Consumer Data Right (CDR) Framework (Australia)

Australia

vongoing (no fixed version)

4 domains

33 controls

Australia's Consumer Data Right (CDR) framework, established under Part IVD of the Competition and Consumer Act 2010, enables consumers to securely share their data with accredited third parties. It was first implemented for the banking sector (Open Banking) and subsequently rolled out for energy (July 2022) and non‑bank lending (2023). Additional sectors such as telecommunications and health are in advanced development. The framework is overseen by the ACCC and continuously updated through CDR rules and data standards.

Unverified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (4)

CDR: Accreditation

6 controls

Controls in the CDR: Accreditation domain of Consumer Data Right (CDR) Framework (Australia) — 6 controls
Code	Title	Description
CDR-ACC-1	Unrestricted Accreditation	Accreditation at the unrestricted level permits collection and use of CDR data subject to the full obligations.
CDR-ACC-2	Sponsored Accreditation	Sponsored accreditation allows an entity to be accredited via a sponsor that takes on certain obligations.
CDR-ACC-3	Affiliate Accreditation	Affiliate accreditation permits a principal to extend accreditation to an affiliate under its responsibility.
CDR-ACC-4	CDR Representative Model	A CDR representative provides goods/services using CDR data under a principal accredited data recipient, governed by a C...
CDR-ACC-5	Trusted Adviser and Insight Disclosure	Disclosures to trusted advisers, and CDR insight disclosures, must meet the rules' conditions.
CDR-ACC-6	Accredited Action Initiator	Action initiation (where enabled) requires the relevant accreditation and adherence to action-initiation rules.

CDR: Consent and Authorisation

6 controls

Controls in the CDR: Consent and Authorisation domain of Consumer Data Right (CDR) Framework (Australia) — 6 controls
Code	Title	Description
CDR-CON-1	Voluntary Consent	Consent to collect/use CDR data must be voluntary.
CDR-CON-2	Express Consent	Consent must be express (a clear affirmative act), not implied.
CDR-CON-3	Informed Consent	Consumers must be given the information needed to understand what they are consenting to.
CDR-CON-4	Specific Consent	Consent must be specific as to the data, use and duration.
CDR-CON-5	Time-Limited Consent	Consent must be limited in time and re-sought on expiry.
CDR-CON-6	Withdrawable Consent and Authorisation	Consumers must be able to withdraw consent (and data holders to manage authorisation withdrawal) easily via the dashboar...

CDR: Privacy Safeguards (CCA Part IVD Div 5)

13 controls

Controls in the CDR: Privacy Safeguards (CCA Part IVD Div 5) domain of Consumer Data Right (CDR) Framework (Australia) — 13 controls
Code	Title	Description
CDR-PS-1	Privacy Safeguard 1: Open and Transparent Management of CDR Data	Accredited data recipients and data holders must manage CDR data in an open and transparent way, including by having and...
CDR-PS-10	Privacy Safeguard 10: Notifying of the Disclosure of CDR Data	Recipients must notify the consumer (dashboard) of disclosures of CDR data.
CDR-PS-11	Privacy Safeguard 11: Quality of CDR Data	Recipients must take reasonable steps to ensure CDR data they disclose is accurate, up to date and complete, having rega...
CDR-PS-12	Privacy Safeguard 12: Security of CDR Data, and Destruction or De-identification	Recipients must protect CDR data from misuse, interference, loss and unauthorised access per the information-security re...
CDR-PS-13	Privacy Safeguard 13: Correction of CDR Data	Recipients must correct CDR data on request or notify the consumer of refusal, with reasons and complaint avenues.
CDR-PS-2	Privacy Safeguard 2: Anonymity and Pseudonymity	Where lawful and practicable, individuals must have the option of dealing anonymously or by pseudonym in relation to CDR...
CDR-PS-3	Privacy Safeguard 3: Seeking to Collect CDR Data from CDR Participants	An accredited data recipient may only seek to collect CDR data with valid consent and only data reasonably needed.
CDR-PS-4	Privacy Safeguard 4: Dealing with Unsolicited CDR Data	If unsolicited CDR data is received, the recipient must determine whether it could have been collected under the rules a...
CDR-PS-5	Privacy Safeguard 5: Notifying of the Collection of CDR Data	Recipients must notify the consumer (via the consumer dashboard) of the collection of CDR data.
CDR-PS-6	Privacy Safeguard 6: Use or Disclosure of CDR Data	CDR data may only be used or disclosed in accordance with consent and the rules; otherwise prohibited.
CDR-PS-7	Privacy Safeguard 7: Use or Disclosure of CDR Data for Direct Marketing	CDR data must not be used or disclosed for direct marketing except as permitted by the rules.
CDR-PS-8	Privacy Safeguard 8: Overseas Disclosure of CDR Data	Before disclosing CDR data overseas, recipients must take reasonable steps to ensure the overseas recipient complies wit...
CDR-PS-9	Privacy Safeguard 9: Adoption or Disclosure of Government Related Identifiers	Recipients must not adopt, use or disclose a government related identifier of a consumer except as permitted.

CDR: Rules, Security and Oversight

8 controls

Controls in the CDR: Rules, Security and Oversight domain of Consumer Data Right (CDR) Framework (Australia) — 8 controls
Code	Title	Description
CDR-RULE-BREACH	CDR Data Breach and Notifiable Data Breach	Recipients must respond to eligible data breaches and comply with notifiable-data-breach obligations (OAIC) for CDR data...
CDR-RULE-COMPLAINTS	Complaints and Internal Dispute Resolution	Participants must maintain internal dispute resolution for CDR complaints and inform consumers of external avenues (OAIC...
CDR-RULE-CONFORMANCE	Conformance Testing (CTS)	Participants must pass Conformance Test Suite testing and meet the CDR data standards before going live and on changes.
CDR-RULE-DASHBOARD	Consumer Dashboards and Receipts	Data holders and recipients must provide consumer dashboards showing authorisations/consents and CDR receipts for transp...
CDR-RULE-DESIGNATION	Sector Designation and Scope	The CDR applies to designated sectors (banking, energy, with telecommunications and others in development); data holders...
CDR-RULE-OSP	Outsourced Service Provider Arrangements	Use of outsourced service providers for CDR data must be governed by a CDR outsourcing arrangement flowing down the obli...
CDR-RULE-OVERSIGHT	Regulator Oversight and Enforcement (ACCC and OAIC)	The ACCC administers the CDR rules/accreditation and the OAIC oversees privacy; both have enforcement powers.
CDR-RULE-SECURITY	Information Security (CDR Rules Schedule 2)	Accredited recipients must implement the information-security controls in Schedule 2 of the CDR Rules (governance, acces...

Your Compliance Coverage

If you comply with Consumer Data Right (CDR) Framework (Australia), you already cover:

GDPR

36%

12 controls mapped

Compare →

NIST SP 800-53 Rev 5

1 controls mapped

Compare →

ISO 27001:2022

1 controls mapped

Compare →

See all 3 mapped frameworks ↓

Maps to 3 other frameworks

33 total controls

GDPR

12 source controls mapped|5 target controls covered

36%

NIST SP 800-53 Rev 5

1 source controls mapped|1 target controls covered

ISO 27001:2022

1 source controls mapped|1 target controls covered

Compare Consumer Data Right (CDR) Framework (Australia) with GDPR

Frequently Asked Questions

What is Consumer Data Right (CDR) Framework (Australia)?

Consumer Data Right (CDR) Framework (Australia) is a compliance framework from Australia with 4 domains and 33 controls. Australia's Consumer Data Right (CDR) framework, established under Part IVD of the Competition and Consumer Act 2010, enables consumers to securely share their data with accredited third parties. It was first implemented for the banking sector (Open Banking) and subsequently rolled out for energy (July 2022) and non‑bank lending (2023). Additional sectors such as telecommunications and health are in advanced development. The framework is overseen by the ACCC and continuously updated through CDR rules and data standards. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does Consumer Data Right (CDR) Framework (Australia) have?

Consumer Data Right (CDR) Framework (Australia) has 33 controls organised across 4 domains. The largest domains are CDR: Privacy Safeguards (CCA Part IVD Div 5) (13 controls), CDR: Rules, Security and Oversight (8 controls), CDR: Accreditation (6 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does Consumer Data Right (CDR) Framework (Australia) map to?

Consumer Data Right (CDR) Framework (Australia) maps to 3 other compliance frameworks. The top mapping partners are GDPR (36% coverage), NIST SP 800-53 Rev 5 (3% coverage), ISO 27001:2022 (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with Consumer Data Right (CDR) Framework (Australia) compliance?

Start your Consumer Data Right (CDR) Framework (Australia) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Consumer Data Right (CDR) Framework (Australia) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required