Google Business Profile Governance for Restaurant Groups: 8 Controls for 2026

TL;DR: Keep primary ownership of the profile estate inside the restaurant group. Give every user an individual account, use business groups to set access boundaries, grant agencies only the access their work requires, and require an approved change record for every unit edit, transfer, and offboarding.

Ask Schmitdy to audit your multi-location AI search setup.

By Marco Lobo
Last updated: September 25, 2026

A profile can be accurate today and still have weak governance. The problem surfaces when a former employee remains an owner, an agency controls the only primary account, or a corporate edit changes every unit before operations has checked it.

Google supplies roles, business groups, and ownership transfers. The operator must decide who holds control, how access is approved, and what evidence closes a change. The following eight controls make that work repeatable.

What should the ownership model look like?

The restaurant company should control primary ownership. An employee using a company-managed Google Account should hold it, with at least one additional company owner to preserve operational access. Avoid placing the primary role with an agency, a general manager's personal account, or a shared marketing login. Only the current primary owner can transfer that role; if unavailable, follow Google's applicable ownership-request or support process.

Google allows multiple owners but only one primary owner for an individual profile and for a business group. Owners can manage users. Managers can complete much of the daily profile work, but they cannot add or remove users or remove the profile. Ownership should follow company accountability, while operational access follows the job.

Google directs each user to access profiles through an individual Google Account instead of sharing a password. List each grant in the profile register. A shared login hides who changed a unit and makes a clean exit harder.

Control 1: company-held primary ownership. Record the company role, the account holding primary ownership, and the additional company owner.

Control 2: two company owners. Maintain a second authorized owner for day-to-day management if one account is unavailable; this does not itself transfer primary ownership.

How should business groups divide a multi-unit estate?

A business group is a shared container for profiles. Google recommends the structure when several people need to manage a set of businesses. A group owner or manager can access every current and future profile placed inside that group, so the boundary needs care.

One business group per brand works when the same corporate team manages every unit. Use separate groups when brands, regions, or operating partners require different access. Creating a group for each restaurant adds ownership records, invitations, and bulk files without always improving control.

Ask one clear question: should this user be able to edit every profile in this group? If not, make the boundary smaller or grant profile-level access to the location involved. Google allows individual owners and managers to be added to profiles that sit inside a business group.

On a phone, swipe sideways to read every column.

Control 3: business groups match actual access boundaries. Keep a one-page estate map showing profiles, groups, and responsible teams.

Which permissions should employees and agencies receive?

Give a user the lowest role that completes the approved task. This is access governance, not a claim about Google rankings. OWASP recommends least privilege, and the UK's Cyber Essentials standard asks organizations to control who can reach data and services and what level of access they receive.

A general manager who updates special hours for one unit does not need ownership of the entire brand. A corporate marketing lead may need group manager access. Only the small set of people responsible for users and ownership transfers need owner rights.

Registered agencies can work through an organization, user groups, and business groups. For one profile, its owner can invite a business group in the agency organization; for a client-owned business group, its owner can invite the agency organization. This gives the partner a defined working route without moving the asset out of company control.

Record these five fields for every grant:

1. named employee or agency organization;
2. profile or business group covered;
3. role granted;
4. business reason and approver;
5. review or removal date.

Control 4: individual accounts only. Do not share passwords across corporate teams, units, or agencies.

Control 5: least access for the job. Review group-wide access before granting it and choose profile-level access when the work covers one unit.

How should a new restaurant enter the system?

Open a change record before anyone creates or claims a profile. Include the real-world business name, confirmed address, opening status, brand, destination business group, location page, and responsible operator. Google's representation guidelines require accurate information and state that a business should not create more than one profile for each location.

Run the onboarding in this order:

1. Search Google Search and Maps for an existing profile.
2. If another party owns it, use Google's ownership request process instead of creating a duplicate.
3. Confirm the company business group that will receive it.
4. Add company owners before external users.
5. Verify the business through the Google route offered.
6. Add the restaurant manager or agency at the approved role.
7. Read back the public name, address, phone, hours, website, and map pin.
8. Save the approver, date, and public check in the change record.

Companies with ten or more eligible locations of the same business can assess Google's bulk verification route. Bulk eligibility does not replace an ownership model, and only an owner or authorized representative should verify the business.

What change control should apply to each unit?

