Privacy obligations for accredited data recipients under the Consumer Data Right

The privacy obligations that come with CDR accreditation

If your business is accredited to receive consumer data under Australia's Consumer Data Right (CDR), you take on a set of statutory privacy obligations that sit on top of your usual compliance load. The CDR, in Part IVD of the Competition and Consumer Act 2010 (Cth), lets consumers share data about themselves held by businesses such as banks and energy retailers, called data holders, with accredited third parties. Those third parties are accredited data recipients (ADRs). The scheme's purpose is to give consumers more control over their data and make it easier for them to compare and switch products and services, which in turn is meant to sharpen competition.

The privacy side of that bargain is a set of 13 Privacy Safeguards in Division 5 of Part IVD of the Competition and Consumer Act 2010 (Cth). They cover much the same ground as the Australian Privacy Principles in the Privacy Act 1988 (Cth), adapted to CDR data, and they carry their own penalties. A breach of a privacy safeguard is a civil penalty provision, and for a body corporate the maximum penalty is the greater of $10 million, three times the value of the benefit obtained from the breach, or 10% of adjusted turnover. Your accreditation can also be suspended or revoked. This article sets out who these obligations apply to, what each of the main safeguards requires, and what you should do to stay compliant.

Who must comply and what brings you into the CDR

You are an accredited data recipient if you are an accredited person holding CDR data that was disclosed to you under the consumer data rules, and you are not the data holder for that data (s 56AK). In practical terms, the obligations attach once your business is accredited to receive CDR data, and some attach even earlier: Privacy Safeguard 1 applies to an accredited person who is, or who may become, an accredited data recipient, so the transparency duties start from the moment you hold accreditation rather than the moment data actually arrives.

Accreditation is granted by the CDR Accreditor, a role performed by the Australian Competition and Consumer Commission (ACCC) unless the Minister appoints someone else (s 56CG). The system operates at different accreditation levels that correspond to different risks, and the ACCC can attach conditions to accreditation and suspend or revoke it (s 56BH). The Office of the Australian Information Commissioner (OAIC) is the privacy regulator for the regime. It approves the form of CDR policies, conducts assessments of how participants handle CDR data, and is the authorised applicant for civil penalties.

You can self-assess whether this applies to your business:

Your sector: The CDR is live in banking and energy, and is scheduled to extend to non-bank lenders from mid-2026, with the telecommunications expansion paused (see the CDR rollout timeline). If you operate in a designated sector, you may be a data holder, an ADR, or both.
Your activity: You are within scope if you are accredited and receive consumer data under the rules, or if you are an accredited person who may become an ADR.
Your data handling: The safeguards govern how you collect, use, disclose, store and delete CDR data, so they bite on every part of your data operations, not just your marketing.

Privacy Safeguard 1: open and transparent management of CDR data

Under s 56ED, your business must manage CDR data openly and transparently. That means taking reasonable steps to implement practices, procedures and systems that ensure you comply with the regime and can deal with consumer inquiries and complaints. It also means maintaining a CDR policy. The policy must be in a form approved by the Information Commissioner, and it must be a document distinct from your privacy policy (rule 7.2 of the Competition and Consumer (Consumer Data Right) Rules 2020).

For an accredited person, the CDR policy must cover:

the classes of CDR data you hold or may hold, and how it is held;
the purposes for which you may collect, hold, use or disclose CDR data with consumer consent;
how a consumer can access their CDR data and seek its correction;
how a consumer can complain about a failure to comply, and how you will deal with the complaint;
whether you are likely to disclose CDR data to accredited persons based overseas, and if so, which countries;
the circumstances in which you may disclose CDR data to someone who is not accredited;
the events about which you will notify consumers; and
the circumstances in which you must delete or de-identify CDR data on a consumer's request.

The policy must be made available free of charge, and you must give a copy to any consumer who asks (s 56ED(7) and (8)). It must also state the consequences for a consumer if they withdraw their consent to collect and use CDR data (rule 7.2(4)).

Privacy Safeguard 2: anonymity and pseudonymity

Under s 56EE, you must give each CDR consumer the option of not identifying themselves, or of using a pseudonym, when they deal with you in relation to their CDR data. The option can be offered through a designated gateway, and the consumer data rules specify the circumstances in which the obligation does not apply. The practical effect is that you should not design services that force identification where the consumer is only checking what data you hold about them.

The collection rules are the heart of the regime. Under s 56EF, you must not seek to collect CDR data from a CDR participant unless the consumer has validly requested the collection under the consumer data rules and you comply with the other requirements for collection. In plain terms, the consumer's consent drives everything: you can only collect data the consumer has agreed to share, for a purpose they have agreed to, and you should only collect what you need to provide the product or service in question. The CDR Rules set out how consent must be sought, including that consent requests must be reasonably easy to understand, use plain and concise language, and comply with the data standards (rule 4.20D).

A consumer can amend or withdraw their consent. If they do, you must stop collecting and using data on that basis, and your CDR policy must tell them what the consequences of withdrawal will be.

Privacy Safeguard 4: unsolicited CDR data

If CDR data arrives at your business without you having sought it, s 56EG requires you to destroy it as soon as practicable after collecting it, unless you are required to retain it under an Australian law or a court or tribunal order. There is no scope to keep unsolicited data in the hope it becomes useful later.

