Back to Frameworks
Competition and Consumer (Consumer Data Right) Rules 2020
Australia
vCompilation No. 10 (F2025C00572), compilation date 4 March 2025, incorporating the 2025 Measures No. 1 Rules; sunsets 1 April 2030
15 domains
132 controls
The Australian consumer data rules in full: what data holders, accredited data recipients, CDR representatives, sponsors and secondary data holders must do to share banking, non-bank lending and energy data at the consumer's direction, from request services, consent and authorisation flows, dashboards and joint accounts to accreditation, dispute resolution, the operational privacy rules, records, reporting and audit. Built from the authorised compilation No. 10 read in full; the Schedule 2 security steps and the thirteen privacy safeguards sit in the companion 'Australia Consumer Data Right - Banking (CDR)' framework.
Verified
Competition and Consumer (Consumer Data Right) Rules 2020 is a compliance framework from Australia with 15 domains and 132 controls that map to 3 other frameworks. The largest domains are Part 1: Preliminary, request services, dashboards, outsourcing, representatives and deletion – Competition and Consumer (Consumer Data Right) Rules 2020 (21 controls), Part 7: Rules relating to the privacy safeguards – Competition and Consumer (Consumer Data Right) Rules 2020 (18 controls), Part 4 Division 4.3: Consents given to accredited persons – Competition and Consumer (Consumer Data Right) Rules 2020 (17 controls). Every control below carries what it requires and what an assessor expects to see.
Maintained by Gerard BlokdykPublished standard
Get the official standard — this page is an AI-assisted companion tool, not a replacement for the authoritative text.
Visit legislation.gov.auFramework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (15)
Part 1: Preliminary, request services, dashboards, outsourcing, representatives and deletion – Competition and Consumer (Consumer Data Right) Rules 2020
21 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::1.10 | Rule 1.10: put each CDR outsourcing arrangement in a written contract carrying the required terms |
| competition-and-consumer-consumer-data-right-rules-2020::1.10A | Rule 1.10A: use only the defined consent types and never make insight or business-consumer disclosure consents a condition of supply |
| competition-and-consumer-consumer-data-right-rules-2020::1.10AA | Rule 1.10AA: put each CDR representative arrangement in a written contract carrying the required terms |
| competition-and-consumer-consumer-data-right-rules-2020::1.10C | Rule 1.10C: confirm trusted adviser status and never make the nomination a condition of supply |
| competition-and-consumer-consumer-data-right-rules-2020::1.10D | Rule 1.10D: document each sponsorship arrangement in a written contract |
| competition-and-consumer-consumer-data-right-rules-2020::1.12 | Rule 1.12: provide an online product data request service |
| competition-and-consumer-consumer-data-right-rules-2020::1.13 | Rule 1.13: provide the direct request, accredited person request, nominated representative and secondary user services |
| competition-and-consumer-consumer-data-right-rules-2020::1.14 | Rule 1.14: give each consumer an accredited person consumer dashboard |
| competition-and-consumer-consumer-data-right-rules-2020::1.15 | Rule 1.15: give each consumer a data holder consumer dashboard, including for account holders of secondary users |
| competition-and-consumer-consumer-data-right-rules-2020::1.16 | Rule 1.16: ensure every direct and indirect OSP complies with its outsourcing arrangement |
| competition-and-consumer-consumer-data-right-rules-2020::1.16A | Rule 1.16A: ensure each CDR representative complies with its arrangement and with Division 4.3A |
| competition-and-consumer-consumer-data-right-rules-2020::1.17 | Rule 1.17: de-identify CDR data only through the CDR data de-identification process |
| competition-and-consumer-consumer-data-right-rules-2020::1.17A | Rule 1.17A: identify and retain redundant data the Act says must not be deleted |
| competition-and-consumer-consumer-data-right-rules-2020::1.18 | Rule 1.18: delete CDR data only through the CDR data deletion process |
| competition-and-consumer-consumer-data-right-rules-2020::1.20 | Rule 1.20: secondary data holders provide an SR data request service to primary data holders |
| competition-and-consumer-consumer-data-right-rules-2020::1.22 | Rule 1.22: handle SR data requests made by consumers through the primary data holder |
| competition-and-consumer-consumer-data-right-rules-2020::1.23 | Rule 1.23: handle SR data requests made by accredited persons through the primary data holder |
| competition-and-consumer-consumer-data-right-rules-2020::1.24 | Rule 1.24: use SR data received only to answer the SR data request, then delete it |
| competition-and-consumer-consumer-data-right-rules-2020::1.25 | Rule 1.25: destroy unsolicited SR data as soon as practicable |
| competition-and-consumer-consumer-data-right-rules-2020::1.26 | Rule 1.26: secondary data holders supply information for disputes about SR data requests |
| competition-and-consumer-consumer-data-right-rules-2020::1.8 | Rule 1.8: collect, use and disclose CDR data within the data minimisation principle |
Part 2: Product data requests – Competition and Consumer (Consumer Data Right) Rules 2020
3 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::2.4 | Rule 2.4: disclose requested product data through the product data request service |
| competition-and-consumer-consumer-data-right-rules-2020::2.5 | Rule 2.5: refuse product data only on grounds in the data standards and inform the requester |
| competition-and-consumer-consumer-data-right-rules-2020::2.6 | Rule 2.6: impose no conditions on the use of disclosed product data |
Part 3: Consumer data requests made by consumers – Competition and Consumer (Consumer Data Right) Rules 2020
2 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::3.4 | Rule 3.4: disclose required consumer data to the consumer through the direct request service |
| competition-and-consumer-consumer-data-right-rules-2020::3.5 | Rule 3.5: refuse direct requests only on permitted grounds and inform the consumer |
Part 4 Division 4.2: Consumer data requests made by accredited persons – Competition and Consumer (Consumer Data Right) Rules 2020
7 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::4.3 | Rule 4.3: seek collection, use and disclosure consents only in accordance with Division 4.3 |
| competition-and-consumer-consumer-data-right-rules-2020::4.4 | Rule 4.4: make consumer data requests to data holders only within valid consents and through the accredited person request service |
| competition-and-consumer-consumer-data-right-rules-2020::4.5 | Rule 4.5: data holders ask the consumer to authorise disclosure |
| competition-and-consumer-consumer-data-right-rules-2020::4.6 | Rule 4.6: data holders disclose authorised data through the accredited person request service |
| competition-and-consumer-consumer-data-right-rules-2020::4.6A | Rule 4.6A: withhold account data where the account holder has stopped secondary user sharing or the rules forbid disclosure |
| competition-and-consumer-consumer-data-right-rules-2020::4.7 | Rule 4.7: refuse authorisation requests or disclosure only on permitted grounds and inform the accredited person |
| competition-and-consumer-consumer-data-right-rules-2020::4.7B | Rule 4.7B: accredited data recipients seek AP disclosure consents only in accordance with Division 4.3 |
Part 4 Division 4.3: Consents given to accredited persons – Competition and Consumer (Consumer Data Right) Rules 2020
17 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::4.10 | Rule 4.10: make consent requests standards-compliant, easy to understand and unbundled |
| competition-and-consumer-consumer-data-right-rules-2020::4.11 | Rule 4.11: ask for consent with active selection, express agreement and the required information |
| competition-and-consumer-consumer-data-right-rules-2020::4.12 | Rule 4.12: respect the consent period limits and the prohibited consents |
| competition-and-consumer-consumer-data-right-rules-2020::4.12B | Rule 4.12B: invite consent amendments only on the permitted grounds and at a reasonable frequency |
| competition-and-consumer-consumer-data-right-rules-2020::4.12C | Rule 4.12C: run consent amendments in the same manner as consents and give the amendment statements |
| competition-and-consumer-consumer-data-right-rules-2020::4.13 | Rule 4.13: let consumers withdraw consent at any time and give effect within 2 business days |
| competition-and-consumer-consumer-data-right-rules-2020::4.14 | Rule 4.14: treat consents as expired at the times the rule sets |
| competition-and-consumer-consumer-data-right-rules-2020::4.15 | Rule 4.15: give the additional de-identification information when seeking a de-identification consent |
