What are the responsibilities of a Budget licensee regarding Payment Card Industry (PCI) compliance, including third-party compliance and data breach notification?
Budget Franchise · 2025 FDDAnswer from 2025 FDD Document
Licensee is familiar with the Payment Card Industry Data Security Standards which are currently in effect ("PCI Standards") and Licensee agrees to undertake any necessary steps to be or remain in full compliance with all applicable PCI Standards.
Further, Licensee is solely responsible for the compliance of any and all third parties (including but not limited to Internet and Host Service Providers) that are given access by Licensee, to Budget customer data.
Licensee is also responsible for promptly notifying Budget of any data security compromise and to fully cooperate and assist in any subsequent investigation.
Source: Item 23 — RECEIPTS (FDD pages 80–426)
What This Means (2025 FDD)
According to Budget's 2025 Franchise Disclosure Document, a licensee must be familiar with and fully compliant with the Payment Card Industry Data Security Standards (PCI Standards). This means the franchisee needs to take all necessary actions to meet these standards.
Budget licensees are also responsible for ensuring that any third parties who have access to Budget customer data, such as Internet and Host Service Providers, also comply with PCI Standards. Therefore, franchisees must carefully vet and monitor their third-party vendors to maintain data security.
Furthermore, Budget requires its licensees to promptly notify them of any data security compromise and to fully cooperate and assist in any subsequent investigation. Failing to adhere to these standards can result in a material breach of the Rental System Agreement and License Agreement, making the licensee responsible for any resulting damage or expenses incurred by Budget. Non-compliance can also lead to suspension from network access until the issues are resolved to Budget's satisfaction. If such failures occur more than twice in a year, Budget may permanently suspend the licensee's internet connection to the system, potentially requiring dedicated connection procedures at the licensee's expense.