Competition and Consumer (Consumer Data Right) Rules 2020 1.10AA: Rule 1.10AA: put each CDR representative arrangement in a written contract carrying the required terms

A CDR representative arrangement is a written contract between a person with unrestricted accreditation (the CDR representative principal) and an unaccredited person (the CDR representative) under which the representative offers goods or services to CDR consumers (never in their capacity as CDR business consumers), obtains their consent under rule 4.3A, and the principal makes the consumer data request and discloses the data to the representative for it to provide the goods or services. The contract must state that these provisions do not operate until the representative's details are on the Register of Accredited Persons, and must require the representative to comply with rules expressed to apply to CDR representatives and with consumer experience data standards as if it were an accredited data recipient. It may let the representative seek the use and disclosure consents the principal could seek and make the permitted uses and disclosures in paragraphs 7.5(1)(j) and 7.5(3)(e). It must forbid the representative to enter another representative arrangement or to engage an outsourced provider except as the arrangement allows, and must require it, for service data: to comply with privacy safeguards 2, 4, 6, 7, 11 (other than subsection (1)), 12 and 13 (other than subsection (1)) as if it were the principal; to take the Schedule 2 steps; to use or disclose service data only under the contract and only for those permitted uses and disclosures; to delete service data and provide deletion records when directed, and require its own OSPs to do the same; to adopt and comply with the principal's CDR policy; and to comply with privacy safeguards 8 and 9 as if it were an accredited data recipient.