| competition-and-consumer-consumer-data-right-rules-2020::4.16 | Rule 4.16: honour the consumer's election to delete redundant data |
| competition-and-consumer-consumer-data-right-rules-2020::4.17 | Rule 4.17: state the general policy on redundant data when seeking consent |
| competition-and-consumer-consumer-data-right-rules-2020::4.18 | Rule 4.18: send a CDR receipt after each consent given, amended or withdrawn |
| competition-and-consumer-consumer-data-right-rules-2020::4.18A | Rule 4.18A: tell the consumer when collection consent expires but use or disclosure continues |
| competition-and-consumer-consumer-data-right-rules-2020::4.18AA | Rule 4.18AA: tell the data holder or accredited data recipient when a collection consent expires |
| competition-and-consumer-consumer-data-right-rules-2020::4.18B | Rule 4.18B: notify the counterparty when a linked collection consent or AP disclosure consent expires |
| competition-and-consumer-consumer-data-right-rules-2020::4.18C | Rule 4.18C: tell the data holder or accredited data recipient when a collection consent is amended |
| competition-and-consumer-consumer-data-right-rules-2020::4.19 | Rule 4.19: update the consumer dashboard as soon as practicable after changes |
| competition-and-consumer-consumer-data-right-rules-2020::4.20 | Rule 4.20: remind consumers every 90 days that consents are still current |
Part 4 Division 4.3A: Consents given to CDR representatives – Competition and Consumer (Consumer Data Right) Rules 2020
17 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::4.20D | Rule 4.20D: representatives make consent requests standards-compliant, easy to understand and unbundled |
| competition-and-consumer-consumer-data-right-rules-2020::4.20E | Rule 4.20E: representatives ask for consent with active selection, express agreement and the required information |
| competition-and-consumer-consumer-data-right-rules-2020::4.20F | Rule 4.20F: representatives respect the 12-month limit and the prohibited consents |
| competition-and-consumer-consumer-data-right-rules-2020::4.20H | Rule 4.20H: representatives invite consent amendments only on permitted grounds and at a reasonable frequency |
| competition-and-consumer-consumer-data-right-rules-2020::4.20I | Rule 4.20I: representatives run consent amendments like consents and give the amendment statements |
| competition-and-consumer-consumer-data-right-rules-2020::4.20J | Rule 4.20J: provide withdrawal channels and give effect to withdrawals within 2 business days |
| competition-and-consumer-consumer-data-right-rules-2020::4.20K | Rule 4.20K: treat representative consents as expired at the times the rule sets |
| competition-and-consumer-consumer-data-right-rules-2020::4.20L | Rule 4.20L: representatives give the additional de-identification information |
| competition-and-consumer-consumer-data-right-rules-2020::4.20M | Rule 4.20M: honour deletion elections made to a representative |
| competition-and-consumer-consumer-data-right-rules-2020::4.20N | Rule 4.20N: representatives state their general policy on redundant data |
| competition-and-consumer-consumer-data-right-rules-2020::4.20O | Rule 4.20O: representatives send CDR receipts after each consent given, amended or withdrawn |
| competition-and-consumer-consumer-data-right-rules-2020::4.20P | Rule 4.20P: tell the data holder or accredited data recipient when a representative's collection consent expires |
| competition-and-consumer-consumer-data-right-rules-2020::4.20Q | Rule 4.20Q: representatives tell the consumer when collection consent expires but use or disclosure continues |
| competition-and-consumer-consumer-data-right-rules-2020::4.20R | Rule 4.20R: principals and accredited data recipients notify each other when linked consents expire |
| competition-and-consumer-consumer-data-right-rules-2020::4.20S | Rule 4.20S: principals tell the data holder or accredited data recipient when a representative's collection consent is amended |
| competition-and-consumer-consumer-data-right-rules-2020::4.20T | Rule 4.20T: keep the principal's dashboard current for representative consents |
| competition-and-consumer-consumer-data-right-rules-2020::4.20U | Rule 4.20U: representatives remind consumers every 90 days that consents are still current |
Part 4 Division 4.4: Authorisations to disclose CDR data – Competition and Consumer (Consumer Data Right) Rules 2020
9 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::4.22 | Rule 4.22: design the authorisation process to the data standards and make it easy to understand |
