Australia Consumer Data Right - Banking (CDR)

Australia

v2020 (ongoing expansion)

3 domains

28 controls

The Australian Consumer Data Right (CDR) for banking, mandated under the Competition and Consumer Act 2010 (amended by the Treasury Laws Amendment), gives consumers the right to share their banking data with accredited third parties. Administered by the ACCC (accreditation), OAIC (privacy), and Data Standards Body (technical standards). Effective July 2020, covering transaction accounts, credit cards, and lending products. Expanding to energy and telecommunications sectors.

Verified

Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.

Visit legislation.gov.au

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (3)

CDR Rules Obligations

9 controls

Accreditation, consent, transparency, deletion, records and reporting obligations under the CDR Rules.

Controls in the CDR Rules Obligations domain of Australia Consumer Data Right - Banking (CDR) — 9 controls
Code	Title	Description
AUCDR-OB-1	Accreditation as an accredited data recipient	Obtain and maintain accreditation, meeting the fit-and-proper, information security and other accreditation criteria bef...
AUCDR-OB-2	Consent requirements	Obtain valid, informed consent for collection, use and disclosure, give the consumer the recipient's name and accreditat...
AUCDR-OB-3	Data minimisation	Only collect and use the CDR data required to provide the requested product or service.
AUCDR-OB-4	CDR policy publication	Maintain a CDR policy that consumers can easily understand and access, covering how data is managed and how to make an e...
AUCDR-OB-5	Deletion or de-identification of redundant data	Inform consumers of their right to have redundant data deleted and delete or de-identify redundant CDR data accordingly.
AUCDR-OB-6	Records of CDR data	Maintain the records required by CDR Rule 9.3(2), including consents, withdrawals, complaints, deletions, use of data, d...
AUCDR-OB-7	Reporting to ACCC and OAIC	Submit reports twice a year to the ACCC and OAIC (per CDR Rule 9.4) and provide a confirmation statement and verificatio...
AUCDR-OB-8	Complaints handling	Maintain processes to receive and handle CDR consumer complaints and record complaint data.
AUCDR-OB-9	Outsourced service provider and representative arrangements	Govern CDR outsourced service provider (OSP), sponsor, affiliate and CDR representative arrangements, including contract...

Information Security (Schedule 2)

6 controls

The minimum information security controls for accredited data recipients (CDR Rules Schedule 2).

Controls in the Information Security (Schedule 2) domain of Australia Consumer Data Right - Banking (CDR) — 6 controls
Code	Title	Description
AUCDR-IS-1	Limit risk of unauthorised access to the CDR data environment	Have processes to limit the risk of inappropriate or unauthorised access to the CDR data environment, including MFA or e...
AUCDR-IS-2	Secure the network and systems within the data environment	Take steps to secure the network and systems within the data environment, including encryption, firewalls, server harden...
AUCDR-IS-3	Securely manage information assets over their lifecycle	Securely manage information assets within the CDR data environment over their lifecycle, including data loss prevention,...
AUCDR-IS-4	Formal vulnerability management program	Implement a formal vulnerability management program to identify, track and remediate vulnerabilities in the CDR data env...
AUCDR-IS-5	Limit, prevent, detect and remove malware	Take steps to limit, prevent, detect and remove malware in the CDR data environment, including anti-malware/antivirus, w...
AUCDR-IS-6	Information security training and awareness program	Implement a formal information security training and awareness program for all personnel interacting with CDR data, incl...

Privacy Safeguards

13 controls

The 13 CDR Privacy Safeguards (Part IVD, Competition and Consumer Act 2010).