Run changes to the name, address, primary category, phone, website, hours, opening status, or reservation destination through a location record. It can be concise, but it needs an accountable owner and a checked result.

On a phone, swipe sideways to read every column.

For a move, rebrand, closure, or operator change, check the current Google rule before editing. Do not answer uncertainty by making another profile. Google's removal guidance separates profile removal from marking a business permanently closed. Removing content also does not guarantee the location disappears from Search or Maps.

The website requires a separate check. Google's LocalBusiness documentation supports fields such as address and opening hours. That markup describes the website page. It does not transfer ownership or correct the Business Profile. Keep the visible location page, its structured data, and the profile consistent.

Control 6: one approved change record. A unit edit remains open until someone reads the public result and records any exception.

How should the group offboard an agency?

Begin before the contract end date. A newly added owner or manager of an individual Business Profile faces a seven-day wait before using some ownership features, including certain removals and primary ownership changes. A final-day handover can therefore leave a gap.

Follow this sequence:

1. Inventory every business group, individual profile, agency organization, and pending invitation.
2. Confirm the company primary owner and second owner can sign in.
3. Transfer primary ownership if the agency or departing user holds it.
4. Wait through any applicable seven-day limit and test company control.
5. Capture open edits, verification cases, and support references.
6. Remove the agency organization, user group, or named users from the agreed scope.
7. Recheck People and access for every group and separately shared profile.
8. Read back the core public fields for each unit and record the result.

Never remove a profile just to remove an agency. Profile content, user access, closure status, and contract termination are separate decisions.

Control 7: joiner, mover, and leaver procedure. CIS Control 6 calls for a process to create, assign, manage, and revoke access. Apply that process to each employee move and agency change.

What should you do when ownership is already wrong?

When another party owns a verified profile, submit Google's ownership request. The current owner has three days to respond. After no response, Google says the business may receive an option to claim and verify the profile, though that option is not always available.

If the current owner cooperates, the primary owner can transfer the role to an existing owner or manager. Account for the seven-day restrictions that apply to newly added users.

Keep an incident record with the profile, users shown, request date, Google emails, response deadline, and next step. Correct hours do not resolve a control failure. Fix the ownership path as its own issue.

How often should access be reviewed?

Run an estate review every quarter and after any hire, role change, departure, agency appointment, or opening. NIST, CIS, the ICO, and OWASP frame access control as an ongoing management process. The NCSC's Cyber Essentials guidance separately includes user access control as a basic control; the quarterly cadence here is an operating recommendation.

Review these questions:

• Is every profile in the intended business group?
• Does a company-managed account hold primary ownership?
• Is there a second company owner?
• Does every user still require the access displayed?
• Are pending invitations still valid?
• Do agency permissions match the current agreement?
• Did each material unit change receive a public readback?

Control 8: quarterly access and location review. End the review with named actions, owners, and dates.

How should results be reported?

Keep four outcomes distinct:

• Answer appearance: the restaurant appeared in a recorded search or AI answer.
• Traffic: analytics recorded a visit to a location page.
• Inquiry: the business identified a submitted call, form, or message.
• Confirmed reservation: the reservation platform or restaurant team confirmed a booking.

Profile governance protects access and location facts. It does not prove that an edit caused a visit, that a visit caused an inquiry, or that an inquiry became a reservation. Label unknown attribution as unknown.

Sources

1. Google Business Profile Help, Create & manage business groups
2. Google Business Profile Help, Manage business group owners & managers
3. Google Business Profile Help, Manage your Business Profile owners & managers
4. Google Business Profile Help, Transfer primary ownership of a Business Profile
5. Google Business Profile Help, Request ownership of a Business Profile
6. Google Business Profile Help, Register your agency for Business Profiles
7. Google Business Profile Help, Manage agency invites
8. Google Business Profile Help, Guidelines for representing your business on Google
9. Google Search Central, Local Business structured data
10. Google Business Profile Help, Verify Business Profiles in bulk
11. Google Business Profile Help, Remove a Business Profile from your Google Account
12. NIST, SP 800-53 Rev. 5
13. Center for Internet Security, CIS Critical Security Control 6
14. Information Commissioner's Office, A guide to data security
15. OWASP, Authorization Cheat Sheet
16. UK National Cyber Security Centre, Cyber Essentials