| competition-and-consumer-consumer-data-right-rules-2020::4.22A | Rule 4.22A: invite the consumer to amend the authorisation when a consent amendment is notified |
| competition-and-consumer-consumer-data-right-rules-2020::4.23 | Rule 4.23: give the consumer the required information when seeking or amending an authorisation |
| competition-and-consumer-consumer-data-right-rules-2020::4.24 | Rule 4.24: add no friction, offers or documents to the authorisation process |
| competition-and-consumer-consumer-data-right-rules-2020::4.25 | Rule 4.25: let consumers withdraw authorisations at any time and give effect within 2 business days |
| competition-and-consumer-consumer-data-right-rules-2020::4.26 | Rule 4.26: treat authorisations as expired at the times the rule sets |
| competition-and-consumer-consumer-data-right-rules-2020::4.26A | Rule 4.26A: notify the accredited person when an authorisation is withdrawn or expires |
| competition-and-consumer-consumer-data-right-rules-2020::4.27 | Rule 4.27: update the data holder dashboard as soon as practicable after changes |
| competition-and-consumer-consumer-data-right-rules-2020::4.28 | Rule 4.28: tell the account holder when a secondary user amends or withdraws an authorisation or it expires |
Part 4A: Joint accounts – Competition and Consumer (Consumer Data Right) Rules 2020
8 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::4A.10 | Rule 4A.10: process joint account requests according to the disclosure option |
| competition-and-consumer-consumer-data-right-rules-2020::4A.11 | Rule 4A.11: ask the other joint holders for approval with the required information |
| competition-and-consumer-consumer-data-right-rules-2020::4A.13 | Rule 4A.13: give each relevant joint account holder a dashboard to manage approvals |
| competition-and-consumer-consumer-data-right-rules-2020::4A.14 | Rule 4A.14: send approval notifications and offer alternative notification schedules |
| competition-and-consumer-consumer-data-right-rules-2020::4A.5 | Rule 4A.5: offer the pre-approval and non-disclosure options on every joint account |
| competition-and-consumer-consumer-data-right-rules-2020::4A.6 | Rule 4A.6: provide a disclosure option management service to every joint account holder |
| competition-and-consumer-consumer-data-right-rules-2020::4A.7 | Rule 4A.7: let any holder move to a more restrictive option and inform the other holders |
| competition-and-consumer-consumer-data-right-rules-2020::4A.8 | Rule 4A.8: run the agreement process for a change to a less restrictive option |
Part 5: Accreditation – Competition and Consumer (Consumer Data Right) Rules 2020
9 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::5.12 | Rule 5.12: meet the ongoing obligations of an accredited person |
| competition-and-consumer-consumer-data-right-rules-2020::5.13 | Rule 5.13: comply with the conditions of accreditation |
| competition-and-consumer-consumer-data-right-rules-2020::5.14 | Rule 5.14: notify the CDR Accreditor of changes and arrangements within 5 business days |
| competition-and-consumer-consumer-data-right-rules-2020::5.1B | Rule 5.1B: operate within the limits of sponsored accreditation |
| competition-and-consumer-consumer-data-right-rules-2020::5.2 | Rule 5.2: apply for accreditation with complete and accurate information |
| competition-and-consumer-consumer-data-right-rules-2020::5.23 | Rule 5.23: meet the obligations that survive surrender, suspension or revocation |
| competition-and-consumer-consumer-data-right-rules-2020::5.25 | Rule 5.25: supply the Register database information and keep it current |
| competition-and-consumer-consumer-data-right-rules-2020::5.31 | Rule 5.31: comply with the Accreditation Registrar's requests for the security of the Register |
| competition-and-consumer-consumer-data-right-rules-2020::5.34 | Rule 5.34: obey a temporary direction to stop making or answering consumer data requests |
Part 6: Dispute resolution – Competition and Consumer (Consumer Data Right) Rules 2020
2 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::6.1 | Rule 6.1: data holders meet the internal dispute resolution requirements |
| competition-and-consumer-consumer-data-right-rules-2020::6.2 | Rule 6.2: data holders meet the external dispute resolution requirements |
Part 7: Rules relating to the privacy safeguards – Competition and Consumer (Consumer Data Right) Rules 2020
18 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::7.10 | Rule 7.10: notify consumers within 5 business days of disclosing incorrect CDR data |
