Competition and Consumer (Consumer Data Right) Rules 2020 7.2: Rule 7.2: keep a separate CDR policy with the required content and make it available

A CDR entity's CDR policy (required by subsection 56ED(3) of the Act, in any form the Information Commissioner approves) must be a document distinct from its privacy policies. A data holder's policy must also say whether it accepts requests for voluntary product or consumer data and, if so, whether it charges fees and how to find out about them. An accredited person that is or may become an accredited data recipient must add: the consequences of withdrawing consent; its sponsorship arrangements and the services each party provides; its CDR representatives and what each provides using CDR data; its direct and indirect OSPs and those of its representatives, wherever based and whether or not accredited, with the services and data each receives; any general research, with a description and any benefit to consumers; the likely countries of overseas unaccredited OSPs where practicable; how it uses de-identified non-redundant data and its de-identification techniques and disclosures; when and how it deletes redundant data and how consumers elect deletion; how it uses de-identified redundant data; and how the deletion election works (civil penalty). Both must describe their internal dispute resolution process (where, how and when to complain, acknowledgement times, information needed, handling process, stage timeframes, redress and internal and external review options) (civil penalty), and an accredited person storing CDR data outside Australia must name the countries (civil penalty). The policy must be readily available through each online service through which the entity or its representatives ordinarily deal with consumers, and given electronically or in hard copy on request as the consumer directs (civil penalty).