Australia Consumer Data Right - Banking (CDR)GDPR

Australia Consumer Data Right - Banking (CDR) covers 35% of GDPR

14 of the 40 controls in GDPR are already satisfied by evidence you collected for Australia Consumer Data Right - Banking (CDR). 26 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

35%

of the target already covered

controls evidenced

genuine gaps

claims rejected in review

This number is directional. It says how much of GDPR your Australia Consumer Data Right - Banking (CDR) evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

33 candidate mappings were examined and 0 were removed. Signed off 2026-08-20, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

Chapter III - Rights of the Data Subject5 of 11 evidenced, 6 to do

Chapter II - Principles3 of 7 evidenced, 4 to do

Chapter V - Transfers of Personal Data2 of 6 evidenced, 4 to do

Chapter IV - Controller and Processor4 of 16 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

AUCDR-PS-1GDPR-Art.12argued against and upheld

Transparent information, communication and modalities for rights

Data managed openly and transparently under a clearly expressed current policy.

AUCDR-PS-5GDPR-Art.13argued against and upheld

Information to be provided where personal data are collected

Consumer notified of collection through the dashboard and a CDR receipt.

AUCDR-PS-13GDPR-Art.16argued against and upheld

Right to rectification

Correction on request or where data is found inaccurate or incomplete.

AUCDR-PS-12GDPR-Art.17argued against and upheld

Right to erasure (right to be forgotten)

Redundant data must be destroyed or de-identified once no longer needed.

AUCDR-PS-4GDPR-Art.17argued against and upheld

Right to erasure (right to be forgotten)

Data that could not lawfully have been collected must be destroyed or de-identified.

AUCDR-PS-7GDPR-Art.21argued against and upheld

Right to object

Direct marketing use of the data is barred except where expressly permitted.

AUCDR-IS-STEP1GDPR-Art.24argued against and upheld

Responsibility of the controller

Formal governance framework with documented senior management responsibilities, reviewed annually.

AUCDR-PS-1GDPR-Art.24argued against and upheld

Responsibility of the controller

Open and transparent management resting on a maintained published policy.

Claims that did not hold

Nothing proposed for this pair was rejected in review. That is unusual and worth knowing rather than hiding: it means the candidate set was small and every candidate held.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk