Competition and Consumer (Consumer Data Right) Rules 2020 4.20E: Rule 4.20E: representatives ask for consent with active selection, express agreement and the required information

When asking for a consent, the representative must provide active selection or agreement for data types, specific uses, period and disclosure recipients, seek express consent for each category, separate data subject to a fee, allow the deletion election, and not pre-select direct marketing or de-identification consents. It must give its name; that it is a CDR representative and its principal will collect the data at its request; its country if not in Australia; the principal's name and accreditation number; how the collection, use or disclosure meets the data minimisation principle; for insight consents, what the insight reveals; for direct marketing, how data may be used or disclosed; fee amounts and consequences; the rule 4.20L de-identification information; a link to the principal's CDR policy; details of any direct or indirect OSPs of the representative or principal (name, accreditation number, overseas country, policy links, why they need the data); that more information is in the principal's policy; that consent may be withdrawn at any time; and the rule 4.20N redundant data statement, deletion right and how to elect. The itemised OSP information applies from 12 November 2025 (rule 505).