The Consumer Data Right is the name of a legislative, regulatory, and standards framework for consumer data portability in Australia. This framework has been created and introduced by the Australian Government, which is implementing the framework on a sector-by-sector basis.
Background In May 2017, the Productivity Commission released a report 'Data Availability and Use'Productivity Commission 2017, Data Availability and Use, Report No. 82, Canberra that recommended, among other things, a new 'Comprehensive Right' for consumers. This proposed new right would allow consumers to access and correct data about themselves held by product or service providers. It would also allow a consumer to have a machine-readable copy of their consumer data provided either to them or directly to a nominated third party, such as a new service provider.
In November 2017, the Australian Government announced plans to legislate a national 'Consumer Data Right', which would allow customers open access to their banking, energy, phone and internet transactions data.
Legislation In 2019, the Australian Parliament passed the 'Treasury Laws Amendment (Consumer Data Right) Bill 2019' to create the Consumer Data Right (CDR); the bill inserted a new part (Part IVD - Consumer Data Right) into the Competition and Consumer Act 2010,Sullivan, C. (2022). The new Australian Consumer Data Right: An exemplary model for Open Banking. WIREs Forensic Science, 4( 5), e1458. https://doi.org/10.1002/wfs2.1458, page 3 and amended the Australian Information Commissioner Act 2010 and Privacy Act 1988.Julie McKay and Jamie Leach(2022), The Australian Consumer Data Right: The Promise of Open Data, Chapter 10, Jeng, Linda (ed.), Open Banking (New York, 2022; online edn, Oxford Academic, 24 Mar. 2022), https://doi.org/10.1093/oso/9780197582879.001.0001, page 201
The CDR legislationThe Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 5. provides individuals and businesses (consumers) with a right to efficiently and conveniently access specified data in relation to them held by businesses (data holders). authorises secure access to this data by trusted and accredited third parties (accredited data recipients). requires businesses (data holders) to provide public access to information on specified products they have on offer.
The CDR legislation establishes a framework to enable the CDR to be applied to various sectors of the economy over time.The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 17.
Action-initiation reform (2024) In August 2024, the Parliament of Australia passed the 'Treasury Laws Amendment (Consumer Data Right) Act 2024', introducing a major reform to the Consumer Data Right (CDR) regime. The reform aimed to expand the CDR beyond its original “read-only” data sharing model by enabling consumers to securely instruct accredited third parties to initiate actions—referred to as "action initiation" or "write access"—such as making payments, switching providers, opening or closing accounts, or updating personal details.
The legislation created two new accreditation categories: the Accredited Action Initiator (AAI), authorised to submit consumers’ instructions, and the Action Service Provider (ASP), authorised to execute those instructions as part of their usual business activities. This marked a shift in the CDR’s scope from data portability to enabling consumer-directed transactions. For instance, FinTech Australia — representing hundreds of fintech businesses — submitted that action initiation could support payments, updating contact details, and product switching to improve consumer outcomes. Likewise, accredited fintech providers such as WeMoney have discussed the potential for action initiation to support streamlined product switching and automated financial management services within the CDR framework. The specific action types to be supported, and their technical implementation, will be determined through ministerial declarations, updates to the CDR Rules, and Data Standards. Where applicable, commencement dates for each action type will be set through subsequent legislative instruments and staged rollouts. Designation The CDR legislation gives the Minister (responsible for the CDR) powers to designate a sector for which the CDR will apply.The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 11. The Minister designates a sector through a legislative instrument. In the instrument, the Minister designates a sector by specifying:The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 12.
classes of information (designated data) businesses (data holders) who hold one or more of those classes of information
The Minister, in the instrument, may also designate a ‘gateway’, or multiple ‘gateways’ to facilitate the transfer of data between a data holder and accredited data recipient or the consumer;The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 20 a gateway typically would be an Australian Government entity, or a body within the effective control of the Australian Government or an Australian state or territory government.The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 20-21
The table below summarizes designations made so far: SectorInstrumentDateBankingF2019L011534 September 2019EnergyF2020L0083326 June 2020TelecommunicationsF2022L0006824 January 2022 Non-bank lendersF2022L0152221 November 2022 The designation instrument itself does not impose data sharing obligations.Elizabeth Kelly (2022), Statutory Review of the Consumer Data Right, The Australian Government (the Treasury), page 15. The requirement to disclose particular data emanates from the CDR rules, which provide the framework for how the CDR operates in a particular sector.
