€ / 4 % |
| AI Act | Deployer | Transparency (limited risk) | €35 M / 7 %* |
How these regulations interact
The distinctive feature of franchise and network brands is joint liability: the flow of data between the network head and points of sale requires a clear allocation of obligations, failing which non-compliance spreads across the entire network.
Personalisation AI remains, here, an essentially GDPR matter (profiling), with the AI Act limited to transparency. Compliance consistency across the entire network is the real challenge.
Application timeline
- 1GDPR. In force; network consistency challenge.
- 2AI Act. Progressive transparency for personalisation.
Applicable penalties
GDPR up to €20M or 4%. A poorly formalised joint liability exposes the entire network; a failing at one point of sale can rebound on the brand.
Compliance roadmap
- 1Map data flows. Map the flow of data across the network.
- 2Clarify roles. Define controller, joint controller, and processor.
- 3Formalising joint responsibility. Drafting the agreement allocating obligations.
- 4Harmonise. Standardise information, consent and profiling.
- 5Frame transfers. Secure international transfers.
How Data Comply One supports the sector
Data Comply One covers GDPR and the AI Act on a single platform, with an outsourced DPO, and supports network heads on joint controllership and compliance consistency across all points of sale.
DCO offers tailored templates (joint controllership agreement, harmonised information notices, transfer governance frameworks).
Frequently asked questions
When several actors jointly determine the purposes and means of processing, they are joint controllers and must formalise the allocation of their obligations.
Detailed guides by regulation
Where does your compliance stand?
Take stock in a few minutes or talk to an expert dedicated to your sector.
They already trust us
See how organisations in the brands & trade names sector secured their compliance with DCO.