What about distributors, dealers and franchisees?

Short answer: Yes, you are responsible for what they do with your consumers' data

When distributors, dealers or franchisees handle consumer data for your service, they act for you, and you are responsible. Give them only what they need, add a data clause to agreements, train them, and check a sample every year. If a partner uses data for its own business, such as selling insurance, that is outside your purpose and must stop.

What the law says

Section 8(1) and 8(2) cover processors.

Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.

Steps

List partner types and numbers.
Issue a standard data clause.
Give masked views where possible.
Train partners.
Check samples yearly.

Evidence to keep

Partner list
Signed clauses
Training and check records

Common mistakes

Full consumer exports to partners
No clause
No checks

From each seat

DPO / Privacy lead: Partner complaints are a leading indicator.
CMD / MD: Ask for coverage figures every quarter.
Operations head: Field teams see partner practice first.
Chief risk officer: Rate partners by data volume.
Procurement department: Put the clause in every agreement.

What a good answer from management sounds like

“All partners sign the data clause, see masked data, and a sample is checked each year.” Effort and time: Medium · 3 to 6 months for a large network.