CDR rules The CDR rules are a legislative instrument made (by the Minister) under section 56BA of the Competition and Consumer Act 2010.Parliament of Commonwealth of Australia, Competition and Consumer (Consumer Data Right) Rules 2020, Compilation No. 7 The rules cover all aspects of the CDR framework including: Product data requests Consumer data requests made by eligible CDR consumers Consumer data requests made by accredited persons Accreditation Dispute resolution Privacy safeguards Data standards
The rules are applied universally across all sectors of the economy to the extent possible. The rules are being progressively updated as the CDR evolves and expands. The current version of the rules are available from here.
Consumer Data Standards How CDR participants (data holders, accredited data recipients and gateways) comply with the requirements of the CDR rules are set out in a set of technical specifications called 'Consumer Data Standards'.
The Consumer Data Standards are specifications for how information technology solutions must be implemented to ensure safe, efficient, convenient and interoperable systems to share data.The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 7. The data standards are binding if required by CDR rules;The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 48. however, the standards are not a legislative instrument, in themselves.
The data standards are made by a Data Standards Chair (on the advice of a Data Standard Body). The Data Standards Chair, who is a person appointed by the Minister, makes the data standards in accordance with the sectoral designations and the CDR rules.the Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 47.
The data standards must be published on the internet and be freely available; the current data standards are available from here. To adapt to changing demands for functionality and available technology solutions, the data standards are living documents subject to continual change.
Governance The governance of the CDR framework is shared across:
Minister (responsible for the CDR) Australian Treasury Australian Competition and Consumer Commission (ACCC) Data Standards Chair and Body Office of the Australian Information Commissioner (OAIC)
The Minister, as well as having the power to designate sectors (for which the CDR will apply), has the power to make CDR rules; up until February 2021, the ACCC was the agency responsible for making CDR rules.Elizabeth Kelly (2022), Statutory Review of the Consumer Data Right, The Australian Government (the Treasury), page 87
The Australian Treasury, in addition to providing the Minister with policy advice regarding the CDR and its future directions, is also responsible for consulting for, and advising the Minister on sector designations, and developing the CDR rules; up until February 2021, these responsibilities were performed by the ACCC.
The ACCC is responsible for regulation of the CDR framework, including compliance and enforcement of the rules and standards. It is also responsible for accreditation of CDR participants (holders, recipients, etc);The Parliament of the Commonwealth of Australia (2019), Treasury Law Amendment (Consumer Data Right) Bill 2019, EXPLANATORY MEMORANDUM, page 11. the ACCC, among other things, maintains a register of accredited CDR participants called the Consumer Data Right Register. The ACCC can also grant exemptions from provisions of the CDR rules (as part of its enforcement responsibilities); it maintains a separate public register for granted exemptions.
The role of the Data Standards Body is currently undertaken by the Australian Treasury; until February 2021, Data61 (CSIRO) performed the role of the Data Standards Body.
The OAIC oversees matters relating to the protection of consumer privacy and confidentiality, and compliance with the CDR Privacy Safeguards. The OAIC can also investigate a consumer complaint about how a CDR participant has handled the consumer's data; the OAIC may refer complaints to relevant external dispute resolution bodies or the ACCC.
Implementation
The Australian government has been implementing ('rolling out') the CDR on a sector-by-sector basis. The CDR was first implemented in the banking sector, following that sector's designation in September 2019; though, prior to the sector's designation, work on the CDR rules and Consumer Data Standards for banking had already begun, and major banks in Australia had already made selected data for their products publicly available.
The foundational CDR rules commenced in February 2020, and the CDR was formally launched in July 2020, when selected consumer data sharing obligations for four major Australian banks became mandatory. Other banks and bank data have been progressively included in a phased manner over the years since the CDR launch.Australian Government, CDR website, The majority of Australian banking consumers are now able to share their data through the CDR framework;Elizabeth Kelly (2022), Statutory Review of the Consumer Data Right, The Australian Government (the Treasury), page 15. in the banking industry, this data sharing often goes under the moniker 'Open Banking'.Podder, S. (2021). Australian open banking: the regulatory dilemma of balancing different policy objectives. Australian Journal of Competition and Consumer Law, 29(1), 15-28.