//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
Commonwealth legislation
This law creates the Consumer Data Right (CDR), a standardised system letting Australians access and share personal data held by businesses (banking, energy, etc.) safely — directly or via accredited third parties. It requires data holders to provide secure online access and sets strict consent, minimisation, privacy and deletion safeguards for accredited users.
By giving consumers control of their data, the CDR makes switching providers and using new data-driven services easier while imposing penalties for misuse.
Want the full deep dive?
Zoe can write the in-depth analysis on top of the summary above: how it works, who it affects and what each part actually does.
Direct links to the current provisions in Competition and Consumer (Consumer Data Right) Rules 2020.
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
This instrument is the Competition and Consumer (Consumer Data Right) Rules 2020.
This instrument is made under section 56BA of the Competition and Consumer Act 2010.
There are 3 ways to request CDR data under these rules.
Product data requests
Any person may request a data holder to disclose CDR data that relates to products offered by the data holder. Such a request is called a product data request.
A product data request is made in accordance with relevant data standards, using a specialised service provided by the data holder. Such a request cannot be made for CDR data that relates to a particular identifiable CDR consumer. The data is disclosed, in machine‑readable form, to the person who made the request. The data holder cannot impose conditions, restrictions or limitations of any kind on the use of the disclosed data.
Consumer data requests made by CDR consumers
A CDR consumer who, in accordance with a Schedule to these rules, is eligible to do so may directly request a data holder to disclose CDR data that relates to them. Such a request is called a consumer data request.
A consumer data request that is made directly to a data holder is made using a specialised online service provided by the data holder. The data is disclosed, in human‑readable form, to the CDR consumer who made the request.
Consumer data requests made on behalf of CDR consumers
A CDR consumer who, in accordance with a Schedule to these rules, is eligible to do so may request an accredited person to request a CDR participant to disclose CDR data that relates to the consumer. The request made by the accredited person is called a consumer data request.
A consumer data request that is made to a data holder on behalf of a CDR consumer by an accredited person must be made in accordance with relevant data standards, using a specialised service provided by the data holder. The data is disclosed, in machine‑readable form, to the accredited person.
Under the data minimisation principle, the accredited person may only collect, use and disclose CDR data in order to provide goods or services in accordance with a request from a CDR consumer, and may only use or disclose it for that purpose, or for a limited number of other purposes which require an additional consent from the CDR consumer.
When consumers are eligible to make requests
A consumer data request can only be made in relation to certain classes of product and consumer CDR data. These are specified in Schedules to these rules that relate to different designated sectors. The relevant Schedule will also set out:
• the circumstances in which a CDR consumer will be eligible to make or initiate a consumer data request for CDR data in that sector; and
• the CDR data that must be disclosed by the data holder in response to a valid request and the CDR data that may be, but is not required to be, disclosed by the data holder.
These rules also deal with a range of ancillary and related matters.
(1) These rules set out details of how the consumer data right works. (2) These rules should be read in conjunction with the following: (a) the Competition and Consumer Act 2010 (the Act), and in particular, Part IVD of the Act, which sets out the general framework for how the consumer data right works; (b) designation instruments made under section 56AC of the Act; (c) guidelines made by the Information Commissioner under section 56EQ of the Act; (d) data standards made under section 56FA of the Act; (e) regulations made under section 172 of the Act.
Note: These rules cover a number of different sectors of the economy. It is intended that they will be amended from time to time in the future to deal with additional sectors.
