-
On this page
The Consumer Data Right (CDR) is an opt-in system that gives you control over the data businesses have about you.
Your data can only be shared within the system with your consent, and it can only be transferred to businesses that are accredited to use the Consumer Data Right.
Under the Consumer Data Right, you can:
- decide which businesses can see and use your data
- specify what types of data you wish to transfer
- specify what you want your data to be used for
- stop the transfer of data at any time
- ask for your data to be deleted once it is no longer needed.
How do you get started?
You can find out which businesses are accredited to use the system on cdr.gov.au.
The business you choose to provide your data to will guide you through the process of accessing your data from the business that holds it. You will need to give your consent to both businesses.
Find out more about the consent process in the Getting started guide.
How do you give consent to transfer your data?
Giving consent to access your data is an important part of protecting your privacy. You have the choice to authorise an accredited business to access your data and you can withdraw your consent at any time.
You control what data is transferred, how it will be used, who it can be provided to, and you can ask for it to be deleted or de-identified if it is no longer needed.
You can stop sharing your data at any time. Your consent to use your consumer data expires after 12 months.
A business should only ask you to consent to the collection of data that they reasonably need to provide the product or service.
Do you have to give consent?
Your consent must be voluntary and made as an active choice. Your consent must be given specifically for the agreed purpose and not implied or presumed, and it cannot be the result of default settings or pre-selected options. You should be fully informed about how your data will be used before giving consent.
You should not feel pressured into providing your consent to a business.
If you have concerns about how your consent has been sought or if you think a business has mishandled your data, you have a right to complain to the business, an external dispute resolution scheme and to us.
If you need help to understand whether you should provide consent under the Consumer Data Right, or if you are experiencing financial difficulties in relation to a product or service provided under the system, organisations such as the Financial Rights Legal Centre may be able to assist you. You can contact the Financial Rights Legal Centre for free legal advice on 02 8204 1313 or via their website.
How do you manage how your data will be used?
Businesses in the system must make their CDR policy available to you. This has detailed information on how your data will be managed. It will also tell you what to do if your data is misused.
Each business must also provide you with an online consumer dashboard that will allow you to manage your Consumer Data Right activity. You will receive information through your online dashboard about what you have consented to and what the data is used for. The online dashboard will also give you the ability to:
- withdraw your consent
- amend your consent
- ask for your data to be deleted once it is no longer needed.
Do you have a joint account?
If you want to give a business access to your data from a joint account, you and each of the other account holders must first agree to allow this.
You can manage your preferences through your consumer dashboard, including whether another joint account holder can make requests on your behalf to provide your data to another business.
How do you correct your data?
You have the right to make a request to correct your data if it is inaccurate, out of date, incomplete or misleading.
If you think your data is incorrect, you can contact the business to ask them to correct it. The business should consider the reasons they hold your data, and then respond to your request by either:
- correcting your data, or
- providing a qualifying statement to ensure the data won’t be misinterpreted.
If the business does not correct your data, they must tell you why they considered that no correction or statement was required and how you can make a complaint if you aren’t satisfied with their response.
Long text description
This image shows the process for authorising an accredited business to access your data.
The consumer is positioned in the centre, between the business that has their data and the business they’d like to give access to their data. The consumer gives consent to both parties to use and disclose their data. They can stop sharing data at any time and their consent lasts for 12 months.
The business which has the consumer’s data transfers only the data requested to the business the consumer has chosen to engage with. That business stores the data securely and only uses it in a way that the consumer has specified.
That business will display the Consumer Data Right accredited logo.
