{"text_format":"3","workbook":"xls","n_sheets":3,"sheets":["All items","Active items","Retired items"],"not_rendered":{"external_links":1},"read":"whole","date_system":"1900","formulas":"cached_only"}

{"sheet":"All items","index":0,"n_rows":1511,"n_cols":13,"rows_kept":1511,"flags":["formulas_cached_only"]}
["Area","Focus area","Checklist ref","Type","Participant","Requirement level","Statement","Reference (file)","Example","Version introduced","Date introduced","Status","Date modified"]
["0AC. Accessibility","00. Accessibility","0AC.00.","CX Standard","Data Holder, Data Recipient","MUST","At a minimum, all CDR participants MUST seek to comply with accessibility guidelines throughout the Consent Model.\n\nThese standards SHOULD be assessed, tested, and refined further by accessibility consultants directly involved in implementation.","Accessibility Standards, Accessibility [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","01. Content distinction","0AC.01.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 1.4. This will make it easier to see and hear content, including separate foreground information from the background.","Accessibility Standards, Accessibility: Content distinction [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","01. Manage consent - Dashboard landing page (1)","0AC.01.","CDR Rule","Data Recipient","MUST","(1) This rule applies in relation to a collection consent or a use consent given under this Division if:\n(a) the consent is current; and\n(b) 90 days have elapsed since the latest of the following:\n(i) the CDR consumer gave the consent;\n(ia) the CDR consumer last amended the consent;\n(ii) the CDR consumer last used their consumer dashboard;\n(iii) the accredited person last sent the CDR consumer a notification in accordance with this rule.\n(2) The accredited person must notify the CDR consumer in accordance with this rule that the consent is still current.\nNote: This subrule is a civil penalty provision (see rule 9.8).\n(3) The notification must be given in writing otherwise than through the CDR consumer’s consumer dashboard.\n(4) A copy of the notification may be included in the CDR consumer’s consumer dashboard.","CDR Rule 4.20","CX Guidelines v1.4.0 PDF, p. 92 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2024-02-29"]
["0AC. Accessibility","02. Keyboard functionality","0AC.02.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 2.1. This will make all functionality available from a keyboard.","Accessibility Standards, Accessibility: Keyboard functionality [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","03. Pointer interactions","0AC.03.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 2.5. This will make it easier to operate functionality using various input devices.","Accessibility Standards, Accessibility Pointer interactions [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","04. Reading experience","0AC.04.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 3.1. This will make text content readable and understandable.","Accessibility Standards, Accessibility: Reading experiences [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","05. Input assistance","0AC.05.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 3.3. This will help users avoid and correct mistakes.","Accessibility Standards, Accessibility: Input assistance [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0DL. Data Language","01. Language to be used","0DL.01.","CX Standard","Data Holder, Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-26"]
["0DL. Data Language","02. Detailed scope requests","0DL.02.","CX Standard","Data Holder, Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-26"]
["1CO. Consent","00. Consent - general","1CO.00.","CX Standard","Data Recipient","MUST","If a data recipient does not have a policy to delete redundant data, and the consumer has not already requested that their redundant data be deleted:\n\nData recipients MUST allow consumers to elect to have their redundant data deleted as part of the withdrawal process prior to the final withdrawal step.\n\nData recipients SHOULD consider prompting consumers to exercise this right at appropriate times (e.g. when inaction on the part of the consumer may cause them to lose the opportunity to exercise the right to delete their redundant data).","Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","CX Guidelines v1.4.0 PDF, p. 65 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CX Guideline","Data Recipient","MAY","Where data recipients are required to withdraw an existing consent prior to, or in the course of, replacing that consent with a new consent, they MAY choose to present the withdrawal process immediately before authentication.\n\nData recipients SHOULD determine the appropriate location, language, and presentation of the withdrawal process.\n\nRefer to the relevant CDR Rules, CX Standards, and CX Guidelines for withdrawal of consent to collection and use.",null,"CX Guidelines v1.4.0 PDF, p. 65 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CDR Rule","Data Recipient","MUST","Data recipients must allow consent to be withdrawn by the consumer at any time by communicating the withdrawal to the data recipient in writing or by using the data recipient’s consumer dashboard.\n\nWhere a consumer chooses to replace an existing consent with a new consent, data recipients must similarly enable consent to be withdrawn by the consumer prior to or in the course of providing a new consent.\n\nIf consent is withdrawn via communication in writing, the data recipient must do so as soon as possible or within 2 business days of receiving this request.","CDR Rule 4.13(1), 4.13(2)(a) | CX Research 15, 31, 32 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 65 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CDR Rule","Data Recipient","MUST","Data recipients must not infer consent or rely on an implied consent.","4.11(1)(e)(Note 1)","CX Guidelines v1.4.0 PDF, p. 52 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CDR Rule","Data Recipient","MUST NOT","Consent must not be inferred or implied.","CDR Rule 4.11(1)(e)(Note 1)","CX Guidelines v1.4.0 PDF, p. 51 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.02","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent:\n(a) that is not in a category of consents; or\n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:\n(i) identifying; or\n(ii) compiling insights in relation to; or\n(iii) building a profile in relation to;\nany identifiable person who is not the CDR consumer who made the consumer data request.\n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:\n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and\n(b) use that derived CDR data in order to provide the requested goods or services.","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active"]
["1CO. Consent","00. Consent - general","1CO.00.03","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n\n(a) must comply with any relevant data standards; and\n\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","00. Consent - general","1CO.00.04","CDR Rule","Data Recipient","MUST NOT","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(c), (d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","00. Consent - general","1CO.00.05","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","00. Consent - general","1CO.00.37","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","00. Consent - general","1CO.00.52","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","00. Consent - general","1CO.00.53","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","00. Consent - general","1CO.00.54","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active","2025-09-17"]
["1CO. Consent","00. Consent - general","1CO.00.55","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","00. Consent - general","1CO.00.56","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","00. Consent - general","1CO.00.57","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","00. Consent - general","1CO.00.58","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","01. Seeking consent","1CO.01.","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","01. DH selection","1CO.01.","CX Guideline","Data Recipient","MAY","Data recipients should consider the implications of allowing multiple data holders to be selected in this step as it may impact the quality of consent.\n\nExample: The data recipient allows the consumer to select several data holders at once, complete the authentication and authorisation process for one, and then allow the consumer to return at some point in the future to connect more data holders without reviewing the terms of consent again. This method of reducing friction would compromise the quality of consent if the time between data holder selection and authentication is too great.",null,"CX Guidelines v1.4.0 PDF, p. 68 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","01. DH selection","1CO.01.01","CDR Rule","Data Recipient","MUST","Note 1: An accredited person might need to make consumer data requests to several CDR participants in order to provide the goods or services requested by the CDR consumer, and might need to make regular consumer data requests over a period of time in order to provide those goods or services.\n\nNote 2: These rules will progressively permit consumer data requests to be made in relation to CDR data held by a broader range of data holders within the banking sector, and in relation to a broader range of CDR data, according to the timetable set out in Part 6 of Schedule 3.","CDR Rule 4.4(2)(Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","01. DH selection","1CO.01.29","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","01. DH selection","1CO.01.30","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-17"]
["1CO. Consent","01. DH selection","1CO.01.31","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2026-03-18"]
["1CO. Consent","01. DH selection","1CO.01.32","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Retired","2025-09-17"]
["1CO. Consent","01. DH selection","1CO.01.59","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should use the phrase 'Stop Sharing' to refer to how a consumer can withdraw authorisation.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 64 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that: \n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’) \n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 57 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CDR Rule","Data Recipient","MUST NOT","Data recipients must not ask the consumer to give consent for the purpose of selling their CDR data unless it is de-identified in accordance with the CDR de-identification process.","CDR Rule 4.12(3)(a)","CX Guidelines v1.4.0 PDF, p. 57 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that:\n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’)\n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 53 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that: \n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’)\n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 51 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(aa) in the case of a use consent—either:\n\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.07","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\n\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(i) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.08","CDR Rule","Data Recipient","MUST NOT","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.09","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n\n(a) in the case of a collection consent or a disclosure consent—either:\n\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.10","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de‑identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.11","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d) ","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) |  CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.13","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) |  CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-05-01"]
["1CO. Consent","02. Collection and use consent","1CO.02.14","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) the following information about withdrawal of consents:\n(ii) instructions for how the consent can be withdrawn;","CDR Rule 4.11(3)(g)(ii) | CX Research 7 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.15","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.16","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.17","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.","CDR Rule 4.13(1)(b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.18","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.19","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.20","CDR Rule","Data Recipient","MUST","For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:\n(a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;\n(b) make a record to evidence the deletion; and\n(c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.","CDR Rule 1.18","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.21","CDR Rule","Data Recipient","MUST","(4) In addition to the information referred to in subsection 56ED(5) of the Act, an accredited data recipient’s CDR policy must:\n(k) include the following information about deletion of redundant CDR data:\n(i) when it deletes redundant data;\n(ii) how a CDR consumer may elect for this to happen;\n(iii) how it deletes redundant data;","CDR Rule 7.2(4)(k)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.22","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.23","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(a) gives the accredited person a collection consent, use consent or disclosure consent; ","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.24","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.25","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (b), (c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.26","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.27","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.28","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.33","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.34","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.35","CX Guideline","Data Recipient","MAY","Data recipients should identify whether the user is sharing individual or non-individual accounts in order to surface the correct data language.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.36","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.38","CX Guideline","Data Recipient","MAY","Data recipients should outline how often data is expected to be collected over that period.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.39","CX Guideline","Data Recipient","MAY","Most research participants expected their data to be deleted when sharing was withdrawn or expired. Data recipients can avoid the election step within the consent flow if they have general policy of deletion.\n\nIf data recipients need to include this in-flow election, they should allow the consumer to elect that they ‘remember’ their preference for subsequent requests.","CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.40","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.41","CX Guideline","Data Recipient","MAY","Data recipients that have a general policy of deleting consumer data should inform the consumer if they are required to keep data for legal reasons.","CX Research 33 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.42","CX Guideline","Data Recipient","MAY","Data recipient should include their CDR policy in their CDR receipts.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.43","CX Guideline","Data Recipient","MAY","In addition to providing withdrawal instructions, data recipients should provide instructions for how to review sharing arrangements.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.44","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","2022-03-08","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.45","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications. The use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","2022-03-08","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.46","CX Guideline","Data Recipient","MAY","Data recipients should surface information about the data deletion process:\n• when data will be deleted;\n• why data may need to be retained (e.g. business or legal reasons);\n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.16.0","2022-03-08","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.47","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide information in relation to complaint handling at appropriate points throughout the Consent Model, such as: \n• during Pre-consent; \n• within the Consent Flow; and/or \n• within the CDR Receipt and/or Consumer Dashboards.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.16.1","2022-04-07","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.48","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.16.1","2022-04-07","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.49","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.50","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.51","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\n\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03a. ADR uses OSPs","1CO.03a.","CDR Rule","Data Recipient","MUST","If data becomes redundant, data recipients MUST direct any outsourced provider that has been provided with a copy of such data to either:\n• return the redundant data to the data recipient; or\n• delete the redundant data, as well as any CDR data that has been directly or indirectly derived from it, and notify the data recipient of the deletion\n\nIf the outsourced provider has provided any such data to another person, the data recipient MUST direct the outsourced provider to direct said person to:\n• take either of the above mentioned steps; and\n• cause similar directions to be made to any person to whom such data has been further disclosed","CDR Rule 7.12(2)(b)","CX Guidelines v1.4.0 PDF, p. 59, 63 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","03a. ADR uses OSPs","1CO.03a.","CDR Rule","Data Recipient","MUST","(1) If an accredited person is the principal in a CDR outsourcing arrangement, it must ensure that the provider complies with its requirements under the arrangement. ","CDR Rule 1.16(1)","CX Guidelines v1.4.0 PDF, p. 59 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","03a. Using OSPs","1CO.03a.01","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(f) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the accredited person:\n(i) a statement of that fact;","CDR Rule 4.11(3)(f)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-05-01"]
["1CO. Consent","03a. Using OSPs","1CO.03a.02","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n\n(f) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the accredited person: \n(i) a statement of that fact; and \n(ii) the name of the OSP; and\n(iii) the OSP’s accreditation number (if any); and\n(iv) if the OSP is based overseas—the country in which it is based; and\n(v) a link to a webpage where the accredited person’s CDR policy and the OSP’s CDR policy (if any) can be directly viewed; and\n(vi) a statement detailing why the OSP needs to access the consumer’s CDR data; and\n(vii) a statement that the consumer can obtain further information about why the OSP needs to access the consumer’s CDR data from the policy if desired;","CDR Rule 4.11(3)(f)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.03","CX Guideline","Data Recipient","MAY","Consumer research suggested that where direct or indirect OSPs are used, consumers expected transparency in this process, and that surfacing details about participants and their roles would facilitate trustworthiness and informed consent.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.04","CX Guideline","Data Recipient","MAY","CDR participants may want to note where an OSP is accredited, which the research suggested would facilitate trustworthiness in the process.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.05","CX Guideline","Data Recipient","MAY","Data recipients should provide a high level of transparency, control, and certainty around all parties who may collect or access the data in any way.\n\nData recipients can do this by surfacing relevant information and obligations regarding such parties and providers that would otherwise be found in CDR policies.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.06","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses direct or indirect OSPs; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf. \n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.07","CDR Rule","Data Recipient","MUST","The amendments of paragraph 4.11(3)(f) of the principal rules made by the amending rules apply on and after the day that is 12 months after the commencement of the amending rules.","CDR Rule 502","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03a. Using OSPs","1CO.03a.08","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03a. Using OSPs","1CO.03a.09","CX Guideline","Data Recipient","MAY","The previous requirements under CDR Rule 4.11(3)(f) of the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 will continue to apply until 11 November 2025. The new requirements apply on and after 12 November 2025.","CDR Rule 502","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.01","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.02","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n\n(i) if the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:\n(i) a statement of that fact; and \n(ii) the sponsor’s name; and \n(iii) the sponsor’s accreditation number; and \n(iv) if the sponsor is based overseas—the country in which it is based; and\n(v) a link to a webpage where the sponsor’s CDR policy can be directly viewed; and \n(vi) a statement detailing why the sponsor needs to access the consumer’s CDR data; and\n(vii) a statement that the CDR consumer can obtain further information about collections or disclosures of CDR data from the sponsor’s CDR policy if desired.","CDR Rule 4.11(3)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.03","CDR Rule","Data Recipient","MUST","(2B) If the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:\n(a) the request for a collection consent must specify that fact; and\n(b) a consent for the affiliate to collect the CDR data is taken to be consent for the sponsor to so collect it.","CDR Rule 4.3(2B)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.04","CDR Rule","Data Recipient","MUST","4.20A Application of Subdivision to sponsor and affiliate \n\nWhere this Subdivision would, if not for this rule, require both an affiliate and the affiliate’s sponsor to give a notice to a CDR consumer, the sponsor and the affiliate may choose which will give the notice.","CDR Rule 4.20A","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.05","CX Guideline","Data Recipient","MAY","For sponsorship arrangements, affiliates may display the sponsor's name and accreditation, as per CDR Rule 4.11(3)(i), where outsourced service provider involvement is surfaced to the consumer, as per CDR Rule 4.11(3)(f). \n\nAs demonstrated in these artefacts, this information should be readily accessible to the consumer.","CDR Rule 4.11(3)(f), (i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.06","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.20A, affiliates may provide the notifications specified in subdivision 4.3.5.","CDR Rule 4.20A","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.07","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 4.11(3)(a) and (b), the name and accreditation number of the affiliate should be displayed.","CDR Rule 4.11(3)(a), (b) | CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.08","CX Guideline","Data Recipient","MAY","Data recipients should provide a high level of transparency, control, and certainty around all parties who may collect or access the data in any way.\n\nData recipients can do this by surfacing relevant information and obligations regarding such parties and providers that would otherwise be found in CDR policies.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf. \n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.10","CX Guideline","Data Recipient","MAY","Various CDR Rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the sponsor to be referenced.\n\nThese artefacts demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the sponsor is only noted as a background detail.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.01","CDR Rule","Data Recipient","MUST","(1) In these rules, a CDR representative arrangement is a written contract between a person with unrestricted accreditation (the CDR representative principal) and a person without accreditation (the CDR representative):\n\n(a) under which the CDR representative will offer goods and services to CDR consumers, but not in their capacity as CDR business consumers, for which it will need to use or disclose CDR data of the CDR consumer; and\n\n(b) under which, where the CDR representative has obtained the consent of a CDR consumer to the collection, use and disclosure of CDR data in accordance with rule 4.3A:\n(i) the CDR representative principal will:\n(A) make any appropriate consumer data request; and\n(B) disclose the relevant CDR data to the CDR representative; and\n(ii) the CDR representative will use or disclose the CDR data to provide the relevant goods or services to the CDR consumer; and\n\n(d) under which the CDR representative is required to comply with:\n(i) any rules that are expressed as applying to a CDR representative; and\n(ii) any consumer experience data standards that are expressed as applying to an accredited data recipient, as if the CDR representative were an accredited data recipient.","CDR Rule 1.10AA(1)(a), (b), (d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.02","CDR Rule","Data Recipient","MUST","Note: From the point of view of a CDR consumer who is the customer of a CDR representative, the consumer deals with the CDR representative, as if it were an accredited person, and might not deal with the CDR representative principal at all. The consumer requests the goods or services from the CDR representative; the CDR representative identifies the CDR data that it needs in order to provide the goods and services; the consumer gives their consent to the CDR representative for the collection and use of the CDR data. The consumer is informed that the CDR representative principal will do the actual collecting, but as a background detail.\nA CDR representative cannot deal with a person in their capacity as a CDR business consumer.","CDR Rule 1.10AA (Note)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.03","CDR Rule","Data Recipient","MUST NOT","(4) A CDR representative arrangement must require the CDR representative to comply with the following requirements in relation to any service data:\n(c) the CDR representative must not use or disclose the service data other than in accordance with a contract with the CDR representative principal;","CDR Rule 1.10AA(4)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.04","CDR Rule","Data Recipient","MUST","(2) The CDR representative may, in accordance with Division 4.3A, ask the CDR consumer to give:\n(a) a collection consent for the CDR representative principal to collect the CDR consumer’s CDR data from the CDR participant and disclose it to the CDR representative; and\n(b) a use consent for the CDR representative to use it in order to provide those goods or services.\nNote 1: For a collection consent mentioned in paragraph (a), see subrule 1.10A(8).\nFor consents mentioned in paragraph (b), see rule 1.10A as applied to a CDR representative under subrule 1.10A(5).\nNote 2: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the CDR representative principal to request CDR data from more than 1 CDR participant.\nNote 3: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3A(2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.05","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(h) replace paragraph 4.11(3)(i) with the following:\n“(i) the fact that the person is a CDR representative and that the CDR data will be collected by its CDR principal at its request;\n(j) if the CDR representative is not located in Australia—the country in which it is located;\n(k) the CDR principal’s name; and\n(l) the CDR principal’s accreditation number;\n(m) a link to the principal’s CDR policy; and\n(n) a statement that the CDR consumer can obtain further information about such collections or disclosures from the CDR principal’s CDR policy if desired.”;","CDR Rule 4.3(C)(1)(h)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.06","CDR Rule","Data Recipient","MUST","(8) For an accredited person with a CDR representative, a consent given by a CDR consumer under these rules to the CDR representative for the accredited person to collect particular CDR data from a CDR participant for that CDR data and disclose it to the CDR representative is also a collection consent.","CDR Rule 1.10A(4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.07","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(a) replace references to the accredited person with references to the CDR representative, except in the following (the exceptional provisions):\n(i) Subdivision 4.3.2B;\n(b) in the exceptional provisions, replace references to the accredited person with references to the CDR principal;","CDR Rule 4.3C(1)(a)(i), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.08","CDR Rule","Data Recipient","MUST","(5) Where a CDR representative principal makes a consumer data request at the request of a CDR representative, it may arrange for the CDR representative to provide the consumer dashboard on its behalf.","CDR Rule 1.14(5)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.09","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(c) replace references to the goods and services provided by the accredited person with references to the goods or services provided by the CDR representative;","CDR Rule 4.3C(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.10","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(a) replace references to the accredited person with references to the CDR representative, except in the following (the exceptional provisions):\n(ii) Subdivision 4.3.5, other than paragraph 4.18(2)(c); and\n(b) in the exceptional provisions, replace references to the accredited person with references to the CDR principal;","CDR Rule 4.3C(1)(a)(ii), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.11","CDR Rule","Data Recipient","MUST","4.20B Application of Subdivision to CDR principal and CDR representative \nWhere an accredited person who is a CDR principal is required under this Subdivision to give a notice to a CDR consumer in relation to a consumer data request made at the request of a CDR representative, the notice may be given through the CDR representative.","CDR Rule 4.20B","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.12","CX Guideline","Data Recipient","MAY","For CDR representative arrangements, CDR representatives are required to display their own name as per rule 4.20E(3)(a), but as an unaccredited participant they are not required to display their accreditation number (as they do not have one).\n\nCDR representatives are required by rules 4.20E(3)(d) and (e) to display the CDR principal's name and accreditation number. The CDR representative may choose to display the principal's accreditation number in relation to the representative's name, and may also surface the principal's name, accreditation number, and other details, such as those specified in rules 4.20E(3)(b), (j) and (l) where outsourced service provider involvement is surfaced to the consumer, as per rule 4.20E(3)(k).\n\nAs demonstrated in these artefacts, this information should be readily accessible to the consumer.","CDR Rule 4.20E(3)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.13","CX Guideline","Data Recipient","MAY","CDR representatives can refer to the Principal as a background detail in the relevant artefacts, e.g. dashboard, withdrawal, notifications etc.","CDR Rule 1.10AA","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.14","CX Guideline","Data Recipient","MAY","As noted in CDR Rules 4.20J and 1.14(5), where a CDR principal makes consumer data requests at the request of a CDR representative, the CDR representative may provide the consumer dashboard on the CDR principal's behalf.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.15","CX Guideline","Data Recipient","MAY","Data recipients should provide a high level of transparency, control, and certainty around all parties who may collect or access the data in any way.\n\nData recipients can do this by surfacing relevant information and obligations regarding such parties and providers that would otherwise be found in CDR policies.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.16","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf. \n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.17","CX Guideline","Data Recipient","MAY","Various rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the principal to be referenced. These guidelines demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the principal is only noted as a background detail.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.18","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.3A(2), a CDR representative may ask the consumer to give a collection consent for the CDR principal to collect data; a use consent for the CDR principal to disclose the data to the representative; and another use consent for the representative to use that data to provide goods or services. \n\nIn practice, these use consents may be presented to the consumer as a single consent with two purposes, as demonstrated in these examples, rather than two separate use consents. The details on the use consent relating to the CDR principal's involvement can be surfaced in a separate component, such as the 'supporting parties' design contained in this flow.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.19","CX Guideline","Data Recipient","MAY","As per rule 4.20M, if a CDR participant does not have a general policy of deleting redundant data, then the consumer may elect that the collected data, and any data derived from it, be deleted when it becomes redundant data. They may do this when giving the consent as per rule or at any other time before the consent expires. The consumer may make this election using their consumer dashboard, or in writing to the CDR principal or CDR representative.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.20","CX Guideline","Data Recipient","MAY","As per rule 4.20J, withdrawing consents using a simple alternative method of communication can be to the CDR representative principal or the CDR representative.\nWhen seeking to address the requirements of rule 4.20E(3)(m)(ii), recipients should include the method of communication for the party the consumer is most familiar with.\n\nCDR representative principals must include the details of the simple method of communication in their CDR policy.\n\nWhere a consumer contacts the CDR representative principal, rather than the CDR representative, the  principal may also choose to present contact details that align with the brand, name, or domain of the CDR representative to maintain consistency in the interaction.","CDR Rule 4.20J, 4.20E(3)(m)(ii) | 10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.21","CDR Rule","Data Recipient","MUST","Note: Under rule 4.3A, if a CDR representative asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.20D, 4.20E and 4.20F. A failure to do so could result in the CDR representative principal being liable for one or more civil penalty provisions: see section 56EF of the Act and rule 1.16A.","CDR Rules, Subdivision 4.3A.2 (Note)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(d) the CDR representative principal’s name;\n(e) the CDR representative principal’s accreditation number;","CDR Rule 4.20E(3)(d), (e)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.23","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(b) the fact that the person is a CDR representative and that the CDR data will be collected by its CDR representative principal at its request;\n(j) a link to the CDR representative principal’s CDR policy;\n(l) a statement that the CDR consumer can obtain further information about the collections or disclosures for which consent is requested from the CDR representative principal’s CDR policy if desired;","CDR Rule 4.20E(3)(b), (j), (l)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.24","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(a) its name;","CDR Rule 4.20E(3)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.25","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n\n(m) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.20E(3)(m)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.26","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(n) the following information about redundant data:\n(i) a statement, in accordance with rule 4.20N, regarding the CDR representative’s intended treatment of redundant data;","CDR Rule 4.20E(3)(n)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.27","CDR Rule","Data Recipient","MUST NOT","(1) A CDR representative must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.20F(1)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.28","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to a CDR representative for the purposes of this Division may withdraw the consent at any time:\n(a) by using the CDR representative principal’s consumer dashboard; or\n(b) by using:\n(i) a method mentioned in subrule (2) to notify the CDR representative principal; or\n(ii) a method mentioned in subrule (3) to notify the CDR representative.\nNote 1: The CDR representative principal may allow the CDR representative to provide the consumer dashboard on its behalf—see subrule 1.14(5).\nNote 2: If the withdrawal is made using the consumer dashboard, it has effect immediately (see rule 4.20K).\n(2) The CDR representative principal must make available a simple method of communication for the withdrawal of consent, as an alternative to using the CDR representative principal’s consumer dashboard.\nNote 1: The CDR representative principal may allow the CDR representative to provide the consumer dashboard on its behalf—see subrule 1.14(5).\nNote 2: This subrule is a civil penalty provision (see rule 9.8).\n(3) The CDR representative must make available a simple method of communication for the withdrawal of consent, as an alternative to using the CDR representative principal’s consumer dashboard.\nNote: A failure to do this could make the CDR representative principal liable for a civil penalty (see rule 1.16A).","CDR Rule 4.20J(1)–(3)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.29","CDR Rule","Data Recipient","MUST","A CDR representative must give the CDR consumer a notice that complies with the data standards as soon as practicable after:\n\n(a) the CDR consumer gives the CDR representative a collection consent, a use consent or a disclosure consent;","CDR Rule 4.20O(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.30","CDR Rule","Data Recipient","MUST","A request by a CDR representative for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines developed by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and\n(c) must not include or refer to the CDR representative principal’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.20D","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.31","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n (i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n (ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.20E(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.32","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.20E(1)(aa)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.33","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;","CDR Rule 4.20E(1)(b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.34","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n\n(d) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (c) for each relevant category of consents;","CDR Rule 4.20E(1)(d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.35","CDR Rule","Data Recipient","MUST NOT","(2) The CDR representative must not present direct marketing consents or de‑identification consents as pre-selected options to the CDR consumer for the purposes of subrule (1).","CDR Rule 4.20E(2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.36","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.20E(3)(n)(i), the CDR representative must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n\n (a) deleting the redundant data; or\n (b) de‑identifying the redundant data; or\n (c) deciding, when the CDR data becomes redundant data, whether to delete it or de‑identify it.","CDR Rule 4.20N(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.37","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.38","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active","2025-09-17"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.39","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 506 and further detailed in the Explanatory Statement issued for the Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024.\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.01","CDR Rule","Data Recipient","MUST","(9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.02","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;","CDR Rule 9.3(2)(eg)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.03","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n\n(a) is given in relation to a consent in one of the following categories:\n(i) use consents relating to the goods or services requested by the CDR business consumer;\n(ii) TA disclosure consents;\n(iii) insight disclosure consents;\n(iv) business consumer disclosure consents; and\n\n(b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).\n\nNote: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.","CDR Rule 1.10A(10)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.04","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement;","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.05","CDR Rule","Data Recipient","MUST NOT","(12) An accredited person must not make:\n(b) the giving of a business consumer statement;\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.06","CDR Rule","Data Recipient","MUST","(13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.","CDR Rule 1.10A(13)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n (i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n (ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.08","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time; and\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.09","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.10","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.11","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n(a) is given in relation to a consent in one of the following categories:\n(i) use consents relating to the goods or services requested by the CDR business consumer;","CDR Rule 1.10A(10)(a)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.12","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.13","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (b), (c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.14","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.15","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.16","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.17","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-09-17"]
["1CO. Consent","04. Business consumer statement","1CO.04.18","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-09-17"]