| competition-and-consumer-consumer-data-right-rules-2020::7.10A | Rule 7.10A: answer for representatives that breach the data quality safeguard |
| competition-and-consumer-consumer-data-right-rules-2020::7.11 | Rule 7.11: take the Schedule 2 security steps, including through OSPs and representatives |
| competition-and-consumer-consumer-data-right-rules-2020::7.12 | Rule 7.12: de-identify redundant data only where the consumer was told and did not elect deletion |
| competition-and-consumer-consumer-data-right-rules-2020::7.13 | Rule 7.13: otherwise delete redundant data under the deletion process |
| competition-and-consumer-consumer-data-right-rules-2020::7.14 | Rule 7.14: charge no fee for handling correction requests |
| competition-and-consumer-consumer-data-right-rules-2020::7.15 | Rule 7.15: respond to correction requests within 10 business days with a written notice |
| competition-and-consumer-consumer-data-right-rules-2020::7.16 | Rule 7.16: answer for representatives that fail to handle correction requests |
| competition-and-consumer-consumer-data-right-rules-2020::7.2 | Rule 7.2: keep a separate CDR policy with the required content and make it available |
| competition-and-consumer-consumer-data-right-rules-2020::7.3 | Rule 7.3: apply the anonymity and pseudonymity exceptions correctly and answer for representatives |
| competition-and-consumer-consumer-data-right-rules-2020::7.3A | Rule 7.3A: answer for representatives that fail to destroy unsolicited data |
| competition-and-consumer-consumer-data-right-rules-2020::7.3B | Rule 7.3B: answer for outsourced service providers that fail to destroy unsolicited data |
| competition-and-consumer-consumer-data-right-rules-2020::7.4 | Rule 7.4: update the consumer dashboard after each collection |
| competition-and-consumer-consumer-data-right-rules-2020::7.5 | Rule 7.5: use and disclose CDR data only for permitted uses and disclosures |
| competition-and-consumer-consumer-data-right-rules-2020::7.6 | Rule 7.6: never use or disclose CDR data other than for a permitted use or disclosure |
| competition-and-consumer-consumer-data-right-rules-2020::7.8A | Rule 7.8A: answer for representatives that breach the overseas disclosure or government identifier safeguards |
| competition-and-consumer-consumer-data-right-rules-2020::7.8B | Rule 7.8B: answer for outsourced service providers that breach the overseas disclosure or government identifier safeguards |
| competition-and-consumer-consumer-data-right-rules-2020::7.9 | Rule 7.9: update the consumer dashboard after each disclosure |
Part 9: Reporting, record keeping and audit – Competition and Consumer (Consumer Data Right) Rules 2020
5 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::9.3 | Rule 9.3: keep the prescribed records for 6 years |
| competition-and-consumer-consumer-data-right-rules-2020::9.4 | Rule 9.4: prepare and submit the half-yearly reports to the ACCC and OAIC within 30 days |
| competition-and-consumer-consumer-data-right-rules-2020::9.5 | Rule 9.5: give consumers copies of their records within 10 business days, free of charge |
| competition-and-consumer-consumer-data-right-rules-2020::9.6 | Rule 9.6: produce records and information when the ACCC or OAIC audits |
| competition-and-consumer-consumer-data-right-rules-2020::9.7 | Rule 9.7: produce records and information when the CDR Accreditor audits |
Schedule 1: Default conditions on accreditations – Competition and Consumer (Consumer Data Right) Rules 2020
2 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::S1-2.1 | Schedule 1 clause 2.1: give the CDR Accreditor attestation statements and assurance reports on the set cycle |
| competition-and-consumer-consumer-data-right-rules-2020::S1-2.2 | Schedule 1 clause 2.2: sponsors run a third-party management framework over their affiliates |
Schedule 3: Banking and non-bank lenders sectors – Competition and Consumer (Consumer Data Right) Rules 2020
6 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::S3-2.3 | Schedule 3 clause 2.3: banking and non-bank lending data holders provide the consumer dashboard |
| competition-and-consumer-consumer-data-right-rules-2020::S3-5.1 | Schedule 3 clause 5.1: meet ASIC Regulatory Guide 271 for internal dispute resolution |
| competition-and-consumer-consumer-data-right-rules-2020::S3-5.2 | Schedule 3 clause 5.2: be an AFCA member for the sector |