Privacy Safeguards 6 and 7: use, disclosure and direct marketing

Privacy Safeguard 6 restricts what you can do with CDR data once you have it. An ADR must not use or disclose CDR data unless the use or disclosure is required or authorised under the consumer data rules, which in practice ties use and disclosure back to the purposes the consumer consented to. Privacy Safeguard 10 adds a notification duty: if you disclose CDR data, you must take the steps the rules specify to notify the consumers concerned (s 56EM).

Privacy Safeguard 7 deals with direct marketing. Under s 56EJ, you must not use or disclose CDR data for direct marketing unless the use or disclosure is authorised under the rules in accordance with a valid consent from the consumer, or the disclosure is required under the rules in response to a valid consumer request. There is no general permission to market to consumers because the data happens to be in your hands, so treat direct marketing as off-limits unless you hold consent that specifically covers it.

Privacy Safeguard 8 places restrictions on disclosing CDR data to recipients outside Australia, and Privacy Safeguard 9 stops you adopting government related identifiers, such as tax file numbers, as your own identifiers for consumers (s 56EK and s 56EL).

Privacy Safeguard 12: security, destruction and deletion

Under s 56EO, you must take the steps specified in the consumer data rules to protect CDR data from misuse, interference and loss, and from unauthorised access, modification or disclosure. Schedule 2 of the CDR Rules sets out the specific security steps. The rules also require you to have processes for deleting redundant data and for handling a consumer's request to have their CDR data deleted: s 56BAA requires the rules to include a deletion-on-request obligation, and rule 1.18 sets out the CDR data deletion process you must follow.

You must also destroy or de-identify CDR data you no longer need, once it is redundant for the purposes the rules permit, unless you are required to retain it by law or it relates to current or anticipated legal or dispute resolution proceedings (s 56EO(2)).

Privacy Safeguards 11 and 13: quality, access and correction

CDR data you disclose must be accurate, up to date and complete, having regard to the purpose for which it is held (s 56EN). If you become aware that data you disclosed was incorrect, you must tell the consumer and, if they ask or the rules require it, correct the data and pass the corrected version to the earlier recipient. Consumers can also ask you to correct CDR data you hold, and you must respond by correcting the data or attaching a statement to it so it is accurate and not misleading (s 56EP). Access and correction work through the mechanisms your CDR policy must describe, so the policy and your day-to-day response processes need to line up.

What happens if you breach a privacy safeguard

The Privacy Safeguards are civil penalty provisions enforceable under the Regulatory Powers (Standard Provisions) Act 2014 (Cth) (s 56EU). The Information Commissioner is the authorised applicant, so the OAIC can take you to court for a pecuniary penalty. The maximum penalty for a body corporate is the greater of $10 million, three times the value of the benefit reasonably attributable to the breach, or 10% of your adjusted turnover, and for an individual it is $500,000 (s 56EV).

Beyond penalties, the OAIC can conduct an assessment of how you are maintaining and handling CDR data to check that you comply with the safeguards (s 56ER). The ACCC, as the CDR Accreditor, can suspend or revoke your accreditation, and it monitors compliance with and enforces the CDR legislation, rules and standards generally. Losing accreditation means you can no longer receive CDR data, which for many businesses would be the end of the product they built around the regime.

A compliance checklist for accredited data recipients

Working through the Privacy Safeguards in practice, your compliance programme should cover the following:

Know your status: Confirm whether you are accredited, and at what level, and what your accreditation authorises you to do.
Stand up the CDR policy: Have it in the Information Commissioner-approved form, distinct from your privacy policy, covering every required item, and make it available free of charge.
Build consent into your systems: Only collect data after a valid consumer request, record the scope of each consent, and handle amendments and withdrawals properly.
Destroy unsolicited data: Have a process for identifying and destroying unsolicited CDR data promptly.
Check your marketing: Do not use CDR data for direct marketing without a consent that covers it.
Secure and delete: Implement the security steps in Schedule 2 of the CDR Rules, follow the rule 1.18 deletion process, and destroy or de-identify redundant data.
Handle access, correction and complaints: Have a process for responding to access and correction requests and for dealing with complaints about your compliance.
Keep the regulators in mind: The OAIC can assess your handling of CDR data at any time, so documentation matters.

When to get legal help

Accreditation and the Privacy Safeguards are a specialised area, and the OAIC's CDR Privacy Safeguard Guidelines run to hundreds of pages. A privacy lawyer can help you prepare the accreditation application, including the evidence you need to show you can meet the safeguards, and can draft or review your CDR policy against the Information Commissioner's requirements. They can also review your consent flows, data security arrangements and direct marketing practices, and help you respond if the OAIC or the ACCC starts an assessment, investigation or enforcement action. Given the size of the penalties, having someone who knows the regime review your setup before a problem arises is usually far cheaper than responding to one.

Start with the CDR policy before you apply for accreditation

If you are weighing up CDR accreditation, the work to start now is the CDR policy. Privacy Safeguard 1 applies from the moment you are an accredited person who may become an accredited data recipient, not from the first time data arrives, and the policy is the document the OAIC will reach for first if it assesses your business. It must be in a form the Information Commissioner has approved and kept separate from your privacy policy, so it is not something you can retrofit overnight. Treat the policy, the consent framework and the deletion process as the price of entry: get the CDR policy drafted and approved before you submit your accreditation application, and your business starts the regime on the right side of its privacy obligations.