["1CO. Consent","04. Business consumer statement","1CO.04.19","CX Guideline","Data Recipient","MAY","Data recipients should only request a business consumer statement if they have verified the consumer is a business consumer — per CDR Rule 1.10A(9) — and reasonably expect them to be intending to use the service for business purposes.\n\nAppropriate pre-consent and onboarding experiences can assist with funnelling consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for non-business consumers, and prevent consumers from inadvertently providing a business consumer statement.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.20","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 1.10A(9), when verifying the consumer is not an individual or has an active ABN, data recipients should be satisfied that the evidence given — such as the ABN — is current and relates to the consumer.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.21","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 4.11(1)(bb), data recipients must invite a business consumer to give a business consumer statement in the consent flow.\n\nThis invitation should be presented upfront. Doing so can help data recipients determine the appropriate consent duration and customer data language standards to surface, and whether a business consumer disclosure consent can be requested.","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.22","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 1.10A(10), a business consumer statement cannot be made in relation to a collection consent. As such, CDR Rule 4.12(1) stipulates that the maximum duration for collection consent is 12 months.","CDR Rule 1.10A(10), 4.12(1)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.23","CX Guideline","Data Recipient","MAY","Data recipients should only present business consumers with a pre-selected duration of more than 12 months where the service reasonably requires this and in compliance with the data minimisation principle, CDR Rule 1.8.","CDR Rule 1.8","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.24","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.25","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.26","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.27","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers fact sheet [https://www.cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.01","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(a) must comply with any relevant data standards; and \n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; ","CDR Rule 4.10(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.02","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent). ","CDR Rule 4.10(c), (d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.03","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle. ","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.04","CDR Rule","Data Recipient","MUST","(1) For the purposes of paragraph 56AJ(4)(c) of the Act, the following conditions are specified: \n(a) the person is an ADI or a relevant non-bank lender; and \n(aa) under Part 6 of this Schedule, these rules already apply to the person in their capacity as a data holder of other CDR data; and \n(b) the accredited person has collected CDR data, or any data directly or indirectly derived from CDR data (together, the relevant CDR data), in accordance with a collection consent; \n(c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data; \n(d) either: \n(i) the conditions specified in subclause (2); or \n(ii) the conditions specified in subclause (2A).","CDR Rule Clause 7.2(1) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.05","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or \n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply; \nwhere the period of consent is either: \n(iii) a single occasion; or \n(iv) a specified period of time; \n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13. ","CDR Rule 4.11(1)(b), (Note 2) |  CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.06","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months. ","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.07","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to; ","CDR Rule 4.11(3)(c)(i) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.08","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or \n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.09","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.10","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn; ","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.11","CDR Rule","Data Recipient","MUST","Conditions involving notification prior to first collection \n\n(2) For subparagraph (1)(d)(i), the conditions are:\n(a) either:\n(i) the accredited person is supplying the product to the CDR consumer; or\n(ii) the accredited person has received an application from the CDR consumer for the supply of the product to the CDR consumer, or is aware that the CDR consumer proposes to apply for the supply of the product; and\n(b) prior to the first collection of the relevant CDR data in accordance with the collection consent, the accredited person notified the CDR consumer that the accredited person would hold that data in accordance with the accredited person’s usual data holding practices for consumer data.\n\nNote: If, prior to the first collection of the relevant CDR data, an accredited person has notified the CDR consumer in accordance with this subclause, the accredited person does not need to notify the CDR consumer again before collecting further data in accordance with the collection consent. ",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.13","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent; ","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.14","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.15","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for language to be used when requesting banking data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.16","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.17","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.18","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.19","CX Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.20","CX Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.21","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.22","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.23","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter. ","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.24","CX Guideline","Data Recipient","MAY","Data recipients should list data holders in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders). ","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.25","CX Guideline","Data Recipient","MAY","Data recipients implementing CDR Rule Clause 7.2(2) need only comply with rules and standards for collection consents. Authorised deposit-taking institutions (ADIs) or non-bank lenders (NBLs) who are accredited persons, do not need to comply with CDR requirements for other consent types (such as use, de-identification, or disclosure). \n\nThese entities may use and disclose the collected data according to their usual data handling practices for the use case, even when these practices extend beyond the use and disclosure constraints in the CDR rules.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.26","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion'). \n\nExample DMP statement for data that is yet to be generated: \nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management]. \n\nExample DMP statement for historical data: \nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison]. ",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.27","CX Guideline","Data Recipient","MAY","Data recipients should identify whether the user is sharing individual or non-individual accounts in order to surface the correct data language.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.28","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.29","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets. \n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets. ","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.30","CX Guideline","Data Recipient","MAY","Privacy Safeguard 12 and the requirements to inform the consumer of the data recipient's redundant data handling practices do not apply, as the accredited ADI/NBL would would be handling the collected data in their capacity as a data holder.","CDR Rule 4.11(1)(e), 4.11(3)(h), 4.16, 4.17, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]; Withdrawal Standards, Withdrawing authorisation: Redundant data [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.31","CX Guideline","Data Recipient","MAY","If the data recipient uses an outsourced service provider (OSP) to facilitate the collection of CDR data on their behalf, they must provide the details outlined in CDR Rule 4.11(3)(f). For more details, see https://cx.dsb.gov.au/consent/collection-and-use-consents#block-1a1cbbcc3b934e85a5b966f2f8e560dc.\n\nIn instances where CDR data will only be disclosed to an OSP after collection, the data recipient does not need to provide these details. ","CDR Rule 4.11(3)(f)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.32","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.33","CX Guideline","Data Recipient","MAY","Data recipients may display the notification outlined in CDR Rule Clause 7.2(2)(b) of Schedule 3 as part of the terms for consent when seeking a collection consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.34","CX Guideline","Data Recipient","MAY","Regarding collection consent, CDR Rule 4.11(1)(c) requires data recipients to obtain the consumer's express consent to: \n• collect specific types of CDR data \n• collect that data for a specified time period ","CDR Rule 4.11(1)(a), (b), (c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.35","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.36","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.01","CDR Rule","Data Recipient","MUST","(1) For the purposes of paragraph 56AJ(4)(c) of the Act, the following conditions are specified: \n(a) the person is an ADI or a relevant non-bank lender; and \n(aa) under Part 6 of this Schedule, these rules already apply to the person in their capacity as a data holder of other CDR data; and \n(b) the accredited person has collected CDR data, or any data directly or indirectly derived from CDR data (together, the relevant CDR data), in accordance with a collection consent; \n(c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data; \n(d) either: \n(i) the conditions specified in subclause (2); or \n(ii) the conditions specified in subclause (2A).","CDR Rule Clause 7.2(1) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.02","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(a) the accredited person is supplying the product to the CDR consumer; and \n(b) the accredited person has requested the CDR consumer to consent to the accredited person changing from an accredited data recipient of the relevant CDR data to a data holder of the relevant CDR data; ","CDR Rule Clause 7.2(2A)(a), (b) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.03","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(c) the accredited person has informed the CDR consumer: \n(iii) why the accredited person was entitled to request the consumer’s consent to the change; ","CDR Rule Clause 7.2(2A)(c)(iii) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.04","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(c) the accredited person has informed the CDR consumer: \n(i) that, if the consumer consents to that change, the privacy safeguards applicable to a data holder (rather than those applicable to an accredited data recipient) would apply to the accredited person in relation to the relevant CDR data;","CDR Rule Clause 7.2(2A)(c)(i) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.05","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that:(c) the accredited person has informed the CDR consumer: \n(ii) of the manner in which the accredited person proposes to treat the relevant CDR data; ","CDR Rule Clause 7.2(2A)(c)(ii) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.06","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(d) the CDR consumer has consented.","CDR Rule Clause 7.2(2A)(d) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.07","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(c) the accredited person has informed the CDR consumer: \n(iv) of the consequences of the consumer not giving their consent to the change; ","CDR Rule Clause 7.2(2A)(c)(iv) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.08","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for language to be used when requesting banking data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.09","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.10","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.11","CX Guideline","Data Recipient","MAY","When requesting for consent to become a data holder of the collected data, the accredited person should clearly display information about the data that will be handled under different protection frameworks.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.12","CX Guideline","Data Recipient","MAY","It is at the data recipient’s discretion in how they phrase the consequences of not giving consent as per Clause 7.2(2A)(c)(iv) of Schedule 3. \n\nFor example, they may offer alternative data collection methods if the consumer chooses to decline this permission, though they should consider emphasising the benefits of using CDR over these alternatives.","CDR Rule Clause 7.2(2A)(c)(iv) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.01","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.02","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.03","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.04","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.05","CX Guideline","Data Recipient","MAY","In cases where the brandGroup field is specified by the data holder, data recipients can visually present the related data holder/white label brands under a single grouping.","CDR Support Portal: White Labelled brands in the CDR [https://cdr-support.zendesk.com/hc/en-us/articles/900003938166-White-Labelled-brands-in-the-CDR]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.06","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.01","CX Guideline","Data Recipient","MAY","CX research has demonstrated that transparency during the onboarding process, such as to outline what the ADR will and will not do with the consumer's data, increases the trustworthiness of the process and propensity to willingly consent.","CX Research: 2019 Phase 1; 2019 Phase 2, Stream 1-2","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.02","CX Guideline","Data Recipient","MAY","Appropriate pre-consent and onboarding experiences should be considered to funnel consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for consumers, and prevent consumers from inadvertently being presented incorrect steps and details.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.03","CX Guideline","Data Recipient","MAY","For disclosure consents, where the data recipient does not intend to offer the ability to actively select the disclosure recipient, it is recommended they clearly and upfront state who the disclosure recipient will be and their data handling practices as part of pre-consent. This supports informed consent and transparency.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.04","CX Guideline","Data Recipient","MAY","The following tools, models, and bodies of evidence can be used by CDR participants to inform the way they design value propositions and onboarding. These approaches have been demonstrated to support trustworthiness, increase propensity to consent, and influence perceptions of data sharing under the CDR. The following artefacts, based on CX research, provide useful behavioural insights:\n• Fogg Behavior Model – This model identifies three elements—Motivation, Ability, and a Prompt—as key to driving behaviour change. CX research (2019, 2021–2022) used this model to test various CDR value propositions as prompts, gauging consumer participants’ motivation and ability to proceed. For specific examples, see https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2#block-67baf9e84f3840a99895ae1269005da9 and https://cx.dsb.gov.au/overview/cx-reports/reports/one-time-password-research-report-q3-2022-r1#block-184993a5de9542acb85e07537b48d896.\n• Switching Canvas – This artefact captures the push and pull factors influencing whether consumers try something new. CX research (2019–2020) used it to explore consumer attitudes towards CDR and data sharing across various use cases. For more information, including a summary of factors, see https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80cdb723db0b24fcbd35.\n• Trust–Benefit Scale – This artefact explores attitudes and generalised characteristics across different scenarios. CX research (2020) used it to map consumer trust in CDR processes against perceived benefits from the data recipient. For more information, including generalised characteristics and attitudes, see https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80cdb723db0b24fcbd35.\n• Behavioural Archetypes – These archetypes describe four key behavioural segments based on attitudes, needs, and likelihood to consent. Developed and iterated through CX research (2020–2025), they provide a foundation for tailoring value propositions and content to different consumer types. For more information, see https://cx.dsb.gov.au/overview/behavioural-archetypes.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.05","CX Guideline","Data Recipient","MAY","Data recipients should clearly communicate the value of sharing data as part of the CDR. This may include information on the CDR process, data handling and data protections.","CX Research: 2019 Phase 1; 2020 Phase 3; 2021 Disclosure consent; 2022 Consent Review; Other 2022, 2023 (unpublished)","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.06","CX Guideline","Data Recipient","MAY","The CDR Rules do not prohibit alternative methods of data sharing. However, requests to obtain data through non-CDR mechanisms must remain separate from CDR consents. For more details, see https://cdr-support.zendesk.com/hc/en-us/articles/900005316646-Guidance-on-screen-scraping.","CDR Support Portal: Guidance on screen-scraping [https://cdr-support.zendesk.com/hc/en-us/articles/900005316646-Guidance-on-screen-scraping]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.07","CX Guideline","Data Recipient","MAY","Where possible and appropriate, data recipients may provide alternative methods for data access based on the use case, customer preferences, and to support voluntary consent. This may include manual upload.\n\nHowever, data recipients may also highlight the benefits of using CDR over alternatives, such as being considered a safer, more secure, and increasingly viable method for data access — particularly with the introduction of multi-factor authentication and other security controls that prevent other methods from being reliable or used at all.","CX Research: 2019 Phase 2, Stream 1-2; Other 2022, 2023 (unpublished)","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.08","CX Guideline","Data Recipient","MAY","CX research has shown that consumers are more likely to willingly consent when the value of doing so is clearly outlined before consent is requested.\n\nThis includes helping consumers understand:\n• Effort required – A simple statement like “This should only take a few minutes” helps set expectations and reduce friction.\n• Trust and confidence in data handling – Different consumer behavioural archetypes respond to different cues:\n    ◦ Sceptics gain confidence when they know who is involved and how their data will be handled.\n    ◦ Assurance seekers are reassured when the role of the government and data handling protections are explained.\n    ◦ Sensemakers benefit from a concise overview of how data is accessed, controlled, and protected in CDR.\n    ◦ Enthusiasts respond well to clear references to the government’s role, which reinforces trust.\n\nPresenting this information upfront helps build trust, reduce uncertainty, and increase the likelihood of consent.","CX Research: 2021 Disclosure consent","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.09","CX Guideline","Data Recipient","MAY","Accredited persons can use the CDR logo after accepting a Trade Mark Licencing Agreement (TMLA) with the ACCC. The CDR logo is a registered trade mark owned by the Commonwealth of Australia, and entities may only use the CDR logo for the Licensed Purpose specified in the TMLA.\n\nInline with the licence, \n• Prior to the consent request, the CDR logo can be used in relation to the CDR option and after its selection to support education and onboarding. \n• Accredited persons are permitted to use the CDR logo for 'collection' and 'use' consents, but not for 'disclosure' alone. The CDR logo may be used if collection, use, and disclosure consents are bundled in a single journey.\n• CDR representatives cannot use the CDR logo because they do not fall into a class of persons who can use the CDR logo for a Licensed Purpose.\n\nUse of the CDR logo helps facilitate consistency, familiarity, and trust in the CDR ecosystem.","CX Research: 2019 Phase 2, Stream 1 and 3 | ACCC CDR logo - Fact sheet [https://www.cdr.gov.au/resources/fact-sheets-providers#goto-cdr-logo]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.10","CX Guideline","Data Recipient","MAY","Data recipients should include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.\n\nReferencing government accreditation or trusted parties provides social proof, which increases trust and legitimacy. CX research found this gave consumers instant reassurance and positively influenced their decision to continue.\n\nThis was especially valued by the Assurance Seeker, Sensemaker, and Enthusiast behavioural archetypes.","CX Research: 2019 Phase 2, Stream 1; 2020 Phase 3, Round 3","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.11","CX Guideline","Data Recipient","MAY","Data recipients should include a pre-consent step before a consumer’s first consent. Pre-consent may not be necessary for subsequent consent flows, unless significant time has passed since the consumer’s last consent.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.12","CX Guideline","Data Recipient","MAY","Information presented throughout the CDR journey should adhere to the https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards. This includes: \n• making it easier to see and hear content, including separate foreground information from the background; \n• making all functionality available from a keyboard; \n• making it easier to operate functionality using various input devices; \n• making text content readable and understandable; \n• helping users avoid and correct mistakes.","CX Research: 2019 Phase 2, Stream 1","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.13","CX Guideline","Data Recipient","MAY","These artefacts focus on the general CDR proposition and pre-consent experience. Additional considerations apply for specific consent types. For further guidance, see CX Guidelines:\n• https://cx.dsb.gov.au/consent/collection-and-use-consents#block-853072439fd14fa5a05a92159b3c7712\n• https://cx.dsb.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents#block-1bbf1af016ea8033a671f212cbd93ab5\n• https://cx.dsb.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents\n• https://cx.dsb.gov.au/consent/disclosure-consents/insight-disclosure-consents\n• https://cx.dsb.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.14","CX Guideline","Data Recipient","MAY","The ability to return to earlier steps should be present and visible wherever possible throughout the consent flow to ensure user control and freedom.","10 Usability Heuristics for User Interface Design: User control and freedom (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.15","CX Guideline","Data Recipient","MAY","CDR participants should use visual cues, such as text styling and icons, to help break up content and assist in making content scannable, digestible and memorable.\n\nThis was especially valued by Enthusiast, Assurance seeker, Sensemaker behavioural archetypes.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]; 2021 Disclosure Consent","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.16","CX Guideline","Data Recipient","MAY","Data recipients should provide upfront information to help consumers understand and trust the process. CX research found that clear, early guidance increased confidence and helped consumers feel informed.\n\nWhen explaining the major stages of the Consent Flow, use plain, consistent language—such as Choose, Connect, and Confirm. Repeating these terms throughout the journey helps build familiarity with the CDR process.\n\nProviding this context before entering the flow encouraged users to explore CDR and reduced perceptions that the process was a ‘marketing trick’.\n\nThis was especially valued by the Sceptic, Sensemaker, and Enthusiast behavioural archetypes.","CX Research: 2021 Disclosure Consent | 10 Usability Heuristics for User Interface Design: Consistency and standards (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.17","CX Guideline","Data Recipient","MAY","To build trust, encourage adoption, and support understanding across all behavioural archetypes, data recipients should clearly and briefly indicate how they handle and protect consumer data. CX research found that this may include:\n• How data is protected\n• Not selling or sharing data without consent\n• Simple ways to manage or stop sharing at any time\n• Whether data will be deleted or de-identified after a set period\n• What happens in the event of a security breach\n• Links to CDR protections, complaint handling and other trusted sources\n\nTo reduce drop-off and improve completion, data recipients are encouraged to provide this information upfront during Pre-consent. This information is also required to be surfaced at key points in the Consent Model. For details, refer to the relevant stage in the https://cx.dsb.gov.au/.\n\nCX research found this helped consumers feel informed and more confident in continuing.","CX Research: 2019 Phase 1; 2019 Phase 2; 2021 Disclosure consent; 2022 Consent Review; Other 2022, 2023 (unpublished)","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","01. Product value proposition","1CO0.01.","CDR Rule","Data Recipient","MUST NOT","Data recipients MUST NOT bundle consent with unrelated purposes.\n\nData recipients MUST NOT infer consent or rely on an implied consent.","CDR Rule 4.10(b)(ii), 4.11(1)(Note 1) |  CX Research 36 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 37 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","01. Product value proposition","1CO0.01.","CX Guideline","Data Recipient","MAY","Data recipients should build trust and onboard the consumer to the service itself before presenting a data request.","CX Research 1, 25, 28, 31 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 37 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CX Guideline","Data Recipient","MAY","Consent should be a genuine choice. Data recipients should avoid making consent a precondition of service.","CX Research 26 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CX Guideline","Data Recipient","MAY","The data recipient should include CDR branding (for example, a CDR logo) as provided by the ACCC where appropriate.","CX Research 23 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CX Guideline","Data Recipient","MAY","Data recipients should clearly communicate the value of sharing data as part of the CDR.","CX Research 25 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CDR Rule","Data Recipient","MUST","Data recipients MUST conform with the CDR Rules on consent, including that consent must be voluntary; express; informed; specific as to purpose; time limited; and easily withdrawn.","CDR Rule 4.9","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","03. CDR value proposition - Accreditation information","1CO0.03.","CX Guideline","Data Recipient","MAY","The ability to go backwards should be present and visible wherever possible throughout the consent flow to ensure user control and freedom.","10 Usability Heuristics for User Interface Design: User control and freedom (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","CX Guidelines v1.4.0 PDF, p. 40 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","03. CDR value proposition - Accreditation information","1CO0.03.","CX Guideline","Data Recipient","MAY","The data recipient should use CDR branding provided by the ACCC to facilitate consistency, familiarity, and trust in the CDR ecosystem.\n\nThe data recipient should provide instructions for how consumers can verify a data recipient’s accreditation via an ACCC-provided URL once the ACCC makes this functionality available.","CX Research 13, 23 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 40 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","03. CDR value proposition - Accreditation information","1CO0.03.","CDR Rule","Data Recipient","MUST","The data recipient must present their name and accreditation number to the consumer.","CDR Rule 4.11(3)(a),(b)","CX Guidelines v1.4.0 PDF, p. 40 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CX Guideline","Data Recipient","MAY","CDR information should have full translation functionality and be fully screen-reader accessible.","CX Research 16 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CX Guideline","Data Recipient","MAY","Data recipients should clearly state key things that are important to their customers. This should include how data will not be used, even if these uses are prohibited CDR. \n\nExamples may include:\n- We don’t share or use your data without your consent\n- We don’t sell your data to anyone \n- We don’t share your data for marketing purposes","CX Research 24 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CX Guideline","Data Recipient","MAY","Data recipients should provide information, where applicable, about measures taken in case of security breaches.","CX Research 14 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CDR Rule","Data Recipient","MUST","Data recipients MUST include clear and unambiguous information on how CDR data will be handled upon consent expiry/withdrawal. This SHOULD be presented up front, and wherever applicable throughout the consent model.","CDR Rules 4.9, 4.11(3)(h) | CX Research 33 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","05. CDR value proposition - Data sharing rules (2)","1CO0.05.","CX Guideline","Data Recipient","MAY","Consent should be a genuine choice. Data recipients should avoid making consent a precondition of service.","CX Research 26 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 42 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","05. CDR value proposition - Data sharing rules (2)","1CO0.05.","CDR Rule","Data Recipient","MUST","The CDR policy MUST be available through online services where the data recipient ordinarily deals with CDR consumers.\n\nIt MUST be in the form of a document that is separate from the data recipient’s private policy","CDR Rules 7.2(8), 7.2(2)","CX Guidelines v1.4.0 PDF, p. 42 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","07. CDR value proposition - CDR data sharing instructions","1CO0.07.","CX Guideline","Data Recipient","MAY","Data recipients should provide simple, upfront instructions on how to share data with the CDR, including the time it takes to complete the process. \n\nFor example: ‘This should only take a few minutes.’",null,"CX Guidelines v1.4.0 PDF, p. 46 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","07. CDR value proposition - CDR data sharing instructions","1CO0.07.","CX Guideline","Data Recipient","MAY","Data recipients should use the terms Consent, Connect, Confirm to represent each major stage of the consent flow. \n\nThese terms should be used throughout the flow to maintain consistency and to help users to become familiar with sharing steps.","10 Usability Heuristics for User Interface Design: Consistency and standards (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","CX Guidelines v1.4.0 PDF, p. 46 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.01","CDR Rule","Data Recipient","MUST NOT","(1A) An accredited person must not ask a CDR consumer to give a disclosure consent in relation to CDR data unless the consumer has already given the collection and use consents required to collect the CDR data to be disclosed.","CDR Rule 4.11(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.02","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent:\n(a) that is not in a category of consents; or\n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:\n(i) identifying; or\n(ii) compiling insights in relation to; or\n(iii) building a profile in relation to;\nany identifiable person who is not the CDR consumer who made the consumer data request.\n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:\n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and\n(b) use that derived CDR data in order to provide the requested goods or services.","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.03","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.04","CDR Rule","Data Recipient","MUST NOT","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and \n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(c)–(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.05","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply; where the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.08","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2024-03-06"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.12","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) the following information about withdrawal of consents:\n(ii) instructions for how the consent can be withdrawn;","CDR Rule 4.11(3)(g)(ii) | CX Research 7 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.13","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.14","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.15","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time: \n(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.","CDR Rule 4.13(1)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.16","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.17","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.18","CDR Rule","Data Recipient","MUST","For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:\n(a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;\n(b) make a record to evidence the deletion; and\n(c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.","CDR Rule 1.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.19","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.20","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.21","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.22","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.23","CX Standard","Data Recipient","MUST","If: \n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.27","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.28","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.29","CX Guideline","Data Recipient","MAY","Data recipients should show the accredited person’s accreditation number to facilitate consumer trust.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.30","CX Guideline","Data Recipient","MAY","Data recipients should provide a link to their CDR policy.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.32","CX Guideline","Data Recipient","MAY","Data recipients should encourage consumers to check the accredited person’s data handling policies before consenting to have their data disclosed.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.33","CX Guideline","Data Recipient","MAY","Data recipient should include their CDR policy in their CDR receipts.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.34","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.29.1","2024-03-06","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.35","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an AP disclosure consent from a CDR consumer should refer to CDR Rule 4.3B(2) and Division 4.3A of the CDR Rules.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.36","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.37","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.38","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","Part 50—Transitional provisions, CDR Rule 503, Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.39","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.40","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s). \n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data. \n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.41","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025. \n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives). \n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.09","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.10","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.11","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1). ","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.24","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.25","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.26","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.31","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.01","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.02","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.03","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de‑identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.04","CX Standard","Data Recipient","MUST","If:\n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.05","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.06","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.07","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.08","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.09","CX Guideline","Data Recipient","MAY","To describe data in easy to understand language, data recipients should have regard to the Accessibility Standards on reading experiences, with specific reference to WCAG success criteria 3.1.5, and draw from the Australian Government Style Guide on literacy and access.\n\nData recipients should, for example, describe data concisely, in plain language, with an Australian year 7 or lower readability level, and in a way that limits the use of unusual words, phrases, idioms, and jargon.","Accessibility Standards, Accessibility: Reading experiences [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards] | WCAG Success Criterion 3.1.5 Reading Level (Level AAA) [https://www.w3.org/TR/WCAG22/#reading-level] | Literacy and access (Australian Government Style Manual) [https://www.stylemanual.gov.au/user-needs/understanding-needs/literacy-and-access]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.10","CX Guideline","Data Recipient","MAY","In some scenarios, data recipients may not be able to identify the sector the data was derived from. This may occur, for example, in complex disclosure chains, significantly modified datasets, and in relation to sector-agnostic data.\n\nIn such scenarios, data recipients should describe the data in a way that is specific, meaningful, and comprehensible to the consumer.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data;\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.02","CDR Rule","Data Recipient","MUST","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; any identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3)–(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.03","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and\n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.04","CDR Rule","Data Recipient","MUST","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1). ","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.05","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(ba) in the case of a disclosure consent―either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or \n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: (b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or \n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply; where the period of consent is either: \n(iii) a single occasion; or \n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.08","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months. ","CDR Rule 4.12(1) | CX Research 4, 5","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.09","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:  \n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;","CDR Rule 4.11(3)(c)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.10","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.11","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(aa) in the case of a use consent—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or \n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.13","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.14","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.15","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.16","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.17","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.18","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: (a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.19","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.20","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.21","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.22","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.23","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.24","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.25","CX Standard","Data Recipient","MUST","If: \n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; \n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.26","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.27","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the terms of consent, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the terms of consent. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.28","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use\n[https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.29","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.30","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.31","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an AP disclosure consent from a CDR consumer should refer to CDR Rule 4.3B(2) and Division 4.3A of the CDR Rules.","CDR Rules 4.3B(2), Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.32","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards; \n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data. \n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.33","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.  \n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.  \n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a disclosure recipient and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this disclosure recipient. ","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.34","CX Guideline","Data Recipient","MAY","Data recipients should show the accredited person’s accreditation number to facilitate consumer trust.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.35","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion'). \n\nExample DMP statement for data that is yet to be generated: \nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management]. \n\nExample DMP statement for historical data: \nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.36","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.37","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets. \n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.38","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.39","CX Guideline","Data Recipient","MAY","Data recipients should encourage consumers to check the accredited person’s data handling policies before consenting to have their data disclosed.