In brief
- Regulation: GDPR.
- Network heads, franchisees, branches and partners sharing customer data are all concerned.
- Map data flows.
- Clarifying roles.
- Formalising joint liability.
- Fines of up to €20M or 4% of global turnover.
Regulatory deadlines
The key dates of this regulation.
May 2018
Entry into application
In forceWhat does GDPR cover?
When several parties jointly determine the purposes and means of processing (shared CRM, network loyalty programme), they are joint controllers and must formalise an arrangement allocating their respective obligations and the exercise of individuals' rights. Processing activities specific to a single point of sale make that entity a separate controller.
Data flows within the network must be secured and documented.
Is the 'Brands & Retail Chains' sector concerned?
Network heads, franchisees, branches and partners sharing customer data are all in scope. Shared service providers (CRM, loyalty programmes) are processors.
Global brands additionally manage international data transfers.
Detailed obligations
Map data flows
Map data flows between the head network and points of sale.
Clarify roles
Qualify controller, joint controller, and processor for each processing activity.
Formalising joint responsibility
Draft the agreement distributing obligations and rights management.
Harmonise
Standardising information, consent and retention periods across the network.
Frame transfers
Secure international transfers through appropriate safeguards.
Sanctions & risks
Fines of up to €20M or 4% of global turnover. An informal joint liability exposes the entire network.
Common mistakes in the sector
- 1Undefined roles. Leaving the head-of-network/franchisee split undefined.
- 2Missing Agreement. Failing to formalise joint controllership.
- 3Heterogeneous information. Inconsistent practices across points of sale.
- 4Ungoverned transfers. Transferring outside the EU without safeguards.
Practical case
A retail brand was sharing a common CRM without a joint controllership agreement or consistent data subject information. Remediation formalises the agreement, clarifies roles, harmonises information and consent, and governs transfers to the parent company abroad.
Compliance roadmap
- 1
Map. Mapping network flows.
- 2
Qualify. Define roles.
- 3
Formalise. Joint controllership agreement.
- 4
Harmonise. Information and consent.
- 5
Transfers. Governing international transfers.
Frequently asked questions
Yes for processing activities where the network head and points of sale decide jointly.
Take action on GDPR
Free assessment or a chat with an expert dedicated to brands & trade names.
They already trust us
See how organisations in the brands & trade names sector secured their compliance with DCO.