Controls in the Privacy Safeguards domain of Australia Consumer Data Right - Banking (CDR) — 13 controls
Code	Title	Description
AUCDR-PS-1	Privacy Safeguard 1 - Open and transparent management of CDR data	Manage CDR data in an open and transparent way, including having a clearly expressed and up-to-date CDR policy.
AUCDR-PS-10	Privacy Safeguard 10 - Notifying of the disclosure of CDR data	Notify the consumer of disclosures of CDR data, including via the consumer dashboard.
AUCDR-PS-11	Privacy Safeguard 11 - Quality of CDR data	Take reasonable steps to ensure CDR data is accurate, up to date and complete having regard to the purpose.
AUCDR-PS-12	Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data	Protect CDR data from misuse, interference, loss and unauthorised access, and destroy or de-identify redundant CDR data.
AUCDR-PS-13	Privacy Safeguard 13 - Correction of CDR data	Correct CDR data on request or when satisfied it is inaccurate, out of date, incomplete, irrelevant or misleading.
AUCDR-PS-2	Privacy Safeguard 2 - Anonymity and pseudonymity	Give individuals the option of not identifying themselves, or of using a pseudonym, where lawful and practicable.
AUCDR-PS-3	Privacy Safeguard 3 - Seeking to collect CDR data from CDR participants	Only seek to collect CDR data with valid consent and in accordance with the CDR Rules.
AUCDR-PS-4	Privacy Safeguard 4 - Dealing with unsolicited CDR data	Where unsolicited CDR data is received, determine whether it could have been collected and, if not, destroy or de-identi...
AUCDR-PS-5	Privacy Safeguard 5 - Notifying of the collection of CDR data	Notify the consumer of the collection of CDR data, including via the consumer dashboard and a CDR receipt.
AUCDR-PS-6	Privacy Safeguard 6 - Use or disclosure of CDR data	Only use or disclose CDR data in accordance with consent and the CDR Rules.
AUCDR-PS-7	Privacy Safeguard 7 - Use or disclosure of CDR data for direct marketing	Do not use or disclose CDR data for direct marketing except as permitted by the CDR Rules.
AUCDR-PS-8	Privacy Safeguard 8 - Overseas disclosure of CDR data	Before disclosing CDR data overseas, take reasonable steps to ensure the overseas recipient complies with the safeguards...
AUCDR-PS-9	Privacy Safeguard 9 - Adoption or disclosure of government related identifiers	Do not adopt, use or disclose a government related identifier as the individual's own identifier except as permitted.

Your Compliance Coverage

If you comply with Australia Consumer Data Right - Banking (CDR), you already cover:

Australian Privacy Principles (APPs)

64%

18 controls mapped

Compare →

APRA CPS 234

25%

7 controls mapped

Compare →

GDPR

25%

7 controls mapped

Compare →

+ 4 more: NIST SP 800-53 Rev 5 (21%), NIST Cybersecurity Framework 2.0 (21%)

See all 7 mapped frameworks ↓

Maps to 7 other frameworks

28 total controls

Australian Privacy Principles (APPs)

18 source controls mapped|13 target controls covered

64%

APRA CPS 234

7 source controls mapped|7 target controls covered

25%

GDPR

7 source controls mapped|8 target controls covered

25%

NIST SP 800-53 Rev 5

6 source controls mapped|11 target controls covered

21%

NIST Cybersecurity Framework 2.0

6 source controls mapped|8 target controls covered

21%

Brazil Open Finance (Resolução Conjunta No. 1/2020)

4 source controls mapped|5 target controls covered

14%

ACSC Essential Eight

3 source controls mapped|5 target controls covered

11%

Compare Australia Consumer Data Right - Banking (CDR) with Australian Privacy Principles (APPs)

Frequently Asked Questions

What is Australia Consumer Data Right - Banking (CDR)?

Australia Consumer Data Right - Banking (CDR) is a compliance framework from Australia with 3 domains and 28 controls. The Australian Consumer Data Right (CDR) for banking, mandated under the Competition and Consumer Act 2010 (amended by the Treasury Laws Amendment), gives consumers the right to share their banking data with accredited third parties. Administered by the ACCC (accreditation), OAIC (privacy), and Data Standards Body (technical standards). Effective July 2020, covering transaction accounts, credit cards, and lending products. Expanding to energy and telecommunications sectors. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Australia Consumer Data Right - Banking (CDR) have?

Australia Consumer Data Right - Banking (CDR) has 28 controls organised across 3 domains. The largest domains are Privacy Safeguards (13 controls), CDR Rules Obligations (9 controls), Information Security (Schedule 2) (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Australia Consumer Data Right - Banking (CDR) map to?

Australia Consumer Data Right - Banking (CDR) maps to 7 other compliance frameworks. The top mapping partners are Australian Privacy Principles (APPs) (64% coverage), APRA CPS 234 (25% coverage), GDPR (25% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with Australia Consumer Data Right - Banking (CDR) compliance?

Start your Australia Consumer Data Right - Banking (CDR) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Australia Consumer Data Right - Banking (CDR) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 28 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required