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.40","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.41","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.42","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide information in relation to complaint handling at appropriate points throughout the Consent Model, such as: \n• during Pre-consent; \n• within the Consent Flow; and/or \n• within the CDR Receipt and/or Consumer Dashboards. ","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.43","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.44","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.45","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.  \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.  \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure. \n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model. ","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.46","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025. \n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives). \n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date. ","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.47","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.48","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.49","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.50","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.36.0","2026-03-18","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.01","CDR Rule","Data Recipient","MUST","(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.","CDR Rule 4.12B(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.02","CDR Rule","Data Recipient","MUST","(2) The accredited person may give the invitation:\n\n(a) if its consumer dashboard allows a consent amendment in accordance with subrule 1.14(2A)―via its consumer dashboard; or\n\n(b) in writing directly to the CDR consumer.﻿","CDR Rule 4.12B(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.03","CDR Rule","Data Recipient","MUST","(3) The accredited person may invite a CDR consumer to amend a current consent if:\n(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or\n(b) the amendment would:\n(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and\n(ii) enable the accredited person to provide the modified goods or services.","CDR Rule 4.12B(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire;","CDR Rule 4.12B(4)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.05","CDR Rule","Data Recipient","MUST NOT","(5) The accredited person must not give such an invitation before 1 July 2021.","CDR Rule 4.12B(5)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2024-05-01"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.06","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(b) give more than a reasonable number of such invitations within this period.","CDR Rule 4.12B(4)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.07","CDR Rule","Data Recipient","MUST","(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.\n\nExample: If an accredited person asks a CDR consumer who gave a consent as a CDR business consumer to amend a consent of a kind mentioned in paragraph 1.10A(10)(a), the accredited person must invite the CDR consumer to provide a further business consumer statement: see paragraph 4.11(1)(bb).","CDR Rule 4.12C(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2024-05-01"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.08","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent:\n(a) that is not in a category of consents; or\n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:\n(i) identifying; or\n(ii) compiling insights in relation to; or\n(iii) building a profile in relation to;\nany identifiable person who is not the CDR consumer who made the consumer data request.\n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:\n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and\n(b) use that derived CDR data in order to provide the requested goods or services.","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.09","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n\n(a) must comply with any relevant data standards; and\n\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(1)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.10","CDR Rule","Data Recipient","MUST NOT","A request by an accredited person for a CDR consumer to give or amend a consent: \n\n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(1)(c), (d)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.11","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.30","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.31","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division;","CDR Rule 4.18(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.32","CDR Rule","Data Recipient","MUST","(2A) A CDR receipt given for the purposes of paragraph (1)(aa) must set out details of each amendment that has been made to the consent.","CDR Rule 4.18(2A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.36","CX Guideline","Data Recipient","MAY","Data recipients should present the realised benefits of data sharing as part of amending consent requests so consumers can assess the material value of providing consent.","CX Research: 2020 Phase 3, Round 3 report [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/05/CX-Report-_-Phase-3-_-Round-3.pdfhttps://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.42","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.58","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.59","CX Guideline","Data Recipient","MAY","CDR Representatives inviting consumers to amend their consent should refer to https://www.legislation.gov.au/F2020L00094/2023-07-22/2023-07-22/text/original/epub/OEBPS/document_1/document_1.html#_Toc143251412 of the CDR Rules.","CDR Rules Subdivision 4.3A.3","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.60","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-08-04"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.63","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.64","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.65","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Retired","2025-08-04"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.12","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies\nwith the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.13","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.14","CDR Rule","Data Recipient","MUST","(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer:\n(a) a statement that indicates the consequences of amending a consent; and\n(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.","CDR Rule 4.12C(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.15","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.16","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.17","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.18","CDR Rule","Data Recipient","MUST","(2) Despite subrule 4.11(2), in the case of an amendment to a consent, an accredited person may present, as pre-selected options, the following details of the current consent:\n(a) the selections or indications referred to in paragraphs 4.11(1)(a), (b) and (ba);\n(b) the election (if any) referred to in paragraph 4.11(1)(e).","4.12C(2)(a),(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.19","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months: see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13. ","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.20","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2024-05-01"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.21","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) the following information about withdrawal of consents:\n(ii) instructions for how the consent can be withdrawn;","CDR Rule 4.11(3)(g)(ii) | CX Research 7 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n\n(g) a statement that, at any time, the consent can be withdrawn.","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.23","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.24","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.","CDR Rule 4.13(1)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.25","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.26","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.27","CDR Rule","Data Recipient","MUST","For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:\n(a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;\n(b) make a record to evidence the deletion; and\n(c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.","CDR Rule 1.18","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.28","CDR Rule","Data Recipient","MUST","(4) In addition to the information referred to in subsection 56ED(5) of the Act, an accredited data recipient’s CDR policy must:\n(f) include the following information about deletion of redundant CDR data:\n(i) when it deletes redundant data;\n(ii) how a CDR consumer may elect for this to happen;\n(iii) how it deletes redundant data;","CDR Rule 7.2(4)(k)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.29","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) ask for the CDR consumer’s express consent to the choices referred to in paragraphs (a), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.33","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.34","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.35","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.37","CX Guideline","Data Recipient","MAY","Data recipients should communicate that consent will expire if request is not actioned.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.38","CX Guideline","Data Recipient","MAY","Data recipients should outline the consequences of not continuing to consent - such as service or data loss. This should include information about how data will be handled if re-consent is not provided.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.39","CX Guideline","Data Recipient","MAY","Data recipients should provide multiple reminders to warn consumers that their consent is about to expire. Such reminders should not be sent at unnecessarily high frequencies so as to cause notification fatigue.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.40","CX Guideline","Data Recipient","MAY","Data recipients should provide a clear ‘withdraw consent’ option in addition to allowing expiry by default.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.41","CX Guideline","Data Recipient","MAY","Data recipients should provide the cdr_arrangement_id of the consent to the data holder as part of the amendment process. This will provide consumers with a streamlined authorisation experience as required in the amending authorisation standards.","Amending Authorisation Standards [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.43","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.44","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.45","CX Guideline","Data Recipient","MAY","ADRs should present attributes to be amended in a way that is clearly distinct to attributes that have already been consented to. This may require specific design patterns and/or the use of signifiers, such as 'new' labels, to denote the change being requested.","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.46","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.47","CX Guideline","Data Recipient","MAY","Data recipients should outline how often data is expected to be collected over that period.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.48","CX Guideline","Data Recipient","MAY","Most research participants expected their data to be deleted when sharing was withdrawn or expired. Data recipients can avoid the election step within the consent flow if they have general policy of deletion.\n\nIf data recipients need to include this in-flow election, they should allow the consumer to elect that they ‘remember’ their preference for subsequent requests.","CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.49","CX Guideline","Data Recipient","MAY","Amendments to collection duration or dataset collection require data holder authentication and authorisation.\n\nAmendments to disclosure consents, use consents, including adding/removing uses or amending disclosure and/or use durations, do not require data holder authentication and authorisation.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.50","CX Guideline","Data Recipient","MAY","Data recipients should surface information about data deletion found in their CDR policy along with a link to read this policy.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.51","CX Guideline","Data Recipient","MAY","Data recipients that have a general policy of deleting consumer data should inform the consumer if they are required to keep data for legal reasons.","CX Research 33 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.52","CX Guideline","Data Recipient","MAY","Data recipient should include their CDR policy in their CDR receipts.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.53","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient.","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.54","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications. The use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.55","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide information in relation to complaint handling at appropriate points throughout the Consent Model, such as during Pre-consent; within the Consent Flow; and/or within the CDR Receipt and/or Consumer Dashboards.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.56","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.57","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.61","CX Standard","Data Recipient","MUST","When notifying a Data Holder of an amended collection consent as per rules 4.18C or 4.20S, Data Recipients MUST supply the relevant CDR Arrangement ID to the Data Holder according to https://consumerdatastandardsaustralia.github.io/standards/#specifying-an-existing-arrangement. Providing the CDR Arrangement ID is necessary to trigger the Data Holder authorisation flow simplifications outlined in the https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards. Failure to supply the CDR Arrangement ID will result in the full authorisation flow and a disconnected data sharing arrangement history on consumer dashboards.","Consent Standards, Consent: Amendment of Collection Consents and Authorisations [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.62","CX Standard","Data Recipient","MUST","Data recipients MUST indicate where datasets, uses, and durations are being amended.\n\nData recipients MAY apply this standard to other changing attributes where the attribute in the amending consent request differs to that of the previous consent. How a changed attribute is signified is at the data recipient’s discretion. ","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.66","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.67","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.68","Common Standard","Data Recipient","MAY","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.01","CDR Rule","Data Recipient","MUST","(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.","CDR Rule 4.12B(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.02","CDR Rule","Data Recipient","MUST","(2) The accredited person may give the invitation:\n(b) in writing directly to the CDR consumer.","CDR Rule 4.12B(2)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.03","CDR Rule","Data Recipient","MUST","(3) The accredited person may invite a CDR consumer to amend a current consent if:\n(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or\n(b) the amendment would:\n(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and\n(ii) enable the accredited person to provide the modified goods or services.","CDR Rule 4.12B(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire;","CDR Rule 4.12B(4)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.05","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(b) give more than a reasonable number of such invitations within this period.","CDR Rule 4.12B(4)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.06","CDR Rule","Data Recipient","MUST","(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.\nExample: If an accredited person asks a CDR consumer who gave a consent as a CDR business consumer to amend a consent of a kind mentioned in paragraph 1.10A(10)(a), the accredited person must invite the CDR consumer to provide a further business consumer statement: see paragraph 4.11(1)(bb).","CDR Rule 4.12C(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.08","CDR Rule","Data Recipient","MUST","(4) If the CDR consumer gave the consent as a CDR business consumer, the accredited person must take reasonable steps to re‑confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.\nNote: See subrule 1.10A(9).","CDR Rule 4.12C(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.09","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.10","CDR Rule","Data Recipient","MUST","(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer:\n(a) a statement that indicates the consequences of amending a consent; and\n(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.","CDR Rule 4.12C(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.11","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.13","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.14","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.15","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.16","CDR Rule","Data Recipient","MUST","(2) Despite subrule 4.11(2), in the case of an amendment to a consent, an accredited person may present, as pre‑selected options, the following details of the current consent:\n(a) the selections or indications referred to in paragraphs 4.11(1)(a), (b) and (ba);","CDR Rule 4.12C(2)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.17","CDR Rule","Data Recipient","MUST","(2A) A CDR receipt given for the purposes of paragraph (1)(aa) must set out details of each amendment that has been made to the consent.","CDR Rule 4.18(2A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.18","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division;","CDR Rule 4.18(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.19","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.20","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.21","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.22","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.23","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-09-22"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.24","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-09-22"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.25","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.26","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.27","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.28","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.29","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.30","CX Guideline","Data Recipient","MAY","Data recipients should communicate that consent will expire if request is not actioned.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.31","CX Guideline","Data Recipient","MAY","Data recipients should outline the consequences of not continuing to consent - such as service or data loss. This should include information about how data will be handled if re-consent is not provided.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.32","CX Guideline","Data Recipient","MAY","Data recipients should provide multiple reminders to warn consumers that their consent is about to expire. Such reminders should not be sent at unnecessarily high frequencies so as to cause notification fatigue.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.33","CX Guideline","Data Recipient","MAY","ADRs should present attributes to be amended in a way that is clearly distinct to attributes that have already been consented to. This may require specific design patterns and/or the use of signifiers, such as 'new' labels, to denote the change being requested.","Amending Authorisation Standards, Authorisation: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.34","CX Guideline","Data Recipient","MAY","Data recipients should include their CDR policy in their CDR receipts. ",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.35","CX Standard","Data Recipient","MUST","Data recipients MUST indicate where datasets, uses, and durations are being amended. \n\nData recipients MAY apply this standard to other changing attributes where the attribute in the amending consent request differs to that of the previous consent. How a changed attribute is signified is at the data recipient’s discretion. ","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.36","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-09-22"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.37","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [http://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.38","CX Guideline","Data Recipient","MAY","This flow demonstrates an amendment to a business consumer disclosure consent only. Data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10). Other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months.\n\nA detached disclosure consent amendment may occur where the original disclosure consent was given separate to the associated collection and use consents.\n\nIt may also occur where a bundled collection, use and disclosure consent was given, but different durations were selected for the disclosure consent and the collection consent. If this approach were taken, collection consent renewals would still need to be requested at least every 12 months, inline with the collection duration originally consented to.\n\nTo avoid detached amendments for consents originally given in a bundled fashion, data recipients may alternatively choose to propose a single duration of up to 12 months for all requested consents when inviting the consumer to give the initial consent. This would allow the data recipient to invite the consumer to renew all the consent types in a single action.","CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.39","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.40","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.41","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.01","CDR Rule","Data Recipient","MUST","(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.","CDR Rule 4.12B(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.02","CDR Rule","Data Recipient","MUST","(2) The accredited person may give the invitation:\n(b) in writing directly to the CDR consumer.","CDR Rule 4.12B(2)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.03","CDR Rule","Data Recipient","MUST","(3) The accredited person may invite a CDR consumer to amend a current consent if: \n(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or \n(b) the amendment would: \n(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and \n(ii) enable the accredited person to provide the modified goods or services.","CDR Rule 4.12B(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire;","CDR Rule 4.12B(4)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.05","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(b) give more than a reasonable number of such invitations within this period.","CDR Rule 4.12B(4)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.06","CDR Rule","Data Recipient","MUST","(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.\n\nExample: If an accredited person asks a CDR consumer who gave a consent as a CDR business consumer to amend a consent of a kind mentioned in paragraph 1.10A(10)(a), the accredited person must invite the CDR consumer to provide a further business consumer statement: see paragraph 4.11(1)(bb).","CDR Rule 4.12C(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.08","CDR Rule","Data Recipient","MUST","(4) If the CDR consumer gave the consent as a CDR business consumer, the accredited person must take reasonable steps to re‑confirm that:(a) the CDR consumer is not an individual; or(b) the CDR consumer has an active ABN.\nNote: See subrule 1.10A(9).","CDR Rule 4.12C(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.09","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.10","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; \nany identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.11","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and\n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.13","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.14","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.15","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must: \n(a) not specify a period of time that is more than 7 years; and \n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.16","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.17","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.18","CDR Rule","Data Recipient","MUST","(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer: \n(a) a statement that indicates the consequences of amending a consent; and\n(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.","CDR Rule 4.12C(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.19","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.20","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.21","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn.","CDR Rule 4.11(3)(g)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(h) the following information about redundant data: \n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data; ","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.23","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of: \n(a) deleting the redundant data; or \n(b) de-identifying the redundant data; or \n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it. ","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.24","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.25","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division;","CDR Rule 4.18(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.26","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.27","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.28","CX Standard","Data Recipient","MUST","When notifying a Data Holder of an amended collection consent as per rules 4.18C or 4.20S, Data Recipients MUST supply the relevant CDR Arrangement ID to the Data Holder according to https://consumerdatastandardsaustralia.github.io/standards/#specifying-an-existing-arrangement. Providing the CDR Arrangement ID is necessary to trigger the Data Holder authorisation flow simplifications outlined in the https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards. Failure to supply the CDR Arrangement ID will result in the full authorisation flow and a disconnected data sharing arrangement history on consumer dashboards.","Consent Standards, Consent: Amendment of Collection Consents and Authorisations [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.29","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.30","CX Standard","Data Recipient","MUST","Data recipients MUST indicate where datasets, uses, and durations are being amended. \n\nData recipients MAY apply this standard to other changing attributes where the attribute in the amending consent request differs to that of the previous consent. How a changed attribute is signified is at the data recipient’s discretion. ","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.31","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.32","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.33","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right. \n\nThis information SHOULD be immediately viewable by the consumer without further interaction. \n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.34","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.35","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.36","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.37","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.38","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. \n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation. \n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.39","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.40","CX Guideline","Data Recipient","MAY","Data recipients should communicate that consent will expire if request is not actioned.","CX Research 35 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.41","CX Guideline","Data Recipient","MAY","Data recipients should outline the consequences of not continuing to consent - such as service or data loss. This should include information about how data will be handled if re-consent is not provided.","CX Research 38 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.42","CX Guideline","Data Recipient","MAY","Data recipients should provide multiple reminders to warn consumers that their consent is about to expire. Such reminders should not be sent at unnecessarily high frequencies so as to cause notification fatigue.","CX Research 34 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.43","CX Guideline","Data Recipient","MAY","Data recipients should provide a clear ‘withdraw consent’ option in addition to allowing expiry by default.","CX Research 37 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.44","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [http://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.45","CX Guideline","Data Recipient","MAY","ADRs should present attributes to be amended in a way that is clearly distinct to attributes that have already been consented to. This may require specific design patterns and/or the use of signifiers, such as 'new' labels, to denote the change being requested.","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.46","CX Guideline","Data Recipient","MAY","This flow demonstrates an amendment to extend the duration of a bundled collection, use and business consumer disclosure consent. Such a bundled amendment may occur where the original consent was given in a bundled fashion and each consent is due to expire shortly. While data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10), other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months.\n\nTo facilitate a streamlined amendment that matches how the original consent was given, data recipients may choose to propose a single duration of up to 12 months for all requested consents when inviting the consumer to give the initial consent. This would allow them to invite the consumer to renew all the consent types in a single action.\n\nAlternatively, data recipients can request detached consents of differing durations from the consumer, or a bundled consent with different durations for each consent type, with some consent types enduring for up to 7 years for business consumers. In those circumstances, these consents would be amended in a detached manner. If this approach were taken, collection consent renewals would need to be requested at least every 12 months, inline with the collection duration originally consented to.","CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.47","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where a duration of 12 months or less is proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.\n\nAs business consumer statements cannot be given in relation to collection consents, they have a maximum duration of 12 months. Data recipients wishing to offer durations greater than 12 months for business consumer disclosure consents will need to present 2 different durations for the 2 consent types.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.48","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.49","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.50","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.51","CX Guideline","Data Recipient","MAY","Data recipients should include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.52","CX Guideline","Data Recipient","MAY","Where an amendment includes changes to the collection duration or what datasets are being collected, the consumer will need to authenticate and authorise the amendment with the data holder.\n\nAn amendment that only changes the terms of a disclosure or use consent, such as adding/removing uses, changing what data is disclosed or amending the duration of disclosure and/or use consents, does not require data holder authentication and authorisation.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.53","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.54","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.55","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.56","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.57","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.58","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.59","Common Standard","Data Recipient","MAY","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\n\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.02","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.03","CDR Rule","Data Recipient","MUST","(1) An accredited person or CDR representative may invite a CDR consumer to nominate one or more persons as trusted advisers of the CDR consumer for the purposes of this rule.","CDR Rule 1.10C(1)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person or CDR representative must not make:\n(a) the nomination of a trusted adviser; or\n(b) the nomination of a particular person as a trusted adviser; or\n(c) the giving of a TA disclosure consent;\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10C(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.05","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.06","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.07","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.08","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.09","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.10","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.11","CX Standard","Data Recipient","MUST","If: \n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.12","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.13","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.14","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.15","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.16","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.17","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.18","CX Guideline","Data Recipient","MAY","CX research suggested that, where a consumer does not have an existing relationship with a non-accredited person or trusted adviser, additional information from an independent source can increase confidence levels and informed consent. \n\nData recipients may provide this information during the pre-consent phase, outside of the CDR system.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-10-03"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.19","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.20","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.21","CX Guideline","Data Recipient","MAY","Data recipients may present a list of trusted advisers for the consumer to choose from.\n\nAlternatively, data recipients may specify a nominated trusted adviser where the sole purpose of the collection consent is to disclose the data to a specific trusted adviser.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.22","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies when data is from multiple parties or sources.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.23","CX Guideline","Data Recipient","MAY","To describe data in easy to understand language, data recipients should have regard to the Accessibility Standards on reading experiences, with specific reference to WCAG 3.1.5, and draw from the Australian Government Style Manual on literacy and access.\n\nData recipients should seek to, for example, describe data concisely, in plain language, with an Australian year 7 or lower readability level, and in a way that limits the use of unusual words, phrases, idioms, and jargon.","Australian Government Style Manual: Literacy and access [https://www.stylemanual.gov.au/accessible-and-inclusive-content/literacy-and-access]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.24","CX Guideline","Data Recipient","MAY","The common disclosure consent data standards may also apply to trusted adviser disclosure consents.\n\nFor example, where a data recipient requests that transformed or modified data be disclosed to a trusted adviser.\n\nFor more information, see the CX guidelines about 'Disclosing modified data' (in 'Disclosure consents to accredited persons')","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.25","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.26","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the trusted adviser, explaining how the disclosed data will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.27","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.28","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.29","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. \n\nCX research highlighted the importance of including: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.30","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.31","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.\n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.\n\nThe CX Guidelines demonstrate an intuitive grouping that presents collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt. This allows the receipts to be grouped according to relevant CDR Participant pairings.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.32","CDR Rule","Data Recipient","MUST","(5) To avoid doubt, paragraphs (4)(a) and (c) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and provided to a trusted adviser.","CDR Rule 1.10C(5)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.33","CX Guideline","Data Recipient","MAY","CDR Representatives seeking a Trusted Adviser disclosure consent should refer to Division 4.3A of the CDR Rules.","CDR Rules Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.34","CX Guideline","Data Recipient","MAY","It is at the data recipient's discretion to offer a Trusted Adviser (TA) disclosure service to any TA of the consumer's choosing. This may be determined by existing and commercial arrangements with TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.35","CX Guideline","Data Recipient","MAY","Where a consumer has not previously nominated a Trusted Adviser (TA) at the time of giving a TA disclosure consent, data recipients may take the consumer’s selection/indication of a TA or the consumer’s agreement to a TA as presented to them when giving consent, to be the nomination of the TA.\n\nThe method of presenting nomination is at the discretion of the data recipient, and may consider their arrangements with specific TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.36","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:  \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.37","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.38","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.39","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.40","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a Trusted Adviser is required for their service. \n\nFor example, the selection step may be necessary where the data recipient offers a range of Trusted Advisers to which the consumer can disclose, including where a consumer has previously nominated multiple Trusted Advisers. \n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a Trusted Adviser and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this Trusted Adviser. ","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.41","CX Guideline","Data Recipient","MAY","Data recipients should consider providing upfront information to onboard consumer to the disclosure process. CX research suggested that the inclusion of clear information increased confidence and the ability for the consumer to be informed.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.42","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.43","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.01","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.02","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person or CDR representative must not make:\n(a) the nomination of a trusted adviser; or\n(b) the nomination of a particular person as a trusted adviser; or\n(c) the giving of a TA disclosure consent;\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10C(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.03","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.04","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data;\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.05","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.06","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.07","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.08","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for language to be used when requesting banking data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.09","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for banking data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.10","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.11","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.12","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.13","CX Standard","Data Recipient","MAY","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient.","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.14","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications. The use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.15","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.16","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.17","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.18","CX Guideline","Data Recipient","MAY","CX research suggested that, where a consumer does not have an existing relationship with a non-accredited person or trusted adviser, additional information from an independent source can increase confidence levels and informed consent. \n\nData recipients may provide this information during the pre-consent phase, outside of the CDR system.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-10-03"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.19","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.20","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.21","CX Guideline","Data Recipient","MAY","Data recipients may specify a nominated trusted adviser where the sole purpose of the collection consent is to disclose the data to a specific trusted adviser.\n\nAlternatively, data recipients may present a list of trusted advisers for the consumer to choose from.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.22","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies when data is from multiple parties or sources.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.23","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.24","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the trusted adviser, explaining how the disclosed data will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.25","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.26","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.27","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. \n\nCX research highlighted the importance of including:\n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.28","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.29","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.\n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.\n\nThe CX Guidelines demonstrate an intuitive grouping that presents collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt. This allows the receipts to be grouped according to relevant CDR Participant pairings.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.30","CDR Rule","Data Recipient","MUST","(5) To avoid doubt, paragraphs (4)(a) and (c) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and provided to a trusted adviser.","CDR Rule 1.10C(5)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.31","CX Guideline","Data Recipient","MAY","CDR Representatives seeking a Trusted Adviser disclosure consent should refer to Division 4.3A of the CDR Rules.","CDR Rules Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.32","CX Guideline","Data Recipient","MAY","It is at the data recipient's discretion to offer a Trusted Adviser (TA) disclosure service to any TA of the consumer's choosing. This may be determined by existing and commercial arrangements with TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.33","CX Guideline","Data Recipient","MAY","The intention of rule 1.10C(4)(b) is to prohibit a situation where a consumer is forced to select a particular person as a Trusted Adviser (TA) by an ADR, however there may be reasonable grounds to only offer a single TA to a consumer where they have a pre-existing relationship with a particular TA prior to engaging the ADR’s services.","CDR Rule 1.10C(4)(b) | Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.34","CX Guideline","Data Recipient","MAY","Where a consumer has not previously nominated a Trusted Adviser (TA) at the time of giving a TA disclosure consent, data recipients may take the consumer’s selection/indication of a TA or the consumer’s agreement to a TA as presented to them when giving consent, to be the nomination of the TA.\n\nThe method of presenting nomination is at the discretion of the data recipient, and may consider their arrangements with specific TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.35","CDR Rule","Data Recipient","MUST","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; \nany identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3)–(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.36","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(a) must comply with any relevant data standards; and \n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and \n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent). ","CDR Rule 4.10","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.37","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.38","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or \n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;where the period of consent is either: \n(iii) a single occasion; or \n(iv) a specified period of time; \n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13. ","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.39","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.40","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to; ","CDR Rule 4.11(3)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.41","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.42","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.43","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.44","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.45","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents; ","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.46","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.47","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.48","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.49","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.50","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the terms of consent, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the terms of consent. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.51","CX Guideline","Data Recipient","MAY","Data recipients should make the data holder list searchable if the number of data holders exceeds what can be displayed on the screen.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.52","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.53","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.54","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a Trusted Adviser is required for their service. \n\nFor example, the selection step may be necessary where the data recipient offers a range of Trusted Advisers to which the consumer can disclose, including where a consumer has previously nominated multiple Trusted Advisers. \n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a Trusted Adviser and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this Trusted Adviser.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.55","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.56","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.57","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.58","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.59","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025. \n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives). \n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.60","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.61","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.62","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.63","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.36.0","2026-03-18","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\n\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.02","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.03","CDR Rule","Data Recipient","MUST","(4) Despite paragraph 7.5(1)(e), disclosure of a CDR insight under an insight disclosure consent is not a permitted use or disclosure if the CDR insight includes or reveals sensitive information within the meaning of the Privacy Act 1988.","CDR Rule 7.5A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2024-03-06"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.04","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.05","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(ca) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;","CDR Rule 4.11(3)(ca)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.06","CDR Rule","Data Recipient","MUST","(3) For these rules, an insight disclosure consent in relation to particular CDR data of a CDR consumer held by an accredited data recipient, or a CDR representative that holds the CDR data as service data, is a disclosure consent given by the CDR consumer under these rules that:\n(a)  authorises the accredited data recipient or CDR representative to disclose the CDR data to a specified person for one or more of the following purposes:\n(i)  verifying the consumer’s identity;\n(ii)  verifying the consumer’s account balance;\n(iii)  verifying the details of credits to or debits from the consumer’s accounts; but\n(b)  where the CDR data relates to more than one transaction—does not authorise the accredited data recipient or CDR representative to disclose an amount or date in relation to any individual transaction.","CDR Rule 1.10A(3)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2024-03-06"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.07","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.08","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.09","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.10","CX Standard","Data Recipient","SHOULD","Data recipients SHOULD explain the purpose of generating the insight.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Purpose of insight [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.11","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language to describe what an insight would reveal or describe.\n\nWhere possible and practical, the actual insight SHOULD be displayed to the consumer prior to the insight being disclosed.\n\nWhere it is not possible to display the actual insight, accredited data recipients SHOULD include an example of the insight that demonstrates what the insight may reveal or describe. Accredited data recipients SHOULD make clear that any such examples are hypothetical.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.12","CX Standard","Data Recipient","MAY","Data recipients MAY explain how the insight will be generated using plain and concise language, which MAY include:\n• what method(s) would be used to generate the insight(s);\n• who would be involved in generating the insight(s), such as the specific actor(s); and\n• what information sources would be used to generate the insight, such as the specific dataset(s)","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight generation [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.13","CX Standard","Data Recipient","MUST","Data recipients MUST specify the period the insight will refer to and MAY note when the insight will be or is expected to be generated.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight timing [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.14","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.15","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.16","CX Standard","Data Recipient","MUST","If: \n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; or\n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data; \n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.17","CX Standard","Data Recipient","MUST","When seeking an insight disclosure consent, data recipients MUST provide instructions for how the consumer can access further records, including the actual insights (as per Rules 1.14 and 9.5).","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Insight records [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.18","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2024-03-06"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.19","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.20","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.21","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.22","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.23","CX Guideline","Data Recipient","MAY","Data recipients should consider providing upfront information to onboard consumers to the insight disclosure process. CX research suggested that the inclusion of clear information increased confidence and the ability for the consumer to be informed.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.24","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.25","CX Guideline","Data Recipient","MAY","CX research suggested that, where a consumer does not have an existing relationship with a non-accredited person or trusted adviser, additional information from an independent source can increase confidence levels and informed consent. \n\nData recipients may provide this information during the pre-consent phase, outside of the CDR system.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.26","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.27","CX Guideline","Data Recipient","MAY","Data recipients should explain what information will not be shared with the non-accredited person. Research suggested that clarifying this supported informed consent and confidence in the process.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.28","CX Guideline","Data Recipient","MAY","Where appropriate, data recipients should provide assurance that actual or permission-level data will only be accessed to generate insights and won't be disclosed to the non-accredited person or any other parties.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.29","CX Guideline","Data Recipient","MAY","As a matter of best practice, where possible, accredited data recipients and CDR representatives should show the consumer the CDR insight prior to it being disclosed. This will be unworkable in certain scenarios. However, as CX research suggested, doing this will aid comprehension and trust, and can also mitigate errors and incorrect outputs where the consumer is aware of incorrect details or insights being used.","OAIC Consumer Data Right insights [https://oaic.gov.au/consumer-data-right/guidance-and-advice/cdr-insights] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.30","CX Guideline","Data Recipient","MAY","CX standards require data recipients to use plain and concise language to describe insights. As a guide, data recipients may consider a reading grade of at least 7, and no more than 10, using the Flesch-Kincaid formula or the Automated Readability Index.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.31","CX Guideline","Data Recipient","MAY","The common disclosure consent data standards may also apply to insight disclosure consents.\n\nFor more information, see the CX guidelines about 'Disclosing modified data' (in 'Accredited Persons disclosure consents')","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Guidelines: Disclosure Consents, Accredited Persons disclosure consents [https://cx.dsb.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.32","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies when data is from multiple parties or sources.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.33","CX Guideline","Data Recipient","MAY","To describe data in easy to understand language, data recipients should have regard to the Accessibility Standards on reading experiences, with specific reference to WCAG 3.1.5, and draw from the Australian Government Style Manual on literacy and access.\n\nData recipients should seek to, for example, describe data concisely, in plain language, with an Australian year 7 or lower readability level, and in a way that limits the use of unusual words, phrases, idioms, and jargon.","Australian Government Style Manual: Literacy and access [https://www.stylemanual.gov.au/accessible-and-inclusive-content/literacy-and-access]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.34","CX Guideline","Data Recipient","MAY","As per the CX standards, data recipients should explain the insight's purpose. This explanation may be done at a high-level or, where known, based on how the data recipient expects the insight will be used.","CDR Rule 1.10A(3) | Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.35","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.36","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the insight recipient, explaining how the disclosed insights will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.37","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.38","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.39","CX Guideline","Data Recipient","MAY","Data recipients should surface information about the data deletion process: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.40","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.41","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that insight generation was successful, and that the insights were successfully shared. This message should be clearly visible and shown as soon as the action has taken place.\n\nThis may also be an appropriate location to display the actual insights prior to or immediately following their disclosure.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.42","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.\n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.\n\nThe CX Guidelines demonstrate an intuitive grouping that presents collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt. This allows the receipts to be grouped according to relevant CDR Participant pairings.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.43","CX Guideline","Data Recipient","MAY","As per CDR Rules 4.11(3)(ca) and 4.18(2)(c), if data recipients show the actual insight(s) during the consent flow, they are also required to show the actual insight(s) in the CDR receipt.","CDR Rule 4.11(3)(ca), 4.18(2)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.44","CDR Rule","Data Recipient","MUST NOT","(4) An accredited person must not make:\n(a) the giving of an insight disclosure consent; or\n(b) the specification of a particular person for the purposes of paragraph (3)(a);\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.45","CDR Rule","Data Recipient","MUST","(7) To avoid doubt, paragraphs (4)(a), (5)(a) and (6)(a) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and CDR insights disclosed in accordance with the insight disclosure consent.","CDR Rule 1.10A(7)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.46","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an Insight disclosure consent should refer to CDR Rules 1.10A(5), 1.10A(6) and https://www.legislation.gov.au/F2020L00094/2023-07-22/2023-07-22/text/original/epub/OEBPS/document_1/document_1.html#_Toc143251404 of the CDR Rules.","CDR Rules 1.10A(5), 1.10A(6), Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.47","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:   \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed; in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.48","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.49","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.50","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.51","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.52","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.53","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either: \n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data; \n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A). \nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.02","CDR Rule","Data Recipient","MUST","(4) Despite paragraph 7.5(1)(e), disclosure of a CDR insight under an insight disclosure consent is not a permitted use or disclosure if the CDR insight includes or reveals sensitive information within the meaning of the Privacy Act 1988.","CDR Rule 7.5A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.03","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or \n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.04","CDR Rule","Data Recipient","MUST","(4) An accredited person must not make:\n(a) the giving of an insight disclosure consent; or\n(b) the specification of a particular person for the purposes of paragraph (3)(a);\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.05","CDR Rule","Data Recipient","MUST","(7) To avoid doubt, paragraphs (4)(a), (5)(a) and (6)(a) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and CDR insights disclosed in accordance with the insight disclosure consent.","CDR Rule 1.10A(7)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.07","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.08","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.09","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.10","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.11","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(ca) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;","CDR Rule 4.11(3)(ca)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.12","CDR Rule","Data Recipient","MUST","(3) For these rules, an insight disclosure consent in relation to particular CDR data of a CDR consumer held by an accredited data recipient, or a CDR representative that holds the CDR data as service data, is a disclosure consent given by the CDR consumer under these rules that:\n(a)  authorises the accredited data recipient or CDR representative to disclose the CDR data to a specified person for one or more of the following purposes:\n(i)  verifying the consumer’s identity;\n(ii)  verifying the consumer’s account balance;\n(iii)  verifying the details of credits to or debits from the consumer’s accounts; but\n(b)  where the CDR data relates to more than one transaction—does not authorise the accredited data recipient or CDR representative to disclose an amount or date in relation to any individual transaction.","CDR Rule 1.10A(3)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.13","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:   \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed; in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.14","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.15","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.16","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(h) the following information about redundant data: \n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.17","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of: \n(a) deleting the redundant data; or \n(b) de-identifying the redundant data; or \n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.18","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.19","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: \n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.20","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.21","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.22","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.23","CX Standard","Data Recipient","MAY","Data recipients MAY explain how the insight will be generated using plain and concise language, which MAY include:\n• what method(s) would be used to generate the insight(s);\n• who would be involved in generating the insight(s), such as the specific actor(s); and\n• what information sources would be used to generate the insight, such as the specific dataset(s)","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight generation [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.24","CX Standard","Data Recipient","SHOULD","Data recipients SHOULD explain the purpose of generating the insight.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Purpose of insight [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.25","CX Standard","Data Recipient","MUST","When seeking an insight disclosure consent, data recipients MUST provide instructions for how the consumer can access further records, including the actual insights (as per Rules 1.14 and 9.5).","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Insight records [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.26","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.27","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.28","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language to describe what an insight would reveal or describe.\n\nWhere possible and practical, the actual insight SHOULD be displayed to the consumer prior to the insight being disclosed.\n\nWhere it is not possible to display the actual insight, accredited data recipients SHOULD include an example of the insight that demonstrates what the insight may reveal or describe. Accredited data recipients SHOULD make clear that any such examples are hypothetical.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.29","CX Standard","Data Recipient","MUST","Data recipients MUST specify the period the insight will refer to and MAY note when the insight will be or is expected to be generated.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight timing [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.30","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.31","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.32","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.33","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.34","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.35","CX Guideline","Data Recipient","MAY","Data recipients should consider providing upfront information to onboard consumer to the insight disclosure process. CX research suggested that the inclusion of clear information increased confidence and the ability for the consumer to be informed.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.36","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.37","CX Guideline","Data Recipient","MAY","Data recipients should explain what information will not be shared with the non-accredited person. Research suggested that clarifying this supported informed consent and confidence in the process.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.38","CX Guideline","Data Recipient","MAY","Where appropriate, data recipients should provide assurance that actual or permission-level data will only be accessed to generate insights and won't be disclosed to the non-accredited person or any other parties.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.39","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.40","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the terms of consent, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the terms of consent. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.41","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.42","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.43","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-12"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.44","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an Insight disclosure consent should refer to rules 1.10A(5), 1.10A(6) and Division 4.3A of the CDR Rules.","CDR Rules 1.10A(5), 1.10A(6), Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.45","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data: \nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.46","CX Guideline","Data Recipient","MAY","CX standards require data recipients to use plain and concise language to describe insights. As a guide, data recipients may consider a reading grade of at least 7, and no more than 10, using the Flesch-Kincaid formula or the Automated Readability Index.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.47","CX Guideline","Data Recipient","MAY","As per the CX standards, data recipients should explain the insight's purpose. This explanation may be done at a high-level or, where known, based on how the data recipient expects the insight will be used.","CDR Rule 1.10A(3) | Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.48","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.49","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible. \n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control. \n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.50","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the insight recipient, explaining how the disclosed insights will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.51","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.52","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. \n\nCX research highlighted the importance of including: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.53","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.54","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.55","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.56","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.57","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that insight generation was successful, and that the insights were successfully shared. This message should be clearly visible and shown as soon as the action has taken place.\n\nThis may also be an appropriate location to display the actual insights prior to or immediately following their disclosure.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.58","CX Guideline","Data Recipient","MAY","As a matter of best practice, where possible, accredited data recipients and CDR representatives should show the consumer the CDR insight prior to it being disclosed. This will be unworkable in certain scenarios. However, as CX research suggested, doing this will aid comprehension and trust, and can also mitigate errors and incorrect outputs where the consumer is aware of incorrect details or insights being used.\n\nWhen possible and practical, data recipients should allow the consumer to review their actual insight(s) before it is disclosed to the non-accredited person. Data recipients should also provide the consumer with the option to: \n• deny disclosure;\n• amend insights or data clusters; \n• confirm disclosure.","OAIC Consumer Data Right insights [https://www.oaic.gov.au/consumer-data-right/consumer-data-right-guidance-for-business/privacy-obligations/consumer-data-right-insights] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.59","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.60","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts. \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent. \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure.\n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.61","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.62","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.63","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.64","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.65","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.36.0","2026-03-18","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.02","CDR Rule","Data Recipient","MUST","(11) For these rules, a business consumer disclosure consent in relation to particular CDR data of a CDR business consumer held by an accredited data recipient is a disclosure consent given by the CDR business consumer under these rules that: \n(a) authorises the accredited data recipient to disclose the CDR data to a specified person; and \n(b) includes a business consumer statement.","CDR Rule 1.10A(11)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.03","CDR Rule","Data Recipient","MUST NOT","(12) An accredited person must not make:\n(c) the specification of a particular person for the purposes of paragraph (11)(a);\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.04","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.05","CDR Rule","Data Recipient","MUST","(9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.06","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;","CDR Rule 9.3(2)(eg)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.07","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n\n(a) is given in relation to a consent in one of the following categories: \n(i) use consents relating to the goods or services requested by the CDR business consumer; \n(ii) TA disclosure consents; \n(iii) insight disclosure consents; \n(iv) business consumer disclosure consents; and\n\n(b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).\n\nNote: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.","CDR Rule 1.10A(10), (Note)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.08","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.09","CDR Rule","Data Recipient","MUST NOT","(12) An accredited person must not make:\n(b) the giving of a business consumer statement;\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.10","CDR Rule","Data Recipient","MUST","(13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.","CDR Rule 1.10A(13)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.11","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time; and\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.12","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.13","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.14","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.15","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.16","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.17","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.18","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.19","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.20","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.21","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.22","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.23","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.24","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.25","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.26","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.27","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.28","CX Guideline","Data Recipient","MAY","Data recipients may invite a consumer to give a use consent to confirm whether they are a business consumer, per the requirements of CDR Rule 1.10A(9). This could be requested in conjunction with a collection consent, or could be requested as a detached use for already collected data.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.29","CX Guideline","Data Recipient","MAY","Data recipients should only request a business consumer statement if they have verified the consumer is a business consumer — per CDR Rule 1.10(9) — and reasonably expect them to be intending to use the service for business purposes. \n\nAppropriate pre-consent and onboarding experiences can assist with funnelling consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for non-business consumers, and prevent consumers from inadvertently providing a business consumer statement.","CDR Rule 1.10(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.30","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.31","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.32","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 1.10A(9), when verifying the consumer is not an individual or has an active ABN, data recipients should be satisfied that the evidence given — such as the ABN — is current and relates to the consumer.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.33","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 4.11(1)(bb), data recipients must invite a business consumer to give a business consumer statement in the consent flow.\nThis invitation should be presented upfront. Doing so can help data recipients determine the appropriate consent duration and customer data language standards to surface, and whether a business consumer disclosure consent can be requested.","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.34","CX Guideline","Data Recipient","MAY","Data recipients must only present business consumers with a pre-selected duration of more than 12 months where the service reasonably requires this and in compliance with the data minimisation principle, CDR Rule 1.8.","CDR Rule 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.35","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | Nielsen Norman Group: 10 Usability Heuristics for User Interface Design (Error prevention) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.36","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.37","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.38","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.39","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.40","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.41","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.42","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [https://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.43","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.44","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible. \n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control. \n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.45","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.46","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.47","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.01","CDR Rule","Data Recipient","MUST","(11) For these rules, a business consumer disclosure consent in relation to particular CDR data of a CDR business consumer held by an accredited data recipient is a disclosure consent given by the CDR business consumer under these rules that:\n\n(a) authorises the accredited data recipient to disclose the CDR data to a specified person; and\n\n(b) includes a business consumer statement.","CDR Rule 1.10A(11)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.02","CDR Rule","Data Recipient","MUST","(9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.03","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;","CDR Rule 9.3(2)(eg)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.04","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n\n(a) is given in relation to a consent in one of the following categories:\n (i) use consents relating to the goods or services requested by the CDR business consumer;\n (ii) TA disclosure consents;\n (iii) insight disclosure consents;\n (iv) business consumer disclosure consents; and\n\n(b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).\n\nNote: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.","CDR Rule 1.10A(10), (Note)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.05","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement;","CDR Rule 1.10A(11)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.06","CDR Rule","Data Recipient","MUST","(12) An accredited person must not make:\n(b) the giving of a business consumer statement;\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.07","CDR Rule","Data Recipient","MUST","(13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.","CDR Rule 1.10A(13)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.08","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data;\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.09","CDR Rule","Data Recipient","MUST","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; \nany identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3)–(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.10","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.11","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(c)–(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.12","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.13","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.14","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.15","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.16","CDR Rule","Data Recipient","MUST","(12) An accredited person must not make:\n(c) the specification of a particular person for the purposes of paragraph (11)(a);\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.17","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n(a) is given in relation to a consent in one of the following categories:\n(i) use consents relating to the goods or services requested by the CDR business consumer;\n(iv) business consumer disclosure consents;","CDR Rule 1.10A(10)(a)(i),(iv)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.18","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.19","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\n\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.20","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.21","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.23","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.24","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.25","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(h) the following information about redundant data: \n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.26","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of: \n(a) deleting the redundant data; or \n(b) de-identifying the redundant data; or \n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.27","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.28","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.29","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.30","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.31","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.32","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.33","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.34","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.35","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right. \n\nThis information SHOULD be immediately viewable by the consumer without further interaction. \n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.36","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.37","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.38","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.39","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.40","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.41","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. \n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation. \n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.42","CX Guideline","Data Recipient","MAY","Data recipients should only request a business consumer statement if they have verified the consumer is a business consumer — per CDR Rule 1.10(9) — and reasonably expect them to be intending to use the service for business purposes. \n\nAppropriate pre-consent and onboarding experiences can assist with funnelling consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for non-business consumers, and prevent consumers from inadvertently providing a business consumer statement.","CDR Rule 1.10(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.43","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [https://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.44","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 1.10A(9), when verifying the consumer is not an individual or has an active ABN, data recipients should be satisfied that the evidence given — such as the ABN — is current and relates to the consumer.","CDR rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.45","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 4.11(1)(bb), data recipients must invite a business consumer to give a business consumer statement in the consent flow. \nThis invitation should be presented upfront. Doing so can help data recipients determine the appropriate consent duration and customer data language standards to surface, and whether a business consumer disclosure consent can be requested.","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.46","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the data request occurs.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.47","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the data request occurs, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the data request. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.48","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.49","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.50","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.51","CX Guideline","Data Recipient","MAY","This flow demonstrates bundled collection, use, and business consumer disclosure consents. Data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10). Other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months.\n\nData recipients may choose to propose durations that differ based on the consent type. If this approach were taken, collection consent renewals would still need to be requested at least every 12 months, inline with the collection duration originally consented to.\n\nData recipients may alternatively choose to propose a single duration of up to 12 months for all the requested consents, despite being able to request up to 7 years for the use and disclosure consent. This would allow the data recipient to invite the consumer to renew all the consent types in a single action.","CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.52","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 1.10A(10), a business consumer statement cannot be made in relation to a collection consent. As such, CDR Rule 4.12(1) stipulates that the maximum duration for collection consent is 12 months.","CDR Rule 1.10A(10), 4.12(1)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.53","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.54","CX Guideline","Data Recipient","MAY","Data recipients should only present business consumers with a pre-selected duration of more than 12 months where the service reasonably requires this and in compliance with the data minimisation principle, CDR Rule 1.8.","CDR Rule 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.55","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.56","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.57","CX Guideline","Data Recipient","MAY","Data recipients should identify whether the user is sharing individual or non-individual accounts in order to surface the correct data language.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.58","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible. \n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control. \n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.59","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.60","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.61","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.62","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.63","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.64","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.65","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.66","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.67","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.68","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts. \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent. \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure.\n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.69","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.70","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.71","Common Standard","Data Recipient",null,"Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.72","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.73","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.36.0","2026-03-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.01","CDR Rule","Data Holder","MUST","(8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.","CDR Rule 7.2(8)","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active","2024-02-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.02","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT include forgotten details links in redirect screens.","Authentication Standards, Redirect to Web with OTP, Authentication: Password Link [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.03","CX Standard","Data Holder, Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the data holder and data recipient.","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.06","Technical Standard","Data Holder","SHOULD","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.16","CX Guideline","Data Holder","MAY","Data holders should use the Brand Name of the data recipient wherever the data recipient is referenced in consumer-facing authentication processes, including cancellation screens and One Time Password (OTP) delivery.\n\nIf the data recipient is not referenced in certain processes, such as the OTP message, data holders should not introduce the Brand Name for the purposes of this guideline. Data holders should not present the Software Product Name in relation to these processes.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.17","CX Guideline","Data Holder","MAY","Data holders should consider including their CDR policy in the authentication process as this will likely be the first online service the CDR consumer uses to interact with their data holder for the purposes of CDR.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.18","CX Guideline","Data Holder","MAY","Data holders may choose to include relevant organisation credentials if it reflects existing authentication processes, such as their ABN.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.22","CX Guideline","Data Holder","MAY","Data holders will need to determine appropriate authentication methods in accordance with the standards, including the appropriate identifiers and OTP delivery channels.\n\nAs per Schedule 4 Rules 2.1 and 2.3(2) for the energy sector, some consumers may not have online access to an account.\n\nIn such a scenario, an appropriate credential and/or OTP delivery channel may need to be determined by the data holder to successfully authenticate the consumer.\n\nTo facilitate authentication in this scenario, a data holder may, for example, provide a support pathway to help such an offline consumer locate or register an appropriate credential.\n\nFor OTP delivery, a data holder may note, in the authentication flow, that they do not possess the appropriate details to deliver the OTP, along with instructions for how to contact the data holder and register or provide these details, which should be external to the CDR flow.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.23","CX Guideline","Data Holder","MAY","Support pathways should be provided to help consumers who may have forgotten their credentials or may not have the appropriate credentials and/or contact details.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active","2022-05-05"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.24","CX Guideline","Data Holder","MAY","‘Offline customers’ are eligible energy consumers without online access to their energy account(s).\n\nData holders must take reasonable steps to support data sharing for offline customers and must not impose additional eligibility requirements, such as requiring online access prior to data sharing.","CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.1","2022-05-17","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.25","CX Guideline","Data Holder","MAY","Data holders can offer online registration to an offline customer as part of their own processes, but this should be external to the authentication and authorisation flows.","CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.1","2022-05-17","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.26","Common Standard","Data Holder","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication, and Decoupled Authentication is not supported, data holders MUST continue to support the 'Redirect to Web with OTP' flow in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule Standard, Fallback Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.27","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT introduce unwarranted friction into the authentication process.\nIn line with CDR Rule 4.24 on restrictions when asking CDR consumers to authorise disclosure of CDR data, unwarranted friction for authentication flows and methods is considered to include, but is not limited to:\n• The addition of any requirements beyond normal data holder practices for authenticating the consumer, including, but not limited to, One Time Password (OTP) verification code delivery. \n• Providing or requesting additional information beyond normal data holder practices for authenticating the consumer, including, but not limited to, OTP verification code delivery.\n• Offering additional or alternative services.\n• Referencing or including other documents.","Authentication Standards, Common Authentication Standards, Authentication: Friction [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.28","Technical Standard","Data Holder","MUST","A Single LoA value is carried in the acr claim which is described in https://openid.net/specs/openid-connect-core-1_0.html#IDToken of https://consumerdatastandardsaustralia.github.io/standards/#nref-OIDC.\n\n• An LoA of 2 is represented by the URI: urn:cds.au:cdr:2\n  • The authenticators used to attain this level MUST achieve Single Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL1' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Levels of Assurance (LoAs), Single Ordinal [https://consumerdatastandardsaustralia.github.io/standards/#levels-of-assurance-loas]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.29","CX Standard","Data Holder","MAY","Data holders MAY invite consumers using ‘Redirect to Web’ flows to install the data holder app used for the purposes of CDR authentication. This invitation MUST NOT introduce unwarranted friction.","Authentication Standards, Common Authentication Standards, Authentication: App Install [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.30","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder MUST request a user identifier in accordance with https://consumerdatastandardsaustralia.github.io/standards/#user-identifiers.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.31","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.32","Technical Standard","Data Holder","MUST NOT","The following credential constraints apply such that Authenticators:\n• MUST NOT permit Memorised Secrets defined by https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation to achieve 'LoA 2' (as a single factor of authentication only).","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.33","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\n\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.34","CX Guideline","Data Holder","MAY","Data holders may use alternative methods for authentication in accordance with the relevant standards for https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.35","CX Guideline","Data Holder","MAY","A user with valid credentials that is not authorised to share data should still be able to successfully authenticate. This may include a user that not a nominated representative, or is otherwise ineligible to share data. In this situation, the user should be able to successfully authenticate before seeing details in the authorisation flow outlining that they cannot share data, which may include a list of unavailable accounts and instructions on how to gain the ability to share data. A user that is ineligible or not a nominated representative should not fail at the point of authentication where they otherwise have valid credentials and meet the necessary criteria to successfully authenticate.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.36","CX Guideline","Data Holder","MAY","When the ‘Redirect to Web with OTP’ flow is used, the ‘App Install’ CX Standard allows data holders to prompt users to install their app for the purposes of CDR authentication. \n\nThis may be achieved via a banner, included in the footer, included in OTP delivery, or shared to a user's contact details following the completion of authentication, for example. \n\nThe delivery channel and method for any additional invitations are at the discretion of the data holder. The exact wording of the message provided in the Redirect to Web flow is also at the data holder's discretion. However, data holders should avoid including links that could unnecessary friction or trigger phishing concerns.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.37","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.36.0","2026-03-18","Active"]
["2AU. Redirect to Web with OTP","01. User identifier","2AU.01.07","Technical Standard","Data Holder","MUST","If a data holder requests a user identifier for the purposes of identifying the customer during authentication, then the data holder:\n• MUST request a user identifier that can uniquely identify the customer.\n• MUST request a user identifier that is already known by the customer in the redirected page.","Security Profile, Credential Requirements, User Identifiers [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","01. User identifier","2AU.01.20","CX Guideline","Data Holder","MAY","Data holders should use a user identifier that is consistent and familiar with their existing digital channel experiences and use terminology that aligns with the intended sector. Some example user identifiers are email address, user name, mobile number and customer ID.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","01. User identifier","2AU.01.21","CX Guideline","Data Holder","MAY","User identifiers need to be unique to each single eligible CDR consumer. Data holders should aim to do this by using identifiers unique to each customer (e.g. Customer IDs for the banking sector) and/or verifying the consumer has primary access to their device/service (e.g. mobile number or email address).\n\nUser identifiers need to be registered and verified external to the CDR authentication flow. If the consumer changes their primary access identifier (e.g. email address), data holders need to verify that the consumer is the intended user of that identifier before changing it (e.g. verifying email with an activation link).\n\nData holders considering suitable user identifiers should exclude any identity attributes that are shared across two or more people or cannot be registered as a verified claim for only one person.","Security Profile: Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.04","CX Standard","Data Holder, Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications.\n\nThe use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.05","CX Standard","Data Holder","MUST","Data holders MUST communicate the expiry period of the OTP to the consumer in the authentication flow.","Authentication Standards, Redirect to Web with OTP, Authentication: OTP Expiry [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 12, 27 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.08","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The provided OTP MUST be invalidated after a period of time at the discretion of the data holder. This expiry period SHOULD facilitate enough time for the customer to reasonably complete the authorisation process.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements] | CDR Rule 4.24 | CX Research 12, 27 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.09","Technical Standard","Data Holder","MUST NOT","Data Holders MUST NOT request that the customer enter an existing password in the redirected page.","Security Profile: Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.10","Technical Standard","Data Holder","MUST","Data Holders MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.11","Technical Standard","Data Holder","SHOULD","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page. \n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.12","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder SHOULD implement additional controls to minimise the risk of interception of the OTP through the selected delivery mechanism.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.13","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The provided OTP MUST be numeric digits and be between 4 and 6 digits in length.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.14","Technical Standard","Data Holder","SHOULD","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The algorithm for the creation of the OTP is at the discretion of the data holder but SHOULD incorporate a level of pseudo-randomness appropriate for the use case.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.15","Technical Standard","Data Holder","MUST NOT","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The delivery mechanism for the OTP is at the discretion of the data holder, but MUST align to existing and preferred channels for the customer. \n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile: Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows] | CDR Rule 4.24 | CX Research 12, 27 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.19","CX Guideline","Data Holder","MAY","Data holders should include functionality that allows a consumer to request that a One Time Password be resent.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/] | Decision Proposal 127 [https://github.com/ConsumerDataStandardsAustralia/standards/issues/127]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.01","Common Standard","Data Holder","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication, and Decoupled Authentication is not supported, data holders MUST continue to support the 'Redirect to Web with OTP' flow in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule Standard, Fallback Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.02","Common Standard","Data Holder","MUST","If a data holder provides an app, the data holder MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data holders MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data holders subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.03","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipient [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.04","Common Standard","Data Holder","MAY","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.05","CX Standard","Data Holder","MUST NOT","Where a data holder implements Redirect to App, the authentication flow and method MUST NOT involve more steps than the consumer would reasonably encounter when logging in to the data holder’s app for non-CDR purposes, unless otherwise specified in the data standards.","Authentication Standards, Redirect to App, Authentication: Steps [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.06","Technical Standard","Data Holder","MUST","Data holders MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data holders MUST use a single issuer identifier per app.\n• Data holders MUST only support Authorization Code Flow for Redirect to App authentication.\n• Data holders MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252.\n• After authentication, the data holder MUST continue the authorisation flow within the data holder app.\n• Data holders SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.","Security Profile, Authentication Flows, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.07","Technical Standard","Data Holder","MUST NOT","The following credential constraints apply such that Authenticators:\n• MUST NOT permit Memorised Secrets defined by https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation to achieve 'LoA 2' (as a single factor of authentication only).","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.08","Technical Standard","Data Holder","MUST","A Single LoA value is carried in the acr claim which is described in https://openid.net/specs/openid-connect-core-1_0.html#IDToken of https://consumerdatastandardsaustralia.github.io/standards/#nref-OIDC.\n\n• An LoA of 2 is represented by the URI: urn:cds.au:cdr:2\n  • The authenticators used to attain this level MUST achieve Single Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL1' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 3 is represented by the URI: urn:cds.au:cdr:3\n  • The authenticators used to attain this level MUST achieve Multi-Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL2' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 4 is represented by the URI: urn:cds.au:cdr:4\n  • The authenticators used to attain this level MUST conform with the Authentication Level 'AL3' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n\nREAD operations SHALL only be allowed where at least an LoA of 2 has been achieved during the establishment of consent.\n\nWRITE operations SHALL only be allowed where:\n• At least an LoA of 3 has been achieved during the establishment of consent, or\n• At least an LoA of 2 has been achieved during the establishment of consent and a subsequent challenge/response has resulted in an LoA of 3 being achieved within the lifespan of the current Access Token.","Security Profile, Levels of Assurance (LoAs), Single Ordinal [https://consumerdatastandardsaustralia.github.io/standards/#levels-of-assurance-loas]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.09","CX Standard","Data Holder","MUST","When the authorisation flow is presented to the consumer in a data holder app, the data holder MUST provide consumers with the ability to switch or add user profiles based on the profiles supported by that app.","Authorisation Standards, Authorisation: Add or Switch Profiles [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.10","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.11","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.12","Technical Standard","Data Recipient","MUST","Data recipients MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data recipients MUST register separate Redirect URIs where they provide both app-based and web-based redirection.\n• If data recipients initiate consent from an app, they MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252 for their app Redirect URI.","Security Profile, Authentication Flows, Redirect to App, Data Recipient [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.13","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT introduce unwarranted friction into the authentication process.\nIn line with CDR Rule 4.24 on restrictions when asking CDR consumers to authorise disclosure of CDR data, unwarranted friction for authentication flows and methods is considered to include, but is not limited to:\n• The addition of any requirements beyond normal data holder practices for authenticating the consumer, including, but not limited to, One Time Password (OTP) verification code delivery. \n• Providing or requesting additional information beyond normal data holder practices for authenticating the consumer including, but not limited to, OTP verification code delivery.\n• Offering additional or alternative services.\n• Referencing or including other documents.","Authentication Standards, Common Authentication Standards, Authentication: Friction [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.14","CX Standard","Data Holder","MAY","Data holders MAY invite consumers using ‘Redirect to Web’ flows to install the data holder app used for the purposes of CDR authentication. This invitation MUST NOT introduce unwarranted friction.","Authentication Standards, Common Authentication Standards, Authentication: App Install [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.15","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT include forgotten details links in redirect screens.","Authentication Standards, Redirect to Web with OTP, Authentication: Password Link [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.16","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder MUST request a user identifier in accordance with https://consumerdatastandardsaustralia.github.io/standards/#user-identifiers.\n• The data holder MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page. \n• The delivery mechanism for the OTP is at the discretion of the data holder, but MUST align to existing and preferred channels for the customer. \n• The data holder SHOULD implement additional controls to minimise the risk of interception of the OTP through the selected delivery mechanism.\n• The provided OTP MUST only be used for authentication for CDR based sharing and MUST NOT be usable for the authorisation of other transactions or actions.\n• The provided OTP MUST be invalidated after a period of time at the discretion of the data holder. This expiry period SHOULD facilitate enough time for the customer to reasonably complete the authorisation process.\n• The provided OTP MUST be numeric digits and be between 4 and 6 digits in length.\n• The algorithm for the creation of the OTP is at the discretion of the data holder but SHOULD incorporate a level of pseudo-randomness appropriate for the use case.\n• The data holder SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.17","CX Standard","Data Holder","MUST","Data holders MUST communicate the expiry period of the OTP to the consumer in the authentication flow.","Authentication Standards, Redirect to Web with OTP, Authentication: OTP Expiry [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.18","CX Guideline","Data Holder","MAY","CDR Participants may choose to voluntarily implement Redirect to App before the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations of 10 May 2027.\nIf implemented prior to this date, they will also need to meet other relevant standards, including https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows, unless otherwise stated.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.19","CX Guideline","Data Holder","MAY","In line with existing practices, a data holder may provide functionality that allows a consumer to add, register, or switch profiles prior to, or after, authentication.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.20","CX Guideline","Data Holder","MAY","Where a consumer has not logged into the app before, or has been logged out, the data holder may require them to log in using a username and password as per their existing practices. Where this occurs, the data holder must still have regard for the standard that prohibits memorised secrets being relied upon as a single factor for the purposes of sharing CDR data.","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.01","Common Standard","Data Holder","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication, and Decoupled Authentication is not supported, data holders MUST continue to support the 'Redirect to Web with OTP' flow in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule Standard, Fallback Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.02","Common Standard","Data Holder","MUST","If a data holder provides an app, the data holder MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data holders MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data holders subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.03","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.04","CX Standard","Data Holder","MUST NOT","Where a data holder implements Redirect to App, the authentication flow and method MUST NOT involve more steps than the consumer would reasonably encounter when logging in to the data holder’s app for non-CDR purposes, unless otherwise specified in the data standards.","Authentication Standards, Redirect to App, Authentication: Steps [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.05","Technical Standard","Data Holder","MUST","Data holders MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data holders MUST use a single issuer identifier per app.\n• Data holders MUST only support Authorization Code Flow for Redirect to App authentication.\n• Data holders MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252.\n• After authentication, the data holder MUST continue the authorisation flow within the data holder app.\n• Data holders SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.","Security Profile, Authentication Flows, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.06","Technical Standard","Data Holder","MUST NOT","The following credential constraints apply such that Authenticators:\n• MUST NOT permit Memorised Secrets defined by https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation to achieve 'LoA 2' (as a single factor of authentication only).","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.07","Technical Standard","Data Holder","MUST","A Single LoA value is carried in the acr claim which is described in https://openid.net/specs/openid-connect-core-1_0.html#IDToken of https://consumerdatastandardsaustralia.github.io/standards/#nref-OIDC.\n\n• An LoA of 2 is represented by the URI: urn:cds.au:cdr:2\n  • The authenticators used to attain this level MUST achieve Single Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL1' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 3 is represented by the URI: urn:cds.au:cdr:3\n  • The authenticators used to attain this level MUST achieve Multi-Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL2' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 4 is represented by the URI: urn:cds.au:cdr:4\n  • The authenticators used to attain this level MUST conform with the Authentication Level 'AL3' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n\nREAD operations SHALL only be allowed where at least an LoA of 2 has been achieved during the establishment of consent.\n\nWRITE operations SHALL only be allowed where:\n• At least an LoA of 3 has been achieved during the establishment of consent, or\n• At least an LoA of 2 has been achieved during the establishment of consent and a subsequent challenge/response has resulted in an LoA of 3 being achieved within the lifespan of the current Access Token.","Security Profile, Levels of Assurance (LoAs), Single Ordinal [https://consumerdatastandardsaustralia.github.io/standards/#levels-of-assurance-loas]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.08","CX Standard","Data Holder","MUST","When the authorisation flow is presented to the consumer in a data holder app, the data holder MUST provide consumers with the ability to switch or add user profiles based on the profiles supported by that app.","Authorisation Standards, Authorisation: Add or Switch Profiles [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.09","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\n\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.10","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.11","Technical Standard","Data Recipient","MUST","Data recipients MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data recipients MUST register separate Redirect URIs where they provide both app-based and web-based redirection.\n• If data recipients initiate consent from an app, they MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252 for their app Redirect URI.","Security Profile, Authentication Flows, Redirect to App, Data Recipient [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.12","CX Guideline","Data Holder","MAY","CDR Participants may choose to voluntarily implement Redirect to App before the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations of 10 May 2027.\nIf implemented prior to this date, they will also need to meet other relevant standards, including https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows, unless otherwise stated.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.13","CX Guideline","Data Holder","MAY","In line with existing practices, a data holder may provide functionality that allows a consumer to add, register, or switch profiles prior to, or after, authentication.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.14","CX Guideline","Data Holder","MAY","Data holders may use alternative methods for authentication in accordance with the relevant standards for https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.15","CX Guideline","Data Holder","MAY","Where a consumer has not logged into the app before, or has been logged out, the data holder may require them to log in using a username and password as per their existing practices. Where this occurs, the data holder must still have regard for the standard that prohibits memorised secrets being relied upon as a single factor for the purposes of sharing CDR data.","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.16","CX Guideline","Data Holder","MAY","In the instance a user installs a data holder app, or is logged out after a session, data holders are permitted to require users to log in with their user ID and password. This guideline should be considered in conjunction with the https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_common-authentication-standards.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.17","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.36.0","2026-03-18","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.01","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(a) subject to subrule (2), the name of the accredited person that made the request;","CDR Rule 4.23(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.02","CDR Rule","Data Holder","MUST NOT","When asking a CDR consumer to authorise the disclosure of CDR data or to amend a current authorisation, the data holder must not do any of the following:\n(a) add any requirements to the authorisation process beyond those specified in the data standards and these rules;\n(b) provide or request additional information during the authorisation process beyond that specified in the data standards and these rules;\n(c) offer additional or alternative services as part of the authorisation process;\n(d) include or refer to other documents.","CDR Rule 4.24","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.28","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.30","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.36.0","2026-03-18","Active"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).\n\nData holders MAY add a ‘profile selection’ step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts. The ‘profile selection’ step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).\n\nIf certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.\n• Data holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n• Data holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n• Note: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.","Authorisation Standards, Authorisation & Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.12","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.25","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.16.0","2022-03-17","Active"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.27","CX Standard","Data Holder","MAY","Data holders MAY include additional functionality to support account discovery and selection where further navigation or interaction is required to view all accounts. This may, for example, include search, sort, filter, scroll, grouping, and pagination, or other controls in line with existing consumer experiences. Any such functionality MUST NOT introduce unwarranted friction. \n\nNote: Unwarranted friction should have regard to CDR Rule 4.24 and is considered to include the addition of any requirements beyond normal data holder practices for an equivalent account selection process.","Authorisation Standards, Authorisation: Account selection functionality [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.03","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(c) the types of CDR data for which the data holder is seeking an authorisation to disclose;","CDR Rule 4.23(1)(c)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.04","CDR Rule","Data Holder, Data Recipient","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(b) the period of time to which the CDR data that was the subject of the request relates;","CDR Rule 4.23(1)(b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.05","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(e) if authorisation is being sought for disclosure over a period of time―what that period is;","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.06","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(d) whether the authorisation is being sought for:\n(i) disclosure of CDR data on a single occasion; or\n(ii) disclosure of CDR data over a period of time of not more than 12 months;\n\nNote: While certain consents by a CDR business consumer can have a period of 7 years, a corresponding authorisation cannot be for more than 12 months before renewal under subparagraph (1)(d)(ii).","CDR Rule 4.23(1)(d)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-02-22"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.07","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(f) a statement that, at any time, the authorisation can be withdrawn;","CDR Rule 4.23(1)(f) | CX Research 30, 32 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.08","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(g) instructions for how the authorisation can be withdrawn.","CDR Rule 4.23(1)(g) | CX Research 30, 32 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.09","CDR Rule","Data Holder","MUST","(1) A CDR consumer who has given an authorisation to a data holder to disclose particular CDR data to an accredited person may withdraw the authorisation at any time:\n(a) by using the data holder’s consumer dashboard; or\n(b) by using a simple alternative method of communication to be made available by the data holder for that purpose.","CDR Rule 4.25(1) | CX Research 30, 32 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-02-22"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.10","CDR Rule","Data Holder","MUST","(2) If the withdrawal was in accordance with paragraph (1)(b), the data holder must give effect to the withdrawal as soon as practicable, and in any case within 2 business days after receiving the communication.\n\nNote: This subrule is a civil penalty provision (see rule 9.8).","CDR Rule 4.25(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2024-02-22"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.11","CDR Rule","Data Holder","MUST","For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.","CDR Rule 7.2(8)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.13","CX Standard","Data Holder","MUST","Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. \n\nThe data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account confirm [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.14","CX Standard","Data Holder","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-24"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.15","CX Guideline","Data Holder","MAY","CDR Rules 4.23(1)(a) and (2) require data holders to refer to the accredited person's name using the legal entity name held in the Register during Authorisation.","CDR Rule 4.23(1)(a) and (2) | 10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.16","CX Guideline","Data Holder","MAY","Data holders can meet CX Standard on Authorisation: Account confirm with the account selection step only. The selected accounts do not need to be displayed again on the final confirmation page.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.17","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(b) requires data holders to give consumers information about the historical range of data that may be accessed under the authorisation.\nThe historical range of consumer data a data holder may disclose can be:\n• up to 2 years, as required by the rules; \n• a shorter historical period, for example, if the consumer became a customer more recently or if the account was opened more recently (except in the energy sector, where LCCD requirements apply. See Energy sector information below); or \n• a longer historical period, such as the earliest holding date or a more recent date, which may be applicable if the data holder chooses to provide additional historical data voluntarily.\n\nNote 1: If historical ranges differ across datasets — for example, if one dataset goes back to 1 April 2023 and another dataset goes back to 30 August 2023 — then the data holder may consider either:\n• showing the specific historical range for each dataset, as demonstrated in the CX Guidelines, or \n• displaying the earliest historical date across all datasets (in this example, 1 April 2023). \n\nNote 2: The technical standards allow data recipients to limit how much historic data is collected when calling the relevant APIs using the oldest-time or oldest-date fields. Data holders must use these fields to constrain the data that they disclose. Data holders should be mindful of the fact that data recipients may wish to collect more or less historical data than the data holder makes available when developing wording to meet the requirements of rule 4.23(1)(b). The precise wording is at the data holder's discretion, but may consider, for example:\nThis may include historical data that dates back [n years / to date], depending on your agreement with [ADR].\n\nBanking and Non-Bank Lender sector\nData holders must also refer to Subclauses 3.2(6) and (7) of Schedule 3. For open accounts, data holders must share a historical range of up to 2 years before the request date for transaction data, and up to 13 months for account data related to an authorisation for direct debit data. Data holders may voluntarily share older data. For closed accounts, if the relevant account is closed on the request date, CDR data, including historical data, related to that account is not considered required consumer data but can be shared voluntarily by the data holders.\n\nEnergy sector\nData holders must also refer to Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4. The last 2 years of billing data for a relevant account is required consumer data.\n'Electricity usage’ energy data language data cluster — which pertains to metering data held by AEMO, as per clause 1.2–1.3(4) of Schedule 4 — is available for up to 2 years before the request date. This includes usage data for the duration that a customer has been the account holder for the given NMI, including any time before they became a customer of their current retailer.","CDR Rule 4.23(1)(b); Subclauses 3.2(6) and (7) of Schedule 3; Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4 | Technical Standards: Banking APIs, oldest-time field [https://consumerdatastandardsaustralia.github.io/standards/#banking-apis]; Energy APIs, oldest-date field [https://consumerdatastandardsaustralia.github.io/standards/index.html?examples#cdr-energy-api_get-usage-for-service-point] | CDR Support Portal: Historical transaction data: Earliest Holding Day [https://cdr-support.zendesk.com/hc/en-us/articles/10085678783759-Historical-transaction-data-Earliest-Holding-Day]; Guidance on Energy Last Consumer Change Date (LCCD) [https://cdr-support.zendesk.com/hc/en-us/articles/12444620614799-Guidance-on-Energy-Last-Consumer-Change-Date-LCCD]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2025-09-24"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.18","CX Guideline","Data Holder","MAY","Data holders should use plain language phrases such as 'stop sharing' to refer to how a consumer can withdraw authorisation.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.19","CX Guideline","Data Holder","MAY","In addition to providing withdrawal instructions, data holders should provide instructions for how to review sharing arrangements.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.20","CX Guideline","Data Holder","MAY","Data holders should include their CDR policy in the Authorisation flow.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.21","CX Guideline","Data Holder","MAY","Data holders should use terms that align with equivalent authorisation actions already in use in their digital experiences. The chosen language should clearly communicate a final affirmative action to mitigate user error. CX research suggests that terms like 'confirm' and 'authorise' successfully and meaningfully communicate the final affirmative action.","10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.22","CX Guideline","Data Holder","MAY","Data holders should redirect the consumer back to the data recipient following the final affirmative action.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.23","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data.\n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nThe CDR receipt should be given in writing and available through the data holder consumer dashboard.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.24","CX Standard","Data Holder","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-24"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.26","CDR Rule","Data Holder","MUST","If an authorisation to disclose particular CDR data to an accredited person is withdrawn or otherwise expires, the data holder must notify the accredited person in accordance with the data standards.\nNote: This rule is a civil penalty provision (see rule 9.8).","CDR Rule 4.26A","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.29.0","2024-02-22","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.29","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(e) requires data holders to state the forward-looking time period where the authorisation is sought for the disclosure of CDR data. This cannot be more than 12 months.","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.01","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.02","CX Standard","Data Holder","MUST","If certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.\n\nData holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nData holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nNote: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.","Authorisation Standards, Unavailable Accounts: Displaying accounts  [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.03","CX Guideline","Data Holder","MAY","In accordance with the Unavailable Accounts: Displaying accounts standard, data holders should display unavailable accounts as part of the account selection step, with an explanation of why these are unable to be shared. \n\nWhere data holders are unable to display unavailable accounts, they may instead provide a generic explanation for unspecified accounts, in accordance with the Unavailable Accounts: No accounts can be shown standard.\n\nUnavailable accounts may include accounts that are not in scope for data sharing under CDR, accounts for which data sharing is voluntary, or where a data holder deems it necessary to prevent financial harm or abuse.\n\nDespite being unavailable, data holders are recommended to show these accounts to avoid confusion and align with consumer expectations.