Consumer Data Right (CDR) participant accreditation + compliance
Banking, energy and (soon) non-bank lending data sharing — accredited participants must comply with privacy safeguards.
Who must comply
Designated data holders + accredited data recipients in banking, energy, and (in scope) non-bank lending and telecommunications.
What triggers it
Becoming a data holder or accredited recipient.
When due
Continuous; incident notification within 30 days.
Evidence required
Accreditation, CDR Policy, Privacy Safeguard compliance documentation, incident register.
Max penalty
Civil penalties up to ~$50M / 30% turnover for serious breaches
Summary
The Consumer Data Right (Pt IVD Competition and Consumer Act) and the CDR Rules require data holders to share consumer data on request and accredited data recipients to handle CDR data under the 13 Privacy Safeguards. ACCC + OAIC jointly enforce; CDR has its own incident notification regime distinct from NDB.
Enforced by
Source legislation
Industries
Topics
Source: https://cdr.gov.au. Rules Mate is not a law firm. Always verify against the live regulator source before acting.