Personal Data in Russian Franchise Networks: Who Qualifies as Data Operator Under 152-FZ

In Russian franchise networks, customer personal data is routinely processed through a single information system: collection occurs at the franchisee outlet, storage takes place on the franchisor’s servers, and further use supports a common loyalty program and brand-wide communications.

The distribution of legal roles between the parties is rarely formalized in contracts, yet the issue becomes critical when a data subject submits a request, a regulator intervenes, or a security incident occurs.

Legal Definition of Operator

Under paragraph 2 of Article 3 of Federal Law No. 152-FZ “On Personal Data”, an operator is any person that organizes and/or carries out processing and determines the purposes, the scope of data, and the operations performed. The decisive criterion is the determination of processing purposes; this distinguishes an operator from a processor acting on another party’s instructions. Multiple operators may exist for the same dataset, and the law does not prescribe how responsibility is shared.

Processing on Behalf of an Operator

Article 6(3)–(5) of 152-FZ permits an operator to instruct another party to process data, provided the data subject has consented and a written agreement exists. The processor does not need separate consent from the subject; the instructing operator remains liable to the subject, while the processor is liable only to the operator.

Default Model: Franchisee as Operator

When a franchisee concludes a contract with a customer, receives payment, and fulfills obligations, the legal basis is Article 6(1)(5) — processing necessary for performance of a contract. The franchisee therefore determines the purpose and qualifies as operator. The franchisor supplying the IT system acts solely on the franchisee’s instructions and is a processor.

When the Franchisor Becomes an Operator

The franchisor acquires independent operator status once it pursues its own processing purposes. Typical triggers include:

• Operating a loyalty program where the franchisor is the obligated party and issues points redeemable across the network.
• Conducting advertising campaigns in its own name, requiring prior consent under the Advertising Law No. 38-FZ.
• Collecting data through a central website, mobile app, or call center when the specific franchisee is not yet identified at the moment of collection.

In the last scenario, the franchisor processes data for its own purpose of routing leads and must therefore be treated as operator at the collection stage; subsequent transfer to the chosen franchisee constitutes a transfer between two operators.

Documenting Processing Instructions

Instructions must be included in the commercial concession agreement or an annex and must explicitly list the categories of data, permitted actions, purposes, confidentiality and security obligations, data-localization requirements, and breach-notification deadlines that allow the operator to meet the 24-hour Roskomnadzor reporting window.

Liability and Practical Recommendations

Transferring data without a valid instruction constitutes processing without a legal basis and may result in fines of 150,000–300,000 RUB, rising to 300,000–500,000 RUB for repeat violations under Article 13.11 of the Code of Administrative Offenses. The operator remains liable to data subjects and should therefore secure contractual recourse against the processor.

Experts recommend mapping every processing purpose within the network, identifying the operator for each purpose, and formalizing instructions between franchisor and franchisees before operations begin.