\n\nFor further detail about covered products and required and voluntary CDR data, refer to the https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors.","CDR Rules Clause 3.2 of Schedule 3; Clause 3.2 of Schedule 4 | Authorisation Standards, Unavailable Accounts: Displaying accounts [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]; Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | ACCC Compliance guide for data holders in the banking and non-bank lender sectors [https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2025-09-24"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.04","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.05","CX Standard","Data Holder","MAY","If a successfully authenticated user cannot proceed to establish an authorisation in accordance with the rules on eligible consumers and required consumer data, data holders MAY provide the option of concluding the authorisation process.","Authorisation Standards, Unavailable Accounts: Authorisation not permitted [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Retired","2025-09-24"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.06","CX Standard","Data Holder","MAY","If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.07","CX Guideline","Data Holder","MAY","If an account holder has not given a secondary user instruction for an account with a secondary user, that account will appear as unavailable to the secondary user.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.08","CX Guideline","Data Holder","MAY","The request function is optional but permitted under the standards. It can be presented within the authorisation flow or elsewhere, at the data holder’s discretion.\n\nThis functionality would allow non-nominated persons or secondary users without sharing rights to request access. This could alert the account owner(s) or administrator(s) of the steps required to grant sharing rights, leading them to the relevant services for managing secondary users or nominated representatives.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active","2025-09-24"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.09","CX Guideline","Data Holder","MAY","Data holders should provide clear explanations to consumer about why their accounts are unavailable.\n\nThese explanations should only reference account types that the consumer holds, and should be contextually shown in relation to the account where possible.\n\nData holders should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","03a. Unavailable accounts - Unavailable accounts cannot be shown","3AU.03a.01","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","03a. Unavailable accounts - Unavailable accounts cannot be shown","3AU.03a.02","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03a. Unavailable accounts - Unavailable accounts cannot be shown","3AU.03a.03","CX Guideline","Data Holder","MAY","In accordance with the Unavailable Accounts: Displaying accounts standard, data holders should display unavailable accounts as part of the account selection step, with an explanation of why these are unable to be shared. \n\nWhere data holders are unable to display unavailable accounts, they may instead provide a generic explanation for unspecified accounts, in accordance with the Unavailable Accounts: No accounts can be shown standard.\n\nUnavailable accounts may include accounts that are not in scope for data sharing under CDR, accounts for which data sharing is voluntary, or where a data holder deems it necessary to prevent financial harm or abuse.\n\nDespite being unavailable, data holders are recommended to show these accounts to avoid confusion and align with consumer expectations.\n\nFor further detail about covered products and required and voluntary CDR data, refer to the https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors.","CDR Rules Clause 3.2 of Schedule 3; Clause 3.2 of Schedule 4 | Authorisation Standards, Unavailable Accounts: Displaying accounts [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]; Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | ACCC Compliance guide for data holders in the banking and non-bank lender sectors [https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2025-09-24"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.01","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.02","CX Standard","Data Holder","MAY","If a successfully authenticated user cannot proceed to establish an authorisation in accordance with the rules on eligible consumers and required consumer data, data holders MAY provide the option of concluding the authorisation process.","Authorisation Standards, Unavailable Accounts: Authorisation not permitted [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.03","CX Standard","Data Holder","MAY","If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.04","CX Guideline","Data Holder","MAY","Some scenarios may result in a user without sharing rights not seeing any accounts in the account selection step. Data holders may provide a generic explanation and instructions in place of the account selection step and/or unavailable account pattern.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.05","CX Guideline","Data Holder","MAY","Data holders should provide additional information to help users without sharing rights understand how they might gain sharing rights. This may, for example, state that the account owner has to grant them sharing rights before data sharing can occur. Similarly, data holders may include instructions for how to request sharing rights from the account owner(s) or administrator if that functionality is provided by the data holder.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.06","CX Guideline","Data Holder","MAY","If no accounts can be shown, data holders should provide a message to consumers confirming that data will not be shared during this process.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.07","CX Guideline","Data Holder","MAY","Some scenarios may result in a user without sharing rights not seeing any accounts in the account selection step. A data holder may choose to provide optional functionality to allow a user without sharing rights to send a request to the account owner(s) or administrators from the authorisation flow.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.08","CX Guideline","Data Holder","MAY","The request function is optional but permitted under the standards. It can be presented within the authorisation flow or elsewhere, at the data holder’s discretion.\n\nThis functionality would allow non-nominated persons or secondary users without sharing rights to request access. This could alert the account owner(s) or administrator(s) of the steps required to grant sharing rights, leading them to the relevant services for managing secondary users or nominated representatives.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active","2025-09-24"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.09","CX Guideline","Data Holder","MAY","If a data holder provides the optional request functionality and a user acts upon it, the data holder should provide a message to confirm that the request has been sent. This message should be clearly visible and shown as soon as the action has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.01","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.02","CX Standard","Data Holder","MUST","Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. The data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account confirm [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.03","CX Guideline","Data Holder","MAY","Where a consumer only has one account, data holders can meet CX Standards for Authorisation by omitting the account selection step and only displaying the account on the final confirmation page.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.04","CX Guideline","Data Holder","MAY","Data holders should include a message indicating that some accounts may not be shown, and instructions on where the consumer can find more information.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Retired","2021-10-25"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.01","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\n\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.02","CX Standard","Data Holder","MAY","Data holders MAY include additional functionality to support account discovery and selection where further navigation or interaction is required to view all accounts. This may, for example, include search, sort, filter, scroll, grouping, and pagination, or other controls in line with existing consumer experiences. Any such functionality MUST NOT introduce unwarranted friction. \n\nNote: Unwarranted friction should have regard to CDR Rule 4.24 and is considered to include the addition of any requirements beyond normal data holder practices for an equivalent account selection process.","Authorisation Standards, Authorisation: Account selection functionality [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.03","CX Guideline","Data Holder","MAY","These artefacts show an example implementation of selection functionality, which may or may not be suitable in every situation. Data holders should use their discretion and implement the most appropriate options for their use cases.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.04","CX Guideline","Data Holder","MAY","Data holders should allow consumers to search, sort, filter and select their accounts in a way that is aligned to the outcomes consumers are seeking.\n\nFor example, a consumer may want to search, sort, and filter by nicknames, account numbers, account type, or other elements the account may refer to such as any related plans, services, properties, numbers, and products.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.05","CX Guideline","Data Holder","MAY","If enhanced selection functionality is implemented alongside pagination, filter or search, data holders should consider consumer expectations, technical feasibility and their existing user experiences. \n\nData holders should provide feedback to users to:\n• Prevent errors- This ensures the system aligns with user expectations. For example, if “Select all” applies only to the current page, this limitation should be clearly communicated to avoid misunderstandings.\n• Minimise cognitive load- Users shouldn’t have to manually track selections across multiple pages.\n\nOffering selection options like “Select all [n] accounts on this page,” “Select all [n] accounts on all pages,” and “Select none” helps ensure clarity and simplifies bulk actions.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World, Error Prevention, Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.06","CX Guideline","Data Holder","MAY","If scrolling is required to view the total number of accounts, data holders should allow consumers to search and filter their accounts in a way that is aligned to the outcomes consumers are seeking.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.07","CX Standard","Data Holder","MUST","When the authorisation flow is presented to the consumer in a data holder app, the data holder MUST provide consumers with the ability to switch or add user profiles based on the profiles supported by that app.","Authorisation Standards, Authorisation: Add or Switch Profiles [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","05. Selection functionality (3)","3AU.05.08","CX Guideline","Data Holder","MUST","In line with existing practices, a data holder may provide functionality that allows a consumer to add, register, or switch profiles prior to, or after, authentication.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","05. Selection functionality (2)","3AU.05.09","CX Guideline","Data Holder","MUST","Data holders may present the profile selection step at different points in the authorisation process, depending on the authentication flow. For example, it may occur after authentication for Redirect to Web flows, or when switching or adding users for in-app authorisation flows.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.01","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(e) if authorisation is being sought for disclosure over a period of time―what that period is;","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.02","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(d) whether the authorisation is being sought for:\n(i) disclosure of CDR data on a single occasion; or\n(ii) disclosure of CDR data over a period of time of not more than 12 months;\n\nNote: While certain consents by a CDR business consumer can have a period of 7 years, a corresponding authorisation cannot be for more than 12 months before renewal under subparagraph (1)(d)(ii).","CDR Rule 4.23(1)(d)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-02-22"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.03","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is absent or 0, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nData holders may consider communicating the sharing period as a single disclosure instance, but the phrasing is at the discretion of the data holder.","Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.04","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is greater than 0 but less than 24 hours, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nData holders may consider communicating the sharing period as a single disclosure instance occurring within a specific timeframe, but the phrasing is at the discretion of the data holder.","Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","07. Layout variation","3AU.07.01","CX Guideline","Data Holder","MAY","Data holders should align the authorisation flow to their design systems and/or experience languages to facilitate familiar, intuitive, and trustworthy authorisations",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","08. Cancellation","3AU.08.01","CX Guideline","Data Holder","MAY","Data holders should outline the consequences of choosing to cancel throughout the authentication and authorisation process.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","08. Cancellation","3AU.08.02","CX Guideline","Data Holder","MAY","If a consumer cancels at some point in the Consent Flow, CDR participants should confirm that data was not or will not be shared.\n\nThe CDR receipt should be given in writing.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.01","CDR Rule","Data Holder","MUST","(1) If a data holder has received a notice under rule 4.18C or 4.20S, the data holder must, in accordance with this Division, invite the CDR consumer to amend the authorisation to disclose CDR data accordingly.","CDR Rule 4.22A(1)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2024-02-22"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.02","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(a) subject to subrule (2), the name of the accredited person that made the request;","CDR Rule 4.23(1)(a)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.03","CDR Rule","Data Holder","MUST NOT","When asking a CDR consumer to authorise the disclosure of CDR data or to amend a current authorisation, the data holder must not do any of the following:\n(a) add any requirements to the authorisation process beyond those specified in the data standards and these rules;\n(b) provide or request additional information during the authorisation process beyond that specified in the data standards and these rules;\n(c) offer additional or alternative services as part of the authorisation process;\n(d) include or refer to other documents.","CDR Rule 4.24","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.16","CX Guideline","Data Holder","MAY","CDR Rules 4.23(1)(a) and (2) require data holders to refer to the accredited person's name using the legal entity name held in the Register during Authorisation.","CDR Rule 4.23(1)(a) and (2) | 10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.27","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.29","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.36.0","2026-03-18","Active"]
["3AU1. Amending Authorisation","01. Account selection","3AU1.01.12","CX Standard","Data Holder","MUST","Where account selection applies, Data Holders MUST pre-select accounts that were associated with the previous authorisation provided these accounts remain eligible and available to share. Data Holders MAY allow these accounts to be amended, and MAY provide information regarding the pre-selection of accounts.","Amending Authorisation Standards, Authorisation: Account Selection [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","01. Account selection","3AU1.01.13","CX Standard","Data Holder","MUST","Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. The data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account confirm [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU1. Amending Authorisation","01. Account selection","3AU1.01.26","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.16.0","2021-03-17","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.04","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(c) the types of CDR data for which the data holder is seeking an authorisation to disclose;","CDR Rule 4.23(1)(c)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.05","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(b) the period of time to which the CDR data that was the subject of the request relates;","CDR Rule 4.23(1)(b)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.06","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(e) if authorisation is being sought for disclosure over a period of time―what that period is;","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.07","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(d) whether the authorisation is being sought for:\n(i) disclosure of CDR data on a single occasion; or\n(ii) disclosure of CDR data over a period of time of not more than 12 months;\n\nNote: While certain consents by a CDR business consumer can have a period of 7 years, a corresponding authorisation cannot be for more than 12 months before renewal under subparagraph (1)(d)(ii).","CDR Rule 4.23(1)(d)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2024-02-22"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.08","CDR Rule","Data Holder","MUST","(1) An authorisation to disclose particular CDR data to an accredited person expires at the earliest of the following:\n(g) if the authorisation was for disclosure of CDR data over a specified period—the end of:\n(ii) if the period of the authorisation has been amended in accordance with this Division―that period as last amended;","CDR Rule 4.26(1)(g)(ii)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.09","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(g) instructions for how the authorisation can be withdrawn.","CDR Rule 4.23(1)(g)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.10","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(f) a statement that, at any time, the authorisation can be withdrawn;","CDR Rule 4.23(1)(f)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.11","CDR Rule","Data Holder","MUST","For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.","CDR Rule 7.2(8)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.14","CX Standard","Data Holder","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-24"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.15","CX Standard","Data Holder","MUST","Data Holders MUST indicate where a dataset is being added to an authorisation or a disclosure duration is being amended. Data Holders MAY apply this standard to other changing attributes, but this MUST ONLY apply where the attribute in the new authorisation differs to that of the previous authorisation. How a changed attributed is signified is at the Data Holder’s discretion.","Amending Authorisation Standards, Authorisation: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.17","CX Guideline","Data Holder","MAY","Data holders can meet CX Standard on Authorisation: Account confirm with the account selection step only. The selected accounts do not need to be displayed again on the final confirmation page.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.18","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(b) requires data holders to give consumers information about the historical range of data that may be accessed under the authorisation.\nThe historical range of consumer data a data holder may disclose can be:\n• up to 2 years, as required by the rules; \n• a shorter historical period, for example, if the consumer became a customer more recently or if the account was opened more recently (except in the energy sector, where LCCD requirements apply. See Energy sector information below); or \n• a longer historical period, such as the earliest holding date or a more recent date, which may be applicable if the data holder chooses to provide additional historical data voluntarily.\n\nNote 1: If historical ranges differ across datasets — for example, if one dataset goes back to 1 April 2023 and another dataset goes back to 30 August 2023 — then the data holder may consider either:\n• showing the specific historical range for each dataset, as demonstrated in the CX Guidelines, or \n• displaying the earliest historical date across all datasets (in this example, 1 April 2023). \n\nNote 2: The technical standards allow data recipients to limit how much historic data is collected when calling the relevant APIs using the oldest-time or oldest-date fields. Data holders must use these fields to constrain the data that they disclose. Data holders should be mindful of the fact that data recipients may wish to collect more or less historical data than the data holder makes available when developing wording to meet the requirements of rule 4.23(1)(b). The precise wording is at the data holder's discretion, but may consider, for example:\nThis may include historical data that dates back [n years / to date], depending on your agreement with [ADR].\n\nBanking and Non-Bank Lender sector\nData holders must also refer to Subclauses 3.2(6) and (7) of Schedule 3. For open accounts, data holders must share a historical range of up to 2 years before the request date for transaction data, and up to 13 months for account data related to an authorisation for direct debit data. Data holders may voluntarily share older data. For closed accounts, if the relevant account is closed on the request date, CDR data, including historical data, related to that account is not considered required consumer data but can be shared voluntarily by the data holders.\n\nEnergy sector\nData holders must also refer to Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4. The last 2 years of billing data for a relevant account is required consumer data.\n'Electricity usage’ energy data language data cluster — which pertains to metering data held by AEMO, as per clause 1.2–1.3(4) of Schedule 4 — is available for up to 2 years before the request date. This includes usage data for the duration that a customer has been the account holder for the given NMI, including any time before they became a customer of their current retailer.","CDR Rule 4.23(1)(b); Subclauses 3.2(6) and (7) of Schedule 3; Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4 | Technical Standards: Banking APIs, oldest-time field [https://consumerdatastandardsaustralia.github.io/standards/#banking-apis]; Energy APIs, oldest-date field [https://consumerdatastandardsaustralia.github.io/standards/index.html?examples#cdr-energy-api_get-usage-for-service-point] | CDR Support Portal: Historical transaction data: Earliest Holding Day [https://cdr-support.zendesk.com/hc/en-us/articles/10085678783759-Historical-transaction-data-Earliest-Holding-Day]; Guidance on Energy Last Consumer Change Date (LCCD) [https://cdr-support.zendesk.com/hc/en-us/articles/12444620614799-Guidance-on-Energy-Last-Consumer-Change-Date-LCCD]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2025-09-24"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.19","CX Guideline","Data Holder","MAY","Data holders should use plain language phrases such as 'stop sharing' to refer to how a consumer can withdraw authorisation.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.20","CX Guideline","Data Holder","MAY","In addition to providing withdrawal instructions, data holders should provide instructions for how to review sharing arrangements.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.21","CX Guideline","Data Holder","MAY","Data holders should include their CDR policy in the Authorisation flow.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.22","CX Guideline","Data Holder","MAY","Data holders should use terms that align with equivalent authorisation actions already in use in their digital experiences. The chosen language should clearly communicate a final affirmative action to mitigate user error. CX research suggests that terms like 'confirm' and 'authorise' successfully and meaningfully communicate the final affirmative action.","10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.23","CX Guideline","Data Holder","MAY","Data holders should redirect the consumer back to the data recipient following the final affirmative action.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.24","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data.\n\nThe receipt should provide the consumer with a record of their sharing arrangement and highlight changes to the authorisation.\n\nThe CDR receipt should be given in writing and available through the data holder consumer dashboard.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.25","CX Standard","Data Holder","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.16.0","2021-03-17","Active","2025-09-24"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.28","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(e) requires data holders to state the forward-looking time period where the authorisation is sought for the disclosure of CDR data. This cannot be more than 12 months. \n\nCDR Rule 4.23(1)(e)","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","03. Multiple customer profiles","3AU1.03.01","CX Standard","Data Holder","MUST","Where customer profile selection applies, Data Holders  SHOULD omit the profile selection step and assume the customer profile associated with the existing authorisation. Data Holders MAY indicate which profile the authorisation relates to during the authorisation process.","Amending Authorisation Standards, Authorisation: Customer Profile [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","04. Layout variation","3AU1.04.01","CX Guideline","Data Holder","MAY","Data holders may align the authorisation flow to their design systems and/or experience languages to facilitate familiar, intuitive, and trustworthy authorisations.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.01","CX Standard","Data Holder","MUST","Where account selection applies, Data Holders MUST pre-select accounts that were associated with the previous authorisation provided these accounts remain eligible and available to share. Data Holders MAY allow these accounts to be amended, and MAY provide information regarding the pre-selection of accounts.","Amending Authorisation Standards, Authorisation: Account Selection [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.02","CX Standard","Data Holder","SHOULD","If certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.\n\nData holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nData holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nNote: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.","Authorisation Standards, Unavailable Accounts: Displaying accounts  [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.03","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.04","CX Standard","Data Holder","MAY","If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.05","CX Guideline","Data Holder","MAY","In accordance with the Unavailable Accounts: Displaying accounts standard, data holders should display unavailable accounts as part of the account selection step, with an explanation of why these are unable to be shared. \n\nWhere data holders are unable to display unavailable accounts, they may instead provide a generic explanation for unspecified accounts, in accordance with the Unavailable Accounts: No accounts can be shown standard.\n\nUnavailable accounts may include accounts that are not in scope for data sharing under CDR, accounts for which data sharing is voluntary, or where a data holder deems it necessary to prevent financial harm or abuse.\n\nDespite being unavailable, data holders are recommended to show these accounts to avoid confusion and align with consumer expectations.\n\nFor further detail about covered products and required and voluntary CDR data, refer to the https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors.","CDR Rules Clause 3.2 of Schedule 3; Clause 3.2 of Schedule 4 | Authorisation Standards, Unavailable Accounts: Displaying accounts [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]; Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | ACCC Compliance guide for data holders in the banking and non-bank lender sectors [https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.06","CX Guideline","Data Holder","MAY","If an account holder has not given a secondary user instruction for an account with a secondary user, that account will appear as unavailable to the secondary user.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.07","CX Guideline","Data Holder","MAY","Data holders should provide clear explanations to consumer about why their accounts are unavailable. \n\nThese explanations should only reference account types that the consumer holds, and should be contextually shown in relation to the account where possible.\n\nData holders should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.08","CX Guideline","Data Holder","MAY","The request function is optional but permitted under the standards. It can be presented within the authorisation flow or elsewhere, at the data holder’s discretion.\n\nThe purpose would be to allow non-nominated persons or secondary users without sharing rights to request access. This could alert the account owner(s) or administrator(s) of the steps required to grant sharing rights, leading them to the relevant services for managing secondary users or nominated representatives.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.01","CDR Rule","Data Holder","MUST","(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following: \n(a) the pre-approval option, under which joint account data may be disclosed in response to a valid consumer data request on the authorisation of the requester without the approval of the relevant account holders","CDR Rule 4A.5(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.02","CDR Rule","Data Holder","MUST","(2) The data holder must provide for the pre-approval and non-disclosure options to be available for a joint account.","CDR Rule 4A.5(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.03","CDR Rule","Data Holder","MUST","(4) For the purposes of rule 4A.12, where the pre-approval option applies to a joint account and the requester authorises the disclosure of joint account data in response to a valid consumer data request:\n(a) each relevant account holder is taken to have approved the disclosure;","CDR Rule 4A.5(4)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.04","CDR Rule","Data Holder","MUST","(5) Unless a sector Schedule provides otherwise, the pre-approval option applies to a joint account by default.","CDR Rule 4A.5(5)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.05","CDR Rule","Data Holder","MUST","The disclosure option that applies to a joint account may be changed in accordance with rule 4A.7 or 4A.8.","CDR Rule 4A.5(6)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.06","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to:\n(a) change the disclosure option that applies to the account in accordance with rule 4A.7; and\n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8;","CDR Rule 4A.6(1)(a), (b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.07","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(a) to a relevant account holder, to inform them that the requester has given, amended or withdrawn an authorisation, or that the authorisation has expired;\nin accordance with the data standards.","CDR Rule 4A.14(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.08","CDR Rule","Data Holder","MUST","(2) The data holder must make the appropriate approval notification to a joint account holder in relation to an event mentioned in subrule (1):\n(a) as soon as practicable after the event occurs, unless the joint account holder has selected an alternative schedule of notifications; and\n(b) through its ordinary means of contacting the joint account holders.","CDR Rule 4A.14(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.09","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.10","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.11","CX Standard","Data Holder","MAY","For the content of the approval notification, data holders MAY provide the consumer with instructions for how any relevant authorisation(s) or approval(s) can be reviewed.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Notification content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.12","CX Standard","Data Holder","MAY","Data holders MAY provide a mechanism or entry point for a notification schedule to be amended from or in relation to the notification itself.\n\nThis MAY, for example, allow a consumer to stop receiving the type of notification(s) from the notification itself.\n\nThe notification MAY also, for example, include a link to amend the notification schedule or instructions to direct the consumer to the appropriate place.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Contextual amendment [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.13","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.14","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.15","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.16","CX Guideline","Data Holder","MAY","Data holders should provide instructions for how a disclosure option can be changed.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.17","CX Guideline","Data Holder","MAY","Email is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.14(2)and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.11(a) and 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.18","CX Guideline","Data Holder","MAY","Data holders should include information about data sharing with the CDR.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.19","CX Guideline","Data Holder","MAY","Data holders should provide information about the ADR to relevant account holders. This should include the ADR's name, accreditation number and a link to the their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.20","CX Guideline","Data Holder","MAY","Where an alternative notification schedule is provided as per CDR Rule 4A.14(3), this notification may be omitted at the consumer's request.","CDR Rule 4A.14(3)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.21","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.16.0","2022-03-17","Active"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.01","CDR Rule","Data Holder","MUST","A data holder is not liable under these rules for a failure to comply with this Part if it considered that the relevant act or omission was necessary in order to prevent physical, psychological or financial harm or abuse to any person.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.02","CX Standard","Data Holder","MUST","Where rule 4A.15 is leveraged to allow a vulnerable requester to share their joint account data as if it were an individual account, the data holder MUST alert the requester, in the context of the authorisation flow, that the other joint account holder(s) will not be notified.\n\nThis alert SHOULD be applied where appropriate for joint account management in general, including the consumer dashboard and the Disclosure Option Management Service (DOMS).","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Rule 4A.15 exemptions [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.03","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.04","CX Guideline","Data Holder","MAY","Data holders may choose to leverage CDR Rule 4A.15 by allowing a vulnerable joint account holder to share joint account data as if it were from an individual account.\n\nThis may mean that the other account holder(s) are not alerted to the sharing of that data, and are not provided with an equivalent dashboard as per CDR Rule 4A.13.\n\nThe CX research and community consultation suggested that such an approach would support vulnerable consumers in accessing and benefitting from the CDR.","CDR Rule 4A.15 and 4A.13 | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; Joint accounts & the Consumer Data Right (Consumer Policy Research Centre) [https://cx.dsb.gov.au/overview/cx-reports/reports/community-engagement-reports-2018-2022#block-162f1af016ea80a08e25e56b8351c949]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.05","CX Guideline","Data Holder","MAY","Data holders should outline that sharing arrangements made by the vulnerable requester will not be visible to the other relevant account holder(s) on their consumer dashboard(s).",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.06","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.07","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.16.0","2022-03-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.01","CDR Rule","Data Holder","MUST","(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following: \n(b) the co-approval option, under which joint account data may be disclosed in response to a valid consumer data request only after:\n(i) the requester has authorised the disclosure; and\n(ii) each of the relevant joint account holders has approved the disclosure;","CDR Rule 4A.5(1)(b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.02","CDR Rule","Data Holder","MUST","(3) The data holder may provide for the co-approval option to be available for a joint account.","CDR Rule 4A.5(3)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.03","CDR Rule","Data Holder","MUST","(6) The disclosure option that applies to a joint account may be changed in accordance with rule 4A.7 or 4A.8.","CDR Rule 4A.5(6)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.04","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to:\n(a) change the disclosure option that applies to the account in accordance with rule 4A.7; and\n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8;","CDR Rule 4A.6(1)(a), (b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.05","CDR Rule","Data Holder","MUST","(4) If the co-approval option applies to the joint account, the data holder must, subject to subrule (5):\n(a) ask the requester for authorisation in accordance with rule 4.5 and Division 4.4;","CDR Rule 4A.10(4)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.06","CDR Rule","Data Holder","MUST","(4) If the co-approval option applies to the joint account, the data holder must, subject to subrule (5):\n(b) if the authorisation is given, invite the approval of the relevant account holders in accordance with rule 4A.11","CDR Rule 4A.10(4)(b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.07","CDR Rule","Data Holder","MUST","(4) If the co-approval option applies to the joint account, the data holder must, subject to subrule (5):\n(c) if all the relevant account holders give their approval, or are taken to have given their approval, comply with rules 4.6 to 4.7.","CDR Rule 4A.10(4)(c)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.08","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(a) indicate that an accredited person has requested disclosure of CDR data that relates to the joint account on behalf of the requester;","CDR Rule 4A.11(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.09","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(b) indicate that:\n(i) the requester has authorised, under Division 4.4, the disclosure of the joint account data; and","CDR Rule 4A.11(b)(i)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.10","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(b) indicate that:\n(ii) a co-approval option applies to the joint account;","CDR Rule 4A.11(b)(ii)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.11","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(c) indicate the matters referred to in paragraphs 4.23(1)(a), (b), (c), (d) and (e) so far as they relate to the request;","CDR Rule 4A.11(c)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.12","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(d) ask the relevant account holder to approve or not approve disclosure of the joint account data;","CDR Rule 4A.11(d)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.13","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(e) specify the time by which the data holder needs to receive any approval, and inform them that if an approval is not received by that time, the joint account data will not be disclosed;","CDR Rule 4A.11(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.14","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(f) inform them that any relevant account holder may, at any time, withdraw the approval using their consumer dashboard\n(g) indicate what the effect of removing the approval would be.","CDR Rule 4A.11(f), (g)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.15","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(a) to a relevant account holder, to inform them that the requester has given, amended or withdrawn an authorisation, or that the authorisation has expired;\nin accordance with the data standards.","CDR Rule 4A.14(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.16","CDR Rule","Data Holder","MUST","(2) The data holder must make the appropriate approval notification to a joint account holder in relation to an event mentioned in subrule (1):\n(a) as soon as practicable after the event occurs, unless the joint account holder has selected an alternative schedule of notifications; and\n(b) through its ordinary means of contacting the joint account holders.","CDR Rule 4A.14(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.17","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.18","CDR Rule","Data Holder","MUST","Obligation for data holder to provide relevant account holders with consumer dashboard\n(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(c) contains the details referred to in paragraph 1.15(1)(b) that relate to the joint account data; and\n(d) has a functionality that:\n(i) can be used by the relevant account holder to manage approvals in relation to each authorisation to disclose joint account data made by a requester; and\n(ii) allows for withdrawal, at any time, of such an approval; and\n(iii) is simple and straightforward to use; and\n(iv) is prominently displayed; and\n(v) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards.","CDR Rule 4A.13","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Retired","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.19","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.20","CX Standard","Data Holder","MUST","Where an account requires further actions or approvals before data can be disclosed, data holders MUST indicate this to the user visually and MUST provide an explanation of what is required or expected.\n\nThis MAY, for example, be achieved with a visual icon to indicate that the account is ‘pending’. This indication MUST be accompanied by an in-context explanation to describe what the status means. This explanation SHOULD include any required actions and any specified time frames.","Authorisation Standards, Authorisation: Pending status [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.21","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.22","CX Standard","Data Holder","MAY","For the content of the approval notification, data holders MAY provide the consumer with instructions for how any relevant authorisation(s) or approval(s) can be reviewed.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Notification content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.23","CX Guideline","Data Holder","MAY","CDR Rules allow, but do not require data holders to provide a co-approval disclosure option. Data holders may want to consider offering co-approval to align with consumer expectations, as identified in CX research and concerns raised by the community.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 1 and 2 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80df9a3ade191e9cf49e]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2020 Phase 3, Round 6 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80cdb723db0b24fcbd35]; Joint accounts & the Consumer Data Right (Consumer Policy Research Centre) [https://cx.dsb.gov.au/overview/cx-reports/reports/community-engagement-reports-2018-2022#block-162f1af016ea80a08e25e56b8351c949] | Submissions: Design Paper: an ‘opt-out’ data sharing model for joint accounts in the banking and energy sectors #176 [https://github.com/ConsumerDataStandardsAustralia/standards/issues/176]; Consumer Data Right rules amendments (version 3), Exposure Draft [https://treasury.gov.au/consultation/c2021-187223].","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.24","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.25","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.26","CX Guideline","Data Holder","MAY","Data holders should provide instructions for how a disclosure option can be changed.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.27","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.11(a) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.11(a) and 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.28","CX Guideline","Data Holder","MAY","The invitation to approve data sharing (CDR Rule 4A.10(4)(b)) and the approval notification (CDR Rule 4A.14(1)(a)) can be provided in the same notification. This notification can also relate to more than 1 joint account.\n\nWhere an alternative notification schedule is provided as per CDR Rule 4A.14(3), the approval notification may be omitted at the consumer's request.","CDR Rule 4A.10(4)(b), 4A.14(1)(a) and 4A.14(3)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.29","CX Guideline","Data Holder","MAY","Data holders should include information about data sharing with the CDR.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.30","CX Guideline","Data Holder","MAY","Data holders should provide more information about the ADR to relevant account holders. Doing so can help remove a key barrier to co-approval data sharing requests.\n\nIn addition to the ADR's name, data holders should also include the ADR's accreditation number and a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.31","CX Guideline","Data Holder","MAY","Data holders should provide a pathway for relevant account holders to find out how their data will be handled by the data recipient.","CX Research: 2020 Phase 3, Round 1 and 2 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80df9a3ade191e9cf49e]; Joint accounts & the Consumer Data Right (Consumer Policy Research Centre) [https://cx.dsb.gov.au/overview/cx-reports/reports/community-engagement-reports-2018-2022#block-162f1af016ea80a08e25e56b8351c949]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.32","CX Guideline","Data Holder","MAY","Where there are multiple joint accounts, data holders should provide a way for the relevant account holder(s) to select which joint accounts they approve for data sharing.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.33","CX Guideline","Data Holder","MAY","Data holders should inform the requester when approval has been given by the relevant account holder(s).","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.34","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.16.0","2022-03-17","Active"]