| competition-and-consumer-consumer-data-right-rules-2020::S3-6.3 | Schedule 3 clause 6.3: non-bank lenders tell the ACCC about loan book and customer numbers |
| competition-and-consumer-consumer-data-right-rules-2020::S3-7.2 | Schedule 3 clause 7.2: meet the conditions before holding collected banking data as a data holder |
| competition-and-consumer-consumer-data-right-rules-2020::S3-8.1 | Schedule 3 clause 8.1: keep requests running and notify when moving from non-bank lending to banking |
Schedule 4: Energy sector – Competition and Consumer (Consumer Data Right) Rules 2020
6 controls
| Code | Title |
|---|---|
| competition-and-consumer-consumer-data-right-rules-2020::S4-2.3 | Schedule 4 clause 2.3: energy retailers provide or offer the consumer dashboard |
| competition-and-consumer-consumer-data-right-rules-2020::S4-4.4 | Schedule 4 clause 4.4: retailers obtain AEMO data from AEMO for every SR data request |
| competition-and-consumer-consumer-data-right-rules-2020::S4-5.1 | Schedule 4 clause 5.1: meet the energy sector's internal dispute resolution requirements |
| competition-and-consumer-consumer-data-right-rules-2020::S4-5.2 | Schedule 4 clause 5.2: hold the right external dispute resolution memberships in energy |
| competition-and-consumer-consumer-data-right-rules-2020::S4-6.1 | Schedule 4 clause 6.1: route AEMO data correction requests to the National Electricity Rules procedures |
| competition-and-consumer-consumer-data-right-rules-2020::S4-9.2 | Schedule 4 clause 9.2: meet the conditions before a retailer holds collected energy data as a data holder |
Your Compliance Coverage
If you comply with Competition and Consumer (Consumer Data Right) Rules 2020, you already cover:
Maps to 3 other frameworks
141 total controls
GDPR
5 source controls mapped|5 target controls covered
4%
Australian Privacy Principles (APPs)
4 source controls mapped|4 target controls covered
3%
OAIC Privacy Management Framework
1 source controls mapped|1 target controls covered
1%
Coverage is not the same as your position
This page shows what Competition and Consumer (Consumer Data Right) Rules 2020 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Competition and Consumer (Consumer Data Right) Rules 2020 and who does it apply to?
Competition and Consumer (Consumer Data Right) Rules 2020 is a compliance framework from Australia with 15 domains and 132 controls. The Australian consumer data rules in full: what data holders, accredited data recipients, CDR representatives, sponsors and secondary data holders must do to share banking, non-bank lending and energy data at the consumer's direction, from request services, consent and authorisation flows, dashboards and joint accounts to accreditation, dispute resolution, the operational privacy rules, records, reporting and audit. Built from the authorised compilation No. 10 read in full; the Schedule 2 security steps and the thirteen privacy safeguards sit in the companion 'Australia Consumer Data Right - Banking (CDR)' framework. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Competition and Consumer (Consumer Data Right) Rules 2020 actually require?
Competition and Consumer (Consumer Data Right) Rules 2020 has 132 controls organised across 15 domains. The largest domains are Part 1: Preliminary, request services, dashboards, outsourcing, representatives and deletion – Competition and Consumer (Consumer Data Right) Rules 2020 (21 controls), Part 7: Rules relating to the privacy safeguards – Competition and Consumer (Consumer Data Right) Rules 2020 (18 controls), Part 4 Division 4.3: Consents given to accredited persons – Competition and Consumer (Consumer Data Right) Rules 2020 (17 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Competition and Consumer (Consumer Data Right) Rules 2020 do I already cover?
Competition and Consumer (Consumer Data Right) Rules 2020 maps to 3 other compliance frameworks. The top mapping partners are GDPR (4% coverage), Australian Privacy Principles (APPs) (3% coverage), OAIC Privacy Management Framework (1% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Competition and Consumer (Consumer Data Right) Rules 2020?
Start your Competition and Consumer (Consumer Data Right) Rules 2020 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Competition and Consumer (Consumer Data Right) Rules 2020 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 132 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 703 frameworks.
Get Started Free →Free forever — no credit card required