(1) Part 1 of these rules deals with preliminary matters, such as: (a) definitions of terms that are used in these rules; and (b) the usage, in these rules, of certain terms that are defined in the Act. The other provisions of these rules should be read together with these definitions and other interpretive provisions. Part 1 also deals with services that must be provided by data holders and accredited persons that allow consumers to make and manage requests for CDR data. (2) Part 2 of these rules deals with product data requests, and should be read in conjunction with the relevant sector Schedule. (3) Part 3 of these rules deals with consumer data requests that are made by CDR consumers, and should be read in conjunction with the relevant sector Schedule. Only CDR consumers who are eligible to do so may make such requests. The eligibility criteria for each sector are set out in the relevant sector Schedule. (4) Part 4 of these rules deals with consumer data requests that involve accredited persons, and should be read in conjunction with the relevant sector Schedule. (5) Part 5 of these rules deals with how persons can become accredited persons. It also deals with ancillary matters, such as revocation and suspension of accreditation, obligations of accredited persons, and the Register of Accredited Persons. The rules set out in this Part should be read in conjunction with Division 3 of Part IVD of the Act. (6) Part 6 of these rules deals with dispute resolution. (7) Part 7 of these rules deals with rules relating to the privacy safeguards. The rules set out in this Part should be read in conjunction with Division 5 of Part IVD of the Act. Part 7 also sets out some additional civil penalty provisions that protect the privacy or confidentiality of CDR consumers’ CDR data. (8) Part 8 of these rules deals with data standards. The rules set out in this Part should be read in conjunction with Division 6 of Part IVD of the Act. (9) Part 9 of these rules deals with miscellaneous matters, such as review of decisions, reporting, record keeping and audit, and civil penalty provisions of the consumer data rules. (9A) Part 50 of these rules sets out application and transitional provisions. (10) Schedule 1 to these rules deals with default conditions on accreditations. (11) Schedule 2 to these rules sets out detailed steps for privacy safeguard 12 (subsection 56EO(1) of the Act and rule 7.11 of these rules). These steps are also relevant to persons who hold CDR data (service data) under a CDR outsourcing arrangement, and are an element of the ongoing obligations of accredited persons (see paragraph 5.12(1)(a)). (12) Schedule 3 to these rules deals with the banking and non-bank lenders sectors. Schedule 3 sets out: (a) particular classes of data holder in those sectors to which these rules do not apply; and (b) the specific types of CDR data in respect of which requests under these rules may be made; and (c) the circumstances in which CDR consumers are eligible in relation to data holders in those sectors; and (d) the progressive application of these rules to those sectors. (13) Schedule 4 to these rules deals with the energy sector. Schedule 4 sets out: (a) the specific types of CDR data in respect of which requests under these rules may be made; and (b) the circumstances in which CDR consumers are eligible in relation to data holders in the energy sector; and (c) some modifications of the general rules that apply in the energy sector because certain types of data are collected or held by agencies specified in the energy sector designation instrument rather than the retailers with which the CDR consumers have accounts; and (d) the progressive application of these rules to the energy sector.
A sector Schedule may modify the operation of Parts 1 to 9 of these rules in relation to a particular designated sector or sectors and a particular matter (whether or not a provision in any of those Parts provides for the Schedule to deal with the matter).
Note: Example: A sector Schedule may provide that these rules do not apply in relation to a particular class of data holders in the designated sector or sectors.
Note: Expressions have the same meaning in this instrument as in the Competition and Consumer Act 2010 as in force from time to time—see paragraph 13(1)(b) of the Legislation Act 2003.
(1) In this instrument:
ABN has the meaning given by the A New Tax System (Australian Business Number) Act 1999.
account privileges, in relation to:
(a) an account with a data holder; and
(b) a particular designated sector;
has the meaning set out in a Schedule to these rules that relates to that sector.
accreditation applicant means a person who has applied to be an accredited person under rule 5.2.
accreditation number of an accredited person has the meaning given by rule 5.6.
accredited data recipient has a meaning affected by subrule (2).
Note: The term “accredited data recipient” is defined in the Act: see section 56AK of the Act. Subrule (2) deals with the usage of this term in these rules.
accredited person request service has the meaning given by subrule 1.13(3).
Act means the Competition and Consumer Act 2010.
addresses for service means both of the following:
(a) a physical address for service in Australia;
(b) an electronic address for service.
ADI (short for authorised deposit‑taking institution) has the meaning given by the Banking Act 1959.
affiliate has the meaning given by rule 1.10D.
AP disclosure consent has the meaning given by rule 1.10A.
associated person, of another person, means any of the following:
(a) a person who:
(i) makes or participates in making, or would (if the other person were an accredited person) make or participate in making, decisions that affect the management of CDR data by the other person; or
(ii) has, or would have (if the other person were an accredited person), the capacity to significantly affect the other person’s management of CDR data;
(b) if the other person is a body corporate—a person who:
(i) is an associate (within the meaning of the Corporations Act 2001) of the other person; or
(ii) is an associated entity (within the meaning of the Corporations Act 2001) of the other person.
authorisation to disclose CDR data means:
(a) an authorisation given by a CDR consumer under Part 4 to a data holder; or
(b) such an authorisation as amended in accordance with these rules.
business consumer disclosure consent has the meaning given by rule 1.10A.
business consumer statement has the meaning given by rule 1.10A.
category, of consents, has the meaning given by rule 1.10A.
CDR business consumer has the meaning given by rule 1.10A.
CDR complaint data, in relation to a CDR participant, means the following:
(a) the number of CDR consumer complaints received by the CDR participant;
(b) the number of such complaints for each complaint type into which the CDR participant categorises complaints in accordance with its complaints handling process;
(c) the number of such complaints resolved;
(d) the average number of days taken to resolve CDR consumer complaints through internal dispute resolution;
(e) the number of CDR consumer complaints referred to a recognised external dispute resolution scheme;
(f) the number of CDR consumer complaints resolved by external dispute resolution;
(g) in relation to a CDR participant that is a data holder―the number of CDR product data complaints received.
Note: Complaints covered by paragraph (g) are not “CDR consumer complaints”.
CDR consumer has a meaning affected by subrule (2).
Note: The term “CDR consumer” is defined in the Act: see subsection 56AI(3) of the Act. Subrule (2) deals with the usage of this term in these rules.
CDR consumer complaint means any expression of dissatisfaction made by a CDR consumer to or about a CDR participant, or a CDR representative of a CDR participant:
(a) that relates to:
(i) that person’s obligations under or compliance with:
(A) Part IVD of the Act; or
(B) these rules; or
(C) binding data standards; or
(ii) the provision to the CDR consumer, by that person, of the goods or services in respect of which the consumer granted consent under Part 4; and
(b) for which a response or resolution could reasonably be expected.
Note: Complaints of a kind referred to in sub‑subparagraph (a)(i)(B) include a complaint relating to the participant’s obligations under, or compliance with, rules dealing with the handling of CDR consumer complaints.
CDR data de‑identification process has the meaning given by rule 1.17.
CDR data deletion process has the meaning given by rule 1.18.
CDR insight, in relation to an insight disclosure consent, means the CDR data subject to the consent.
CDR logo means a logo or symbol, including one whose use requires a licence or authorisation from a person other than the Commonwealth, approved by the Commission for the purposes of this definition.
CDR outsourcing arrangement has the meaning given by rule 1.10.
CDR participant has a meaning affected by subrule (2).
Note: The term “CDR participant” is defined in the Act: see subsection 56AL(1) of the Act. Subrule (2) deals with the usage of this term in these rules.
CDR policy means a policy that a CDR participant has and maintains in compliance with subsection 56ED(3) of the Act.
CDR product data complaint means an expression of dissatisfaction made to a data holder about its required product data or its voluntary product data for which a response or resolution could reasonably be expected.
CDR representative has the meaning given by rule 1.10AA.
CDR representative arrangement has the meaning given by rule 1.10AA.
CDR representative principal has the meaning given by rule 1.10AA.
co‑approval option has the meaning given by rule 4A.5.
collection consent has the meaning given by rule 1.10A.
consent means:
(a) a collection consent, a use consent or a disclosure consent; or
(b) such a consent as amended in accordance with these rules.
consumer dashboard:
(a) in relation to an accredited person—has the meaning given by rule 1.14; and
(b) in relation to a data holder—has the meaning given by rules 1.15 and 4A.13.
consumer data request:
(a) by a CDR consumer—has the meaning given by rule 3.3; and
(b) by an accredited person on behalf of a CDR consumer—has the meaning given by rule 4.4 or rule 4.7A.
Note: The different types of consumer data request are summarised in the following table:
| A consumer data request made under: | is made by: | to: | for disclosure of CDR data to: |
|---|---|---|---|
| rule 3.3 | a CDR consumer | a data holder | the CDR consumer |
| rule 4.4 | an accredited person on behalf of a CDR consumer | a data holder | the accredited person |
| rule 4.7A | an accredited person on behalf of a CDR consumer | an accredited data recipient | the accredited person |
consumer experience data standards means data standards expressed to be consumer experience data standards.
Note: Example: The Data Standards Chair must make data standards about disclosure and security of CDR data, including consumer experience data standards for certain disclosures—see subparagraphs 8.11(1)(c)(iii) to (vi).
current:
(a) a
This is an opening excerpt, not the complete document.