["4CM. Consent Management","01. Withdrawing consent","4CM.01.","CX Standard","Data Recipient","MUST","If a data recipient does not have a general policy to delete redundant data, and the consumer has not already requested that their redundant data be deleted:\n\n• Data recipients MUST allow consumers to elect to have their redundant data deleted as part of the withdrawal process prior to the final withdrawal step.\n• Data recipients SHOULD consider prompting consumers to exercise this right at appropriate times (e.g. when inaction on the part of the consumer may cause them to lose the opportunity to exercise the right to delete their redundant data).","Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","CX Guidelines v1.4.0 PDF, p. 101 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Recipient","MAY","Data recipients should make a link to the CDR policy accessible on the dashboard.",null,"CX Guidelines v1.4.0 PDF, p. 100 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that:\n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’)\n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 96 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Recipient","MAY","Data recipients should provide a link to the CDR policy in the consumer dashboard.",null,"CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Holder, Data Recipient","MAY","Following an authorisation the consumer should be directed back to the data recipient and presented with a 'confirmation' screen.\n\nThis 'confirmation' screen may be presented in the data recipient dashboard.\n\nData recipients and data holders should provide the consumer with a contextual 'walkthrough’ or ‘tutorial' to introduce them to the concept of the dashboard if they are not familiar with it.",null,"CX Guidelines v1.4.0 PDF, p. 89 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.01","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(a) can be used by the CDR consumer to manage:\n(i) such requests; and\n(ii) associated consents; and\n(b) contains the details of each consent specified in subrule (3) and the information specified in subrule (3A);","CDR Rule 1.14(1)(a)–(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-14"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.02","CDR Rule","Data Recipient","MUST","(2) Such a service is the accredited person’s consumer dashboard for that consumer.","CDR Rule 1.14(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.03","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.19(1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.04","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(g) if the consent is not current—when it expired;","CDR Rule 1.14(3)(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.05","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(b) for a use consent―details of the specific use or uses for which the CDR consumer has given their consent;","CDR Rule 1.14(3)(b) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.06","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(c) when the CDR consumer gave the consent;","CDR Rule 1.14(3)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.07","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(f) if the consent is current—when it is scheduled to expire;\n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.08","CDR Rule","Data Recipient","MUST","(5) A copy of the CDR receipt may be included in the CDR consumer’s consumer dashboard.","CDR Rule 4.18(5)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.09","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(c) allows the CDR consumer, at any time, to withdraw a current consent; and \n(d) as part of the process of withdrawing a consent, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a consent;","CDR Rule 1.14(1)(c)–(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.10","CDR Rule","Data Recipient","MUST","(2A) The consumer dashboard may also allow a CDR consumer to amend a current consent.","CDR Rule 1.14(2A)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.11","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(a) details of the CDR data to which the consent relates; ","CDR Rule 1.14(3)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.12","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(h) information relating to CDR data that was collected or disclosed pursuant to the consent (see rules 7.4 and 7.9);","CDR Rule 1.14(3)(h)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.13","CDR Rule","Data Recipient","MUST","(1) For section 56EH of the Act, and subject to subrule (2), an accredited data recipient that collected the CDR data in accordance with section 56EF of the Act as a result of a collection consent must update the person’s consumer dashboard as soon as practicable to indicate:\n(a) what CDR data was collected; and\n(b) when the CDR data was collected; and\n(c) the CDR participant for the CDR data from which the CDR data was collected.","CDR Rule 7.4(1) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.14","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(d) whether the consent applies:\n(i) on a single occasion; or\n(ii) over a period of time;","CDR Rule 1.14(3)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.15","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(e) if a collection consent or disclosure consent applies over a period of time:\n(i) what that period is; and\n(ii) how often data has been, and is expected to be, collected or disclosed over that period;","CDR Rule 1.14(3)(e)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.16","CDR Rule","Data Recipient","MUST","(8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.\n\n(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy: \n(a) electronically; or \n(b) in hard copy; \nas directed by the consumer.","CDR Rule 7.2(8), (9)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.17","CX Guideline","Data Recipient","MAY","Data recipients and data holders should provide the consumer with a contextual 'walkthrough’ or ‘tutorial' to introduce them to the concept of the dashboard if they are not familiar with it.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.18","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, archived), or presenting key details up front, such as when consent was granted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.19","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.\n\nFor example, a consumer may want to sort by data recipient, data cluster, or by a user-defined tag.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.20","CX Guideline","Data Recipient","MAY","Data recipients should organise consents by data holder brand names in a way that is consistent with how data holders are referenced in the provider/data holder selection step when consent is first being sought.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.21","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to create user-defined tags, names, and/or descriptions (e.g. home deposit) for each data sharing arrangement.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.22","CX Guideline","Data Recipient","MAY","Data recipients should include a link to the data holder's specific page on  http://www.cdr.gov.au/find-a-provider for verification purposes. ",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.23","CX Guideline","Data Recipient","MAY","Data recipients should organise consents by referring to the use case/purpose, the brand name, and software product name to aid consent and authorisation recognitions and management across dashboards.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.24","CX Guideline","Data Recipient","MAY","Data recipients should show the status of the consent, which may refer to it being 'active', 'cancelled', 'expired', or relating to a 'once-off’ instance of sharing.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.25","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.\n\nThis may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent).","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.26","CX Guideline","Data Recipient","MAY","Data recipient dashboards should display which accounts they are collecting data from to facilitate consumer comprehension and consent management.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.27","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to download and/or request a record of the sharing arrangement, and/or a copy of their Receipt(s).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.28","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.29","CX Guideline","Data Recipient","MAY","Data recipients may allow consumers to add or remove accounts from an existing consent.\n\nThis process may be initiated by the ADR, such as by inviting them to add new account types to an existing consent, or by allowing the consumer to trigger this process on their ADR consumer dashboard.\n\nThe account amendment process should trigger the consent flow and DH authentication/authorisation process to add or remove the account(s) from the associated authorisation.\n\nData recipients should supply the relevant cdr_arrangement_id to the DH when seeking to have a current authorisation amended.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.30","CX Guideline","Data Recipient","MAY","Data recipients should explain how the time period complies with the data minimisation principle (DMP) for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for a collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe're accessing your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe're accessing data that dates back to [earliest date of record] so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 1.8","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.31","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.\n\nThis information should clearly communicate the purposes and benefits of data sharing to the consumer.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.32","CX Guideline","Data Recipient","MAY","Privacy Safeguard 5\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection. \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection). \n\nNote: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance.","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.33","CX Guideline","Data Recipient","MAY","Data recipients should use the phrases ‘Granted’, 'Expire' and ‘Sharing period’ to refer to the time-based qualities of the data sharing arrangement.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.34","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(e) allows the CDR consumer to elect that redundant data be deleted in accordance with these rules and be able to withdraw such an election; ","CDR Rule 1.14(1)(e)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.35","CDR Rule","Data Recipient","MUST","(3A) For paragraph (1)(b), the other information is:\n(a) a statement that the CDR consumer is entitled to request further records in accordance with rule 9.5; and\n(b) information about how to make such a request.","CDR Rule 1.14(3A)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.36","CDR Rule","Data Recipient","MUST","(2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:\n(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and\n(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);\nthat relates to the CDR consumer.","CDR Rule 9.5(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.37","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to surface information on dispute resolution and making a complaint. This may include:\n• a link to the complaints section of the ADR’s CDR policy; and/or\n• a summary of the complaint handling process.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.38","CX Guideline","Data Recipient","MAY","Data recipients can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include any known information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.39","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to surface information about data deletion found in their CDR policy along with a link to read this policy. This may include:\n• when and how redundant data is deleted;\n• how a CDR consumer may elect for this to happen.","CDR Rule 7.2(4)(k)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Retired","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.40","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. CX research highlighted the importance of including: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.41","CX Guideline","Data Recipient","MAY","These artefacts demonstrate what a consumer might see where an ADR has a policy to delete redundant data by default. \n\nAs per CDR Rule 1.14(1)(e), where an ADR will de-identify redundant data instead of deleting it, the ADR is required to provide the consumer with the ability to elect that redundant data be deleted instead. ADRs should consider providing this functionality in a way that is consistent with any other data handling information and functionality, and may surface the right to delete election in a location similar to the 'Data handling' component found on this screen.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.42","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.1","2022-04-07","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.43","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(f) is simple and straightforward to use; and \n(g) is prominently displayed and readily accessible to the CDR consumer.","CDR Rule 1.14(1)(f)–(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.44","CX Guideline","Data Recipient","MAY","In addition to the CX Standards for CDR receipt delivery, data recipients should also make the CDR receipt available on the dashboard.","Notification Standards, CDR Receipt: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.01","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(a) can be used by the CDR consumer to manage:\n(i) such requests; and\n(ii) associated consents; and\n(b) contains the details of each consent specified in subrule (3) and the information specified in subrule (3A);","CDR Rule 1.14(1)(a), (b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.02","CDR Rule","Data Recipient","MUST","(2) Such a service is the accredited person’s consumer dashboard for that consumer.","CDR Rule 1.14(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.03","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(g) if the consent is not current—when it expired;","CDR Rule 1.14(3)(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.04","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(c) when the CDR consumer gave the consent;","CDR Rule 1.14(3)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.05","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(f) if the consent is current—when it is scheduled to expire;\n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.06","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(e) if a collection consent or disclosure consent applies over a period of time:\n(i) what that period is; and\n(ii) how often data has been, and is expected to be, collected or disclosed over that period;","CDR Rule 1.14(3)(e)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.07","CDR Rule","Data Recipient","MUST","(5) A copy of the CDR receipt may be included in the CDR consumer’s consumer dashboard.","CDR Rule 4.18(5)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.08","CDR Rule","Data Recipient","MUST","(8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.\n\n(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy:\n(a) electronically; or\n(b) in hard copy;\nas directed by the consumer.","CDR Rule 7.2(8), (9)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.09","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(c) has a functionality that:\n(i) allows a CDR consumer, at any time, to:\n(A) withdraw current consents; and\n(B) elect that redundant data be deleted in accordance with these rules and withdraw such an election; and\n(ii) is simple and straightforward to use; and\n(iii) is prominently displayed.","CDR Rule 1.14(1)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.10","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following:\n(a) details of the CDR data to which the consent relates;","CDR Rule 1.14(3)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.11","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(h) information relating to CDR data that was collected or disclosed pursuant to the consent (see rules 7.4 and 7.9);","CDR Rule 1.14(3)(h)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.12","CDR Rule","Data Recipient","MUST","(2) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to an accredited person must, as soon as practicable, update each\nconsumer dashboard that relates to the request to indicate:\n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the accredited person, identified in accordance with any entry on the Register of Accredited Persons specified as being for that purpose.","CDR Rule 7.9(2) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.13","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(d) whether the consent applies:\n(i) on a single occasion; or\n(ii) over a period of time;","CDR Rule 1.14(3)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.14","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.15","CX Standard","Data Recipient","MUST","If:\n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; or\n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.","Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.16","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, inactive), or presenting key details up front, such as when consent was granted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.17","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.\n\nFor example, a consumer may want to sort by data recipient, data cluster, or by a user-defined tag.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.18","CX Guideline","Data Recipient","MAY","Data recipients should organise disclosures to accredited persons using the brand and software product name. The logo held at the brand level should also be presented in relation to the consent to aid recognition and management.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.19","CX Guideline","Data Recipient","MAY","Data recipients should surface the legal entity of the ADR being disclosed to for the AP Disclosure.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.20","CX Guideline","Data Recipient","MAY","Data recipients should provide a link for consumers to verify a data recipient's accreditation via the CDR website. The following link could be used for this purpose: https://www.cdr.gov.au/find-a-provider","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.21","CX Guideline","Data Recipient","MAY","Data recipients should show the status of the consent, which may refer to it being 'active', 'cancelled', 'expired', or relating to a 'once-off’ instance of sharing.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.22","CX Guideline","Data Recipient","MAY","Data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the data recipient for additional information.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.23","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.\nThis may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent).","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.24","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to download and/or request a record of the sharing arrangement, and/or a copy of their Receipt(s).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.25","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.26","CX Guideline","Data Recipient","MAY","The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.27","CX Guideline","Data Recipient","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure). \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure). \n\nIf a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.","CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.28","CX Guideline","Data Recipient","MAY","Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.29","CDR Rule","Data Recipient","MUST","(2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:\n(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and\n(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);\nthat relates to the CDR consumer.","CDR Rule 9.5(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.30","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n\n(f) is simple and straightforward to use; and\n(g) is prominently displayed and readily accessible to the CDR consumer.","CDR Rule 1.14(1)(f)–(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.31","CX Guideline","Data Recipient","MAY","In addition to the CX Standards for CDR receipt delivery, data recipients should also make the CDR receipt available on the dashboard.","Notification Standards, CDR Receipt: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.32","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to surface information on dispute resolution and making a complaint. This may include:\n• a link to the complaints section of the ADR’s CDR policy; and/or\n• a summary of the complaint handling process.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","02. Right to delete","4CM1.02.","CDR Rule","Data Recipient","MUST","The consumer may choose to have redundant data deleted at any time before consent expires unless the data recipient has informed the consumer that they have a general policy of deleting redundant CDR data.","CDR Rule 4.11(1)(e), 4.16(2)","CX Guidelines v1.4.0 PDF, p. 100 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.01","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.19","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.02","CDR Rule","Data Recipient","MUST","(1) An accredited person must give the CDR consumer a notice that complies with this rule (a CDR receipt) as soon as practicable after:\n(aa) the CDR consumer amends such a consent in accordance with this Division;","CDR Rule 4.18(1)(aa)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.03","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(i) details of each amendment (if any) that has been made to the consent.","CDR Rule 1.14(3)(i)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.04","CDR Rule","Data Recipient","MUST","An amendment of a consent takes effect when the CDR consumer amends the consent.","CDR Rule 4.12A","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.05","CX Guideline","Data Recipient","MAY","Data recipients may provide customers with pathways to past CDR Receipts from the sharing arrangement.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.06","CX Guideline","Data Recipient","MAY","Data recipients may allow consumers to access the associated amendment request that was sent to the consumer such as the invitation specified in CDR Rule 4.12B(1) and (2)(b).","CDR Rule 4.12B(1), (2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.07","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to access the details of past amendments from the current version of the consent.\n\nThe details of past amendments should be accessible on the dashboard as per CDR Rule 1.14(3)(i) as well as CDR receipts relating to past consent amendments. \n\nAmendment details should refer to the specific attributes, including additional uses, that were amended, added, or removed, along with the date of the amendment.","CDR Rule 1.14(3)(i)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","03a. ADR uses OSPs","4CM1.03a.","CDR Rule","Data Recipient","MUST NOT","(2) For these rules, a CDR outsourcing arrangement is a written contract between a person (the principal) and another person (the provider) under which:\n\n(b) the provider is required to comply with the following requirements in relation to any service data:\n(ii) the provider must not use or disclose the service data other than in accordance with a contract with the principal.","CDR Rule 1.10(2)(b)(ii)","CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","03a. ADR uses OSPs","4CM1.03a.","CX Guideline","Data Recipient","MAY","If data is being shared with outsourced providers, data recipients should include this information on the dashboard.",null,"CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","03a. ADR uses OSPs","4CM1.03a.","CDR Rule","Data Recipient","MUST","(2) The steps are:\n(b) direct any outsourced service provider of the accredited data recipient that had been provided with a copy of the redundant data:\n(i) either to:\n(A) return the redundant data to the accredited data recipient; or\n(B) delete the redundant data, as well as any CDR data that has been directly or indirectly derived from it, and notify the accredited data recipient of the deletion; and\n(ii) if the outsourced service provider has provided any such data to another person―to:\n(A) direct the person to take either of the steps referred to in subparagraph (i) in relation to that data; and\n(B) cause similar directions to be made to any person to whom such data has been further disclosed.","CDR Rule 7.12(2)(b)","CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","03a. Using OSPs","4CM1.03a.06","CX Guideline","Data Recipient","MAY","Data recipients should outline what the outsourced service provider, sponsor or principal is doing in relation to the specific consent and data, for example: collection; use; transformation; storage; de-identification; etc.","CDR Rule 4.11(3)(f)(i) | CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03a. Using OSPs","4CM1.03a.07","CX Guideline","Data Recipient","MAY","Where outsourced service providers are used, CDR Rule 4.11(3)(f) requires the accredited person to give the consumer information about the OSP in the consent flow but not on dashboards. These guidelines recommend that any OSP listed during consent and their roles be surfaced in dashboards as well to support consistency and meet consumer expectations, as identified in consumer research.","CDR Rule 4.11(3)(f) | CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03a. Using OSPs","4CM1.03a.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf.\n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.01","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(ha) if the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:\n(i) the sponsor’s name; and\n(ii) the sponsor’s accreditation number;","CDR Rule 1.14(3)(ha)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.02","CDR Rule","Data Recipient","MUST","(2) Where the CDR data was collected by a sponsor on behalf of an affiliate: \n(a) the sponsor is not required to provide the consumer dashboard; \n\nNote: The affiliate, as an accredited person that makes the consumer request through the sponsor, is required to provide the consumer dashboard under subrule 1.14(1).","CDR Rule 7.4(2)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.03","CDR Rule","Data Recipient","MUST","(2) Where the CDR data was collected by a sponsor on behalf of an affiliate:\n(c) the dashboard must also indicate that the CDR data was collected by the sponsor on behalf of the affiliate.","CDR Rule 7.4(2)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-03-06"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement","4CM1.03b.05","CX Guideline","Data Recipient","MAY","For a generic example demonstrating how CDR Rule 7.4, privacy safeguard 5 may be implemented, see annotations 12, 13, and 32 in https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents#block-1012235b83724b498179a1467287abec","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data/] | CX Guidelines: Consent Management (Data recipient): Collection and use consents, Collection and use consents - default example [https://cx.dsb.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents#block-1012235b83724b498179a1467287abec]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement","4CM1.03b.06","CX Guideline","Data Recipient","MAY","Data recipients should outline what the outsourced service provider, sponsor or principal is doing in relation to the specific consent and data, for example: collection; use; transformation; storage; de-identification; etc.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.08","CX Guideline","Data Recipient","MAY","Various CDR Rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the sponsor or principal to be referenced. \n\nThese artefacts demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the sponsor or principal is only noted as a background detail.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement","4CM1.03b.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf.\n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.10","CDR Rule","Data Recipient","MUST","(2) Where the CDR data was collected by a sponsor on behalf of an affiliate \n(b) the sponsor and the affiliate may choose which of them will be responsible for updating the consumer’s dashboard in accordance with subrule (1);","CDR Rule 7.4(2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.04","CDR Rule","Data Recipient","MUST","(5) Where a CDR representative principal makes a consumer data request at the request of a CDR representative, it may arrange for the CDR representative to provide the consumer dashboard on its behalf.","CDR Rule 1.14(5)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-03-06"]
["4CM1. DR Dashboard","03c. CDR representative arrangement","4CM1.03c.06","CX Guideline","Data Recipient","MAY","Data recipients should outline what the outsourced service provider, sponsor or principal is doing in relation to the specific consent and data, for example: collection; use; transformation; storage; de-identification; etc.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement","4CM1.03c.08","CX Guideline","Data Recipient","MAY","Various CDR Rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the sponsor or principal to be referenced. \n\nThese artefacts demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the sponsor or principal is only noted as a background detail.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03c. CDR representative arrangement","4CM1.03c.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf.\n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.11","CDR Rule","Data Recipient","MUST","(1) A CDR representative must inform the CDR representative principal as soon as practicable after the information required to be contained on the CDR representative principal’s consumer dashboard changes.\nNote: The CDR representative principal may allow the CDR representative to provide the consumer dashboard on its behalf—see subrule 1.14(5).\n\n(2) The CDR representative principal must, as soon as practicable, make those changes.\nNote 1: This subrule is a civil penalty provision (see rule 9.8).\nNote 2: The CDR representative principal could arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf: see subrule 4.19(2).","CDR Rule 4.20T","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.12","CDR Rule","Data Recipient","MUST","(2) Where a CDR representative provides the consumer dashboard on behalf of a CDR representative principal (see subrule 1.14(5)), the CDR representative principal may arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf.","CDR Rule 4.19(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.13","CX Guideline","Data Recipient","MAY","CDR Representatives should refer to Division 4.3A of the CDR Rules for further information on their obligations when providing dashboards and consent management.","CDR Rules, Division 4.3A","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active","2025-03-07"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.01","CDR Rule","Data Recipient","MUST","(3A) For paragraph (1)(b), the other information is:\n(a) a statement that the CDR consumer is entitled to request further records in accordance with rule 9.5; and\n(b) information about how to make such a request.","CDR Rule 1.14(3A)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.02","CDR Rule","Data Recipient","MUST","(2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:\n(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and\n(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);\nthat relates to the CDR consumer.","CDR Rule 9.5(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active","2024-03-06"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.03","CDR Rule","Data Recipient","MUST","(3) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to a trusted adviser must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:\n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the trusted adviser.","CDR Rule 7.9(3) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.04","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.05","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure Notifications: Notification Record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.06","CX Guideline","Data Recipient","MAY","Data recipients should organise consents by referring to the use case/purpose to aid consent management.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.07","CX Guideline","Data Recipient","MAY","In addition to the CX standards requirements, data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the Trusted Adviser for more information.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.08","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.09","CX Guideline","Data Recipient","MAY","The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.10","CX Guideline","Data Recipient","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure). \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure). \n\nIf a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.","CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.11","CX Guideline","Data Recipient","MAY","Privacy Safeguard 5\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection. \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection). \n\nNote: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance.","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.12","CX Guideline","Data Recipient","MAY","Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.01","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(f) if the consent is current—when it is scheduled to expire;\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.02","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(eb) if a business consumer statement has been given in relation to the consent—that fact;","CDR Rule 1.14(3)(eb)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.03","CDR Rule","Data Recipient","MUST","(3A) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to a person in accordance with a business consumer disclosure consent must, as soon as practicable, update each consumer dashboard that relates to the request to indicate: \n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the person to whom it was disclosed.","CDR Rule 7.9(3A) | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.04","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.05","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure Notifications: Notification Record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.06","CX Guideline","Data Recipient","MAY","In addition to the CX standards requirements, data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the non-AP for more information.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.07","CX Guideline","Data Recipient","MAY","If a business consumer statement has been given, it should be clearly visible in the related consent arrangement on the consumer dashboard.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.08","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.09","CX Guideline","Data Recipient","MAY","Accredited persons should have processes in place to ensure that a CDR consumer continues to meet the business consumer criteria for the full period in which they are treated as a CDR business consumer. This may include monitoring the CDR business consumer’s ABN to ensure it remains active at regular intervals.","ACCC CDR business consumers - Fact sheet [https://www.cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.10","CX Guideline","Data Recipient","MAY","The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.11","CX Guideline","Data Recipient","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure). \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure). \n\nIf a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.","CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.12","CX Guideline","Data Recipient","MAY","Privacy Safeguard 5\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection. \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection). \n\nNote: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance.","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.13","CX Guideline","Data Recipient","MAY","Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","06a. Collection consent management - AP holding collected data as a data holder","4CM1.06a.01","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices on the consumer's data recipient consumer dashboard.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06a. Collection consent management - AP holding collected data as a data holder","4CM1.06a.02","CX Guideline","Data Recipient","MAY","Privacy Safeguard 12 and the requirements related to redundant data handling do not apply to the consumer dashboard, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.01","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices on the consumer's data recipient consumer dashboard.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.02","CX Guideline","Data Recipient","MAY","Privacy safeguard 12 and the requirements related to redundant data handling do not apply to the consumer dashboard, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.03","CX Guideline","Data Recipient","MAY","Clause 7.2(2A) of Schedule 3 does not constitute a type of consent as defined in rule 1.10A, but rather is an additional permission for the data recipient to hold the collected data as a data holder. \n\nThis permission cannot be withdrawn under the CDR, nor is a CDR receipt required.","CDR Rule 1.10A, 4.18","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.04","CX Guideline","Data Recipient","MAY","Note 3 under rule 1.14(3) allows data recipients to include additional information on the consumer dashboard beyond the rule requirements. \n\nFor transparency, data recipients should provide a record of the permission outlined in Clause 7.2(2A) of Schedule 3 given for them to become a data holder of the collected CDR data.","CDR Rule 1.14(3), (Note 3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.05","CX Guideline","Data Recipient","MAY","When a consumer consents to a data recipient becoming a data holder of collected CDR data, that data is no longer subject to CDR protections. \n\nAlthough this data is no longer under CDR protections, data recipients must follow their regular obligations for data use and disclosure (e.g. Privacy Act and Australian Privacy Principle 6).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.01","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.02","CDR Rule","Data Recipient","MUST","(3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant.","CDR Rule 4.13(3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.03","CDR Rule","Data Recipient","MUST","(2) The accredited person must:\n(b) if a collection consent was withdrawn, in any case―notify the data holder of the withdrawal in accordance with the data standards.\nNote 1: When a data holder is notified of the withdrawal of a collection consent, an authorisation to disclose the CDR data expires: see paragraph 4.26(1)(d).","CDR Rule 4.13(2)(b), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.04","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: \n(c) withdraws such a consent in accordance with rule 4.13","CDR Rule 4.18(c) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.05","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.06","CDR Rule","Data Recipient","MUST","(3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired.","CDR Rule 4.18(3) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.07","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.08","CDR Rule","Data Recipient","MUST","(1) A consent given under this Division expires at the earliest of the following:\n(a) if the consent is withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following:\n(i) when the accredited person gave effect to the withdrawal;\n(ii) 2 business days after the accredited person received the communication;\n(b) if the consent is withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn;","CDR Rule 4.14(1)(a)–(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.09","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.\n\n(2) Where a CDR representative provides the consumer dashboard on behalf of a CDR representative principal (see subrule 1.14(5)), the CDR representative principal may arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf.","CDR Rule 4.19","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.10","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(f)  if the consent is current—when it is scheduled to expire; \n(g)  if the consent is not current—when it expired; \n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f)–(g), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.11","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.12","CX Guideline","Data Recipient","MAY","Data recipients should surface information on consequences of withdrawal. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(a).","CDR Rule 7.2(4)(a) | CX Research 32 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.13","CX Guideline","Data Recipient","MAY","Data recipients should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.14","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.15","CX Guideline","Data Recipient","MAY","When a consent is withdrawn, data recipients should notify the consumer: \n• Of the status of their consent, including the updated duration and withdrawal date; \n• That the data recipient is no longer collecting, using, and/or disclosing their data (depending on the type of consent withdrawn); \n• Of how their redundant data will be handled, and when this will come into effect if it will not be immediate (such as when the data will need to be held for legal reasons).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.16","CX Guideline","Data Recipient","MAY","Data recipients can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include any known information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.16.0","2022-03-16","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.17","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(b) amendments to or withdrawals of consents by CDR consumers","CDR Rule 9.3(2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.17.0","2022-06-21","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.18","CX Guideline","Data Recipient","MAY","Data recipients are expected to record how the withdrawal was requested by the consumer in relation to CDR Rule 9.3(2)(b), but the rules do not require the method of withdrawal to be shown on the dashboard.\n\nHowever, data recipients may wish to do this on the dashboard and/or in any CDR Receipt they choose to provide.","CDR Rule 9.3(2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.17.0","2022-06-21","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.19","CDR Rule","Data Recipient","MUST","(1) This rule applies if:\n(a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and \n(b) the request has not been completely resolved; and \n(c) the consent expires for any reason. \n\n(2) The accredited person must notify: \n(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and \n(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired.","CDR Rule 4.18AA","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.29.1","2024-03-06","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.20","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(d) as part of the process of withdrawing a consent, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a consent;","CDR Rule 1.14(1)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.33.1","2025-03-07","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.21","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.33.1","2025-03-07","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.01","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.02","CDR Rule","Data Recipient","MUST","(3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant.","CDR Rule 4.13(3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.03","CDR Rule","Data Recipient","MUST","(2) The accredited person must:\n(b) if a collection consent was withdrawn, in any case―notify the data holder of the withdrawal in accordance with the data standards.\nNote 1: When a data holder is notified of the withdrawal of a collection consent, an authorisation to disclose the CDR data expires: see paragraph 4.26(1)(d).","CDR Rule 4.13(2)(b), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.04","CDR Rule","Data Recipient","MUST","(4) If: \n(a) an accredited person has a collection consent given under this Division to collect particular CDR data from a particular accredited data recipient; and \n(b) the accredited data recipient has an AP disclosure consent to disclose that CDR data to that accredited person; \nthen if one of those consents expires, the other expires when the accredited person or accredited data recipient is notified of the first‑mentioned expiry. \n\nNote: The notification is required by rule 4.18B.","CDR Rule 4.14(4)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.05","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: \n(c) withdraws such a consent in accordance with rule 4.13","CDR Rule 4.18(c) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.06","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.07","CDR Rule","Data Recipient","MUST","(3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired.","CDR Rule 4.18(3) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.08","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.09","CDR Rule","Data Recipient","MUST","(1) A consent given under this Division expires at the earliest of the following: \n(a) if the consent is withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following: \n(i) when the accredited person gave effect to the withdrawal; \n(ii) 2 business days after the accredited person received the communication; \n(b) if the consent is withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn;","CDR Rule 4.14(1)(a)–(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.10","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.19(1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.11","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(f)  if the consent is current—when it is scheduled to expire; \n(g)  if the consent is not current—when it expired; \n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f)–(g), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.12","CX Standard","Data Recipient","MUST","As part of the disclosure consent withdrawal process, Data Recipients MUST advise the consumer to review, with the recipient that the data was disclosed to:\n1. How their data will be handled; and\n2. The consequences of withdrawing the disclosure consent.\n\nNote: The precise wording of the withdrawal message is at the discretion of the ADR","Withdrawal Standards, Withdrawal: Disclosure consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.13","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.14","CX Guideline","Data Recipient","MAY","Data recipients should include information on consequences of withdrawal during the consent withdrawal process. Refer to CDR Rule 7.2(4) and 4.11(3)(g)(iii).","CX Research 32 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.15","CX Guideline","Data Recipient","MAY","Data recipients should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.16","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.17","CX Guideline","Data Recipient","MAY","When a consent is withdrawn, data recipients should notify the consumer: \n• Of the status of their consent, including the updated duration and withdrawal date; \n• That the data recipient is no longer collecting, using, and/or disclosing their data (depending on the type of consent withdrawn); \n• Of how their redundant data will be handled, and when this will come into effect if it will not be immediate (such as when the data will need to be held for legal reasons).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.18","CDR Rule","Data Recipient","MUST","(1) This rule applies if:\n(a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and \n(b) the request has not been completely resolved; and \n(c) the consent expires for any reason. \n\n(2) The accredited person must notify: \n(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and \n(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired.","CDR Rule 4.18AA","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.29.1","2024-03-06","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.19","CDR Rule","Data Recipient","MUST","(1) This rule applies if: \n(a) an accredited person has made a consumer data request to an accredited data recipient on behalf of a CDR representative, based on a collection consent given under this Division relating to particular CDR data and that accredited data recipient; and \n(b) the accredited data recipient has an AP disclosure consent relating to that CDR data; and \n(c) the request has not been completely resolved. \n\n(3) If the AP disclosure consent expires in accordance with these rules, the accredited data recipient must notify the accredited person as soon as practicable of the expiry. \nNote 1: This subrule is a civil penalty provision (see rule 9.8). \nNote 2: The collection consent that the accredited person has expires when the notification is received—see subrule 4.14(4).","CDR Rule 4.18B(1), (3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.29.1","2024-03-06","Active","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.20","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(d) as part of the process of withdrawing a consent, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a consent; ","CDR Rule 1.14(1)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.33.1","2025-03-07","Active"]
["4CM2. DR Withdrawal","02a. Collection consent withdrawal - AP holding collected data as a data holder","4CM2.02a.01","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices during consent withdrawal. ",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02a. Collection consent withdrawal - AP holding collected data as a data holder","4CM2.02a.02","CX Guideline","Data Recipient","MAY","Requirements relating to redundant data handling do not apply during the withdrawal flow. This is because Privacy Safeguard 12 do not apply, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02b. CDR consent withdrawal - Permission to hold collected data as a data holder","4CM2.02b.01","CX Guideline","Data Recipient","MAY","Data recipients should inform consumers that after consent expiration, their data may continue to be used according to their usual data handling practices.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02b. CDR consent withdrawal - Permission to hold collected data as a data holder","4CM2.02b.02","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices during consent withdrawal. ",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02b. CDR consent withdrawal - Permission to hold collected data as a data holder","4CM2.02b.03","CX Guideline","Data Recipient","MAY","Requirements relating to redundant data handling do not apply during the withdrawal flow. This is because Privacy Safeguard 12 do not apply, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.01","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent; or\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division; or\n(c) withdraws a collection consent, use consent or disclosure consent given to an accredited person in accordance with rule 4.13.","CDR Rule 4.18","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.02","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.03","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST set out: \n• The name of the person the CDR consumer gave consent to; and \n• The purpose of the consent(s); and \n• In the case of a collection consent, the name of each CDR participant the CDR consumer consented to the collection of CDR data from; and \n• In the case of a disclosure consent, the name of each person the CDR consumer consented to the disclosure of CDR data to; and \n• A description of the data for which the consent was given; and \n• In the case of an insight disclosure consent, a description of the CDR insight(s); and \n• The duration or expiry date(s) of the relevant consent; and \n• Instructions for how the consent can be reviewed and, for an active consent, withdrawn, including by using a simple alternative method of communication to be made available by the accredited person for the purposes of withdrawal. ","Notification Standards, CDR Receipts: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.04","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.05","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. \n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation. \n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.06","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.07","CX Guideline","Data Recipient","MAY","CDR Representatives should refer to CDR Rule 4.20O for information on their obligations when providing CDR receipts.","CDR Rule 4.20O","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.08","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active","2025-09-23"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.09","CX Guideline","Data Recipient","MAY","Data recipients should include their CDR policy in their CDR receipts.",null,"Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.10","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts. \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent. \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure.\n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model.","CDR Rule 4.18","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.01","CDR Rule","Data Recipient","MUST","(1) This rule applies in relation to a collection consent, use consent or disclosure consent given under this Division if:\n(a) the consent is current; and\n(b) 90 days have elapsed since the latest of the following:\n(i) the CDR consumer gave the consent;\n(ia) the CDR consumer last amended the consent;\n(ii) the CDR consumer last used their consumer dashboard;\n(iii) the accredited person last notified the CDR consumer that the consent is still current. \n\n(2) The accredited person must notify the CDR consumer, in relation to each consent given by the CDR consumer that is still current, that the consent is still current. \nNote: This subrule is a civil penalty provision (see rule 9.8).\n\n(3) The notification must be given in accordance with the data standards.\nNote: This subrule is a civil penalty provision (see rule 9.8).","CDR Rule 4.20","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.02","CDR Rule","Data Recipient","MUST","Rule 4.20 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fb) of the principal rules in relation to rule 4.20.","CDR Rule 504","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.03","CX Standard","Data Recipient","MUST","A 90-day notification provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard. ","Notification Standards, 90-day notifications: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.04","CX Standard","Data Recipient","MUST","A 90-day notification provided by a data recipient: \n• MUST include the following information:  \n    ◦ The name of the person the CDR consumer gave consent to; and\n    ◦ The purpose of the consent(s); and\n    ◦ Instructions for how the consent(s) can be reviewed, which MAY include details, links, or interactive components that direct the consumer to their consumer dashboard \n• SHOULD include the following information: \n    ◦ In the case of a collection consent, the name of each CDR participant, or number of participants, the CDR consumer consented to the collection of CDR data from; and\n    ◦ In the case of a disclosure consent, the name of each person, or number of persons, the CDR consumer consented to the disclosure of CDR data to; and\n    ◦ The expiry date(s) of the relevant consent. ","Notification Standards, 90-day notifications: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.05","CX Guideline","Data Recipient","MAY","The CX Standards for 90-day notifications take effect on 14 July 2025.\n\nThe existing requirements regarding notification of current consents will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 504 (and 507 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to notification of current consents until this date.","CDR Rules 4.20 and 504; 4.20U and 507 | Notification Standards, 90-day Notifications [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.06","CX Guideline","Data Recipient","MAY","CDR Representatives should refer to CDR Rule 4.20U for further information on their obligations when providing ongoing notifications.","CDR Rule 4.20U","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.07","CX Guideline","Data Recipient","MAY","Where a 90-day notification is sent for a single consent, links or interactive components should direct the consumer directly to that consent on the dashboard.",null,"Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.08","CX Guideline","Data Recipient","MAY","Data recipients should provide a consolidated notification when multiple consents align with CDR Rule 4.20(1). Being mindful of the rules and standards, the timing and delivery method of the 90 days reminder should also be considered to manage notification fatigue.","CDR Rule 4.20(1) | Notification Standards, 90-day notifications [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards] | CX Research: 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.09","CX Guideline","Data Recipient","MAY","Where a consolidated 90-day notification is sent for multiple consents, links or interactive components should direct the consumer to a view of consents that were included in the notification.",null,"Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should allow consumers to create user-defined tags, and/or descriptions (e.g. home deposit) for each data sharing arrangement to facilitate management (e.g. in the absence of information about the purpose or use case).","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","CX Guidelines v1.4.0 PDF, p. 108 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should allow consumers to create user-defined tags, names, and/or descriptions (e.g. home deposit) for each data sharing arrangement (e.g. in the absence of information about the purpose or use case).","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","CX Guidelines v1.4.0 PDF, p. 106 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should use the term ‘consent’ instead of ‘authorisation’ to provide consistency and facilitate comprehension.",null,"CX Guidelines v1.4.0 PDF, p. 111 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should use the term ‘consent’ instead of ‘authorisation’ to provide consistency and facilitate comprehension.",null,"CX Guidelines v1.4.0 PDF, p. 106 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.01","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n\n(a) can be used by the CDR consumer to manage authorisations to disclose CDR data in response to the request; and\n(b) contains the details of each authorisation to disclose CDR data specified in subrule (3); and\n(ba) contains any information in the data standards that is specified as information for the purposes of this rule; and\n(bb) contains any information on the Register of Accredited Persons that is specified as information for the purposes of this rule;\n\n(2) Such a service is the data holder’s consumer dashboard for that consumer.\n\nNote: If the consumer data request relates to a joint account, there may be an obligation to provide all joint account holders with consumer dashboards: see rule 4A.13.","CDR Rule 1.15(1)(a),(b),(ba),(bb), (2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.02","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.03","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);\n\n(g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact.","CDR Rule 1.15(3)(f),(g)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.04","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that: \n\n(c) allows the CDR consumer, at any time, to withdraw a current authorisation;","CDR Rule 1.15(1)(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.05","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(a) details of the CDR data that has been authorised to be disclosed","CDR Rule 1.15(3)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.06","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(b) when the CDR consumer gave the authorisation;\n(c) the period for which the CDR consumer gave the authorisation;\n(d) if the authorisation is current—when it is scheduled to expire;\n(e) if the authorisation is not current—when it expired;","CDR Rule 1.15(3)(b)–(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.07","CDR Rule","Data Holder","MUST","(1) For subsection 56EM(1) of the Act, a data holder that discloses CDR data to an accredited person as a result of a consumer data request must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:\n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the accredited data recipient, identified in accordance with any entry on the Register of Accredited Persons specified as being for that purpose.\n\nNote 1: For correction requests, see section 56EP of the Act (privacy safeguard 13) and Subdivision 7.2.5 of these rules.\n\nNote 2: If a consumer data request is made that relates to a joint account, the other joint account holder’s consumer dashboard may not be required to be similarly updated. See rule 4A.13.\n\nNote 3:  See paragraph 1.15(3)(f).\n\nNote 4: See subrule 1.16(5) for how this rule applies where the CDR data is collected by an accredited person acting as a direct or indirect OSP to the accredited data recipient.","CDR Rule 7.9(1) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.08","CX Guideline","Data Holder","MAY","Data holders should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, archived), or presenting key details up front, such as when consent was granted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.09","CX Guideline","Data Holder","MAY","Data holders should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.  \n\nExample: A consumer may want to sort by data recipient, data cluster, or by a user-defined tag. ","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.10","CX Guideline","Data Holder","MAY","If scrolling is required to view the total number of CDR participants, data holders should provide search functionality.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.11","CX Guideline","Data Holder","MAY","Data holders should organise authorisations using the brand and software product name of the ADR. The logo held at the brand level should also be presented in relation to the authorisation to aid recognition and management.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.12","CX Guideline","Data Holder","MAY","Data holders should use the phrase 'Stop access', 'Stop sharing' or 'Stop data sharing' to refer to how a consumer can withdraw authorisation.\n\nA generic term like ‘stop access’ can refer to withdrawing authorisations or actions. If data holders use this wording, they should clarify its meaning with context-specific explanations. CX research found this wording easy to understand.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.13","CX Guideline","Data Holder","MAY","Data holders should provide CDR Receipts reflecting the details of the authorisation shown on a consumer's dashboard.\n\nCDR Receipts should be provided in writing, such as in an email, when:\n1. Authorisations are successfully established\n2. Authorisations are withdrawn\n3. Authorisations expire\n4. Authorisations are amended\n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.14","CX Guideline","Data Holder","MAY","Data holders should show the status of the consent, which may refer to it being 'active', 'cancelled' or 'expired'.\n\nData holders should also indicate the status of data sharing to consumers, which may include that data sharing has been paused or interrupted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.15","CX Guideline","Data Holder","MAY","Data holder consumer dashboards should show details of any historical CDR data that was disclosed to reflect the equivalent requirement in rule 4.23(1)(b) for the authorisation flow, see https://cx.cds.gov.au/55de309705a34c7bb34cd6fccdafc9b6.","CDR Rule 4.23(1)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.16","CX Guideline","Data Holder","MAY","Data holders should nudge consumers to be more privacy conscious and should use appropriate interventions to facilitate comprehension and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of micro-interactions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.17","CX Guideline","Data Holder","MAY","This artefact demonstrates how data holders can comply with Privacy Safeguard 10 for the purposes of CDR Rule 7.9(1).\n\nThe data holder can use the authorisation expiry date where they do not know the final disclosure date. The date of final disclosure should be updated as soon as practicable when this date is known.\n\nThis artefact does not demonstrate the requirements for other privacy safeguards referred to in CDR Rule 7.9.","CDR Rule 7.9(1) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-04-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.18","CX Guideline","Data Holder","MAY","Data holders should use the phrases ‘Granted’, 'Expired', ‘Access period’ and ‘When we've shared your data’ to refer to the time-based qualities of the data sharing arrangement.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.19","CX Guideline","Data Holder","MAY","Data holders should show the account(s) shared as part of the data sharing arrangement. It is at the discretion of data holders to provide functionality to add/remove additional accounts from the data sharing arrangement.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.20","CX Guideline","Data Holder","MAY","Data holders should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.\n\nThis may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent).","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.21","CX Guideline","Data Holder","MAY","Data holders should provide a link for consumers to verify a data recipient’s accreditation via the CDR website (https://www.cdr.gov.au/find-a-provider).","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.22","CX Guideline","Data Holder","MAY","Data holders should communicate that certain information may not be available on data holder dashboards and should advise consumers to check with the data recipient for additional information.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Retired","2024-04-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.23","CX Guideline","Data Holder","MAY","Data holders should surface the legal entity name of the data recipient associated with the authorisation","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.11.0","2021-08-05","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.24","CX Guideline","Data Holder","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data holders may include the date range between which CDR data will be disclosed (dates of initial and final disclosure).\n\nFor single or ‘once-off’ disclosure: Data holders may include the date on which the CDR data was disclosed (date of initial disclosure).\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.\n\nNote 2: Refer to the CDR Rules for exceptions to CDR Rule 7.9 for joint accounts","CDR Rule 7.9 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.11.0","2021-08-05","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.25","CDR Rule","Data Holder","MUST","For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.\n\n(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy:\n(a) electronically; or\n(b) in hard copy;\nas directed by the consumer.","CDR Rule 7.2(8), (9)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.26","CX Guideline","Data Holder","MAY","As per CDR Rule 7.2(8), the CDR policy is required to be made available on each online service ordinarily used to deal with consumers, such as their website and mobile applications, including consumer dashboards.","CDR Rule 7.2(8) | OAIC guidance on Privacy Safeguard 1 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-1-privacy-safeguard-1-open-and-transparent-management-of-cdr-data] | OAIC Guide to developing a CDR policy (Step 5) [https://www.oaic.gov.au/consumer-data-right/guidance-and-advice/guide-to-developing-a-cdr-policy]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.27","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.28","CX Standard","Data Holder","MUST","Data holders MUST advise consumers to check with the relevant data recipient for information about how their data may be handled.\n\nThe precise wording of this message is at the discretion of the data holder. The data holder MAY consider using or paraphrasing the following message:\n\n• ‘You should check with [ADR brand/the data recipient] for more information on how they are handling your data, and for any other permissions you may have given them. See [ADR]’s CDR policy or their Dashboard for more information.’","Dashboard Standards, Data Holder Dashboards, Data Holder Dashboard: Data recipient handling details [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.29","CX Guideline","Data Holder","MAY","Data holders should use the Brand Name of the data recipient wherever the data recipient is referenced in consumer-facing processes, on the consumer dashboard and in relation to the requirement https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.30","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that: \n\n(e) is simple and straightforward to use, and is no more complicated to use than the process for giving the authorisation to disclose CDR data; and\n(f) is prominently displayed and readily accessible to the CDR consumer;","CDR Rule 1.15(1)(e), (f)",null,"1.33.0","2025-02-25","Active"]
["5CM1. DH Dashboard","01. Single occasion disclosure","5CM1.01.01","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(b) when the CDR consumer gave the authorisation;\n(c) the period for which the CDR consumer gave the authorisation;\n(d) if the authorisation is current—when it is scheduled to expire;\n(e) if the authorisation is not current—when it expired;","CDR Rule 1.15(3)(b),(c),(d),(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active","2022-05-09"]
["5CM1. DH Dashboard","01. Single occasion disclosure","5CM1.01.02","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is absent or 0, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nFor the purposes of dashboards, data holders may consider communicating the sharing period as a single disclosure instance, where the start and end dates are the same.","CDR Rule 4.23(1)(d) | Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active","2025-02-26"]
["5CM1. DH Dashboard","01. Single occasion disclosure","5CM1.01.03","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is greater than 0 but less than 24 hours, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nFor the purposes of dashboards, data holders may consider communicating the sharing period as a single disclosure instance within a specific timeframe, where the start and end dates may be on different days.","CDR Rule 4.23(1)(d) | Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active","2025-02-26"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.01","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.02","CX Guideline","Data Holder","MAY","Where an authorisation has been 'amended' and linked to a past authorisation using the cdr_arrangement_id, a data holder may consider providing a 'Consent history' feature.\n\nWhile not required, this feature leverages the cdr_arrangement_id functionality to allow a consumer to see past versions of the authorisation, such as previously shared data, accounts, and dates or durations that may differ to the current authorisation.\n\nImportantly, while data recipients are required to show the details of consent amendments, data holders are not. While data holders are not required to display 'amendments', data holders who are also data recipients may want to consider this functionality to establish greater consistency between their data holder and data recipient dashboard views.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Retired","2024-04-09"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.03","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n\n(h) details of each amendment (if any) that has been made to the authorisation\n\n(3A) Paragraph (3)(h) applies on and after 1 July 2024.","CDR Rules 1.15(3)(h), (3A)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.04","CX Standard","Data Holder","MUST","When a consumer amends an authorisation in accordance with rule 4.22A, which is linked to a cdr_arrangement_id supplied by the data recipient as per the https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards, data holders MUST display the details of each authorisation’s amendment on the consumer’s dashboard.\n\nNote: This requirement gives effect to CDR Rule 1.15(3)(h)","Dashboard Standards, Data Holder Dashboards, Data Holder Dashboard: Amending authorisation details [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.05","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data. Receipts should be given in writing otherwise than through the consumer dashboard, such as via email or SMS, and should be made available on the consumer dashboard. \n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nCDR Receipts should be provided in writing, such as in an email, when: \n1. Authorisations are successfully established\n2. Authorisations are withdrawn \n3. Authorisations expire \n4. Authorisations are amended \n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Retired","2024-06-12"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.06","CX Guideline","Data Holder","MAY","As per CDR Rule 1.15(3)(h), data holders are required to display the details of each amendment (if any) that has been made to the authorisation.\n\nThese artefacts demonstrate 2 examples of how these details could be displayed:\n• The summary shown on the Authorisation history summary screen; and\n• The 'amended' labels in relation to specific attributes that have been amended on the Authorisation history details screens.","CDR Rule 1.15(3)(h)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2024-06-12"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.07","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data. Receipts should be given in writing otherwise than through the consumer dashboard, such as via email or SMS, and should be made available on the consumer dashboard. \n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nCDR Receipts should be provided in writing, such as in an email, when: \n1. Authorisations are successfully established\n2. Authorisations are withdrawn \n3. Authorisations expire \n4. Authorisations are amended \n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2024-06-12"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.08","CX Guideline","Data Holder","MAY","Data holders should provide signposting and clear explanatory text to help consumers understand the relationship between previous and more recent authorisations.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.09","CX Guideline","Data Holder","MAY","As per CDR Rules 4.11(1)(a)–(b), 4.12C(1) and 4.23(b)–(c), a collection consent and the corresponding authorisation can be amended to reflect new datasets and/or a new duration.\n\nWhile not required by the rules or standards, the CX Guidelines recommend accounts amended at the time of authorisation also be displayed to facilitate consumer comprehension.","CDR Rules 4.11(1)(a)–(b), 4.12C(1) and 4.23(b)–(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.30.0","2024-06-12","Active","2025-02-26"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.10","CX Guideline","Data Holder","MAY","As per CDR Rule 1.15(3A), data holders must display details of amendments to authorisations that occur on or after 1 July 2024.\n\nWhile not required by the rules or standards, the CX Guidelines recommend displaying details of amendments made to an authorisation before this date. The inclusion of details of all amendments would most align with consumers' mental model and understanding of their authorisations.","CDR Rule 1.15(3A)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.30.0","2024-06-12","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.01","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data. \n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nThe CDR receipt should be given in writing and available through the data holder consumer dashboard.\n\nCDR Receipts should be provided in writing, such as in an email, when: \n1. Authorisations are successfully established\n2. Authorisations are withdrawn \n3. Authorisations expire \n4. Authorisations are amended\n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.02","CX Guideline","Data Holder","MAY","As per Schedule 4, Rule 2.3(1), data holders are required to provide consumer dashboards to CDR consumers who have online access to the relevant account(s).\n\nWhere a consumer does not have online access to the relevant account(s), Schedule 4, Rule 2.3(2) requires data holders to offer a consumer dashboard and provide one if the CDR consumer accepts.","CDR Rule 2.3(1) and 2.3(2) (Schedule 4) | CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.03","CX Guideline","Data Holder","MAY","For the purposes of Schedule 4, Rule 2.3(2), data holders could provide an (optional) CDR Receipt that contains the details of the dashboard offer. While authorisation withdrawal instructions must be provided in the authorisation flow itself, dashboards are expected to be offered to offline customers external to the authorisation flow after authorisation has been granted.","CDR Rule 2.3(2) (Schedule 4) | CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.04","CX Guideline","Data Holder","MAY","It is at the data holder's discretion to determine the actual process of providing a dashboard to an offline customer for the purposes per Schedule 4, Rule 2.3(2). These guidelines demonstrate one possible approach, where the data holder relies on existing authentication credentials and channels successfully used by the offline customer, along with an access code that is unique to the consumer for greater security.\n\nIn this example, the offline consumer could be provided with a standalone dashboard without needing to register for an online account. A data holder could offer or activate online account registration as part of this process.\n\nA data holder could also require registration for an online account for dashboard access where, for example, the dashboard is only available through an existing online portal or mobile app.\n\nA data holder may choose to make the dashboard accessible via an online account or another mechanism. The actual implementation of dashboards for offline customers is at the data holder's discretion and may be contingent on a number of factors, including the data holder's security posture.","CDR Rule 2.3(2) (Schedule 4) | CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.01","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n\n(c) allows the CDR consumer, at any time, to withdraw a current authorisation;\n(d) as part of the process of withdrawing an authorisation, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing an authorisation; ","CDR Rule 1.15(1)(c), (d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.02","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes. ","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.03","CDR Rule","Data Holder","MUST","(1) Where:\n\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co‑approval option or the pre‑approval option applies, or has applied, to the joint account;\n\nthe data holder must provide each relevant account holder with an online service that:\n\n(d) can be used by the relevant account holder to manage approvals in relation to each authorisation to disclose joint account data made by a requester; and\n(e) allows for the withdrawal, at any time, of an approval in relation to each authorisation to disclose joint account data made by a requester; and\n(f) as part of the process for withdrawing an approval in relation to an authorisation, displays a message, in accordance with the data standards, about the consequences of withdrawing an approval in relation to an authorisation;","CDR Rule 4A.13(1)(a)–(b), (d)–(f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.04","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co‑approval option or the pre‑approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(c) contains the details referred to in paragraph 1.15(1)(b) that relate to the joint account data;","CDR Rule 4A.13(1)(a)–(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.05","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:(a) details of the CDR data that has been authorised to be disclosed;\n(b) when the CDR consumer gave the authorisation;\n(c) the period for which the CDR consumer gave the authorisation;\n(d) if the authorisation is current—when it is scheduled to expire;\n(e) if the authorisation is not current—when it expired;\n(f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);\n(g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact;\n(h) details of each amendment (if any) that has been made to the authorisation.","CDR Rule 1.15(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.06","CDR Rule","Data Holder","MUST","(5) For paragraph 1.15(1)(d), if a relevant account holder’s consumer dashboard contains details of approvals under this Division, the dashboards of the other joint account holders must contain those details.","CDR Rule 4A.13(5)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.07","CDR Rule","Data Holder","MUST","(2) Any relevant account holder may withdraw an approval given under this Division at any time, using their consumer dashboard.","CDR Rule 4A.12(2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.08","CDR Rule","Data Holder","MUST","(3) The data holder must, in accordance with any relevant data standards:\n(a) provide for alternative notification schedules (including reducing the frequency of notifications or not receiving notifications); and\n(b) give each joint account holder a means of selecting such an alternative, and of changing a selection.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.09","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to: \n(a) change the disclosure option that applies to the account in accordance with rule 4A.7; and \n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8; and \n(c) respond to a proposal by another joint account holder to change the disclosure option. \n\n(2) Such a service is a disclosure option management service.","CDR Rule 4A.6(1),(2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.10","CX Guideline","Data Holder","MAY","Data holders must show the account(s) shared as part of the authorisation. Whereby:\n• The initiating account holder has visibility of all accounts shared within the authorisation.\n• Non-initiating account holders only have visibility of their shared accounts within the authorisation.","Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.11","CX Guideline","Data Holder","MAY","Inline with CDR Rule 1.15(1)(c), the initiating account holder can withdraw the authorisation, including all accounts. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal#7a89c2da2e5f45468f8b8112ff80159d.","CDR Rule 1.15(1)(c) | CX Guidelines: Withdrawal: Default example [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal#7a89c2da2e5f45468f8b8112ff80159d]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.12","CX Guideline","Data Holder","MAY","As per CDR Rule 4A.13(1)(d)–(h), data holders are required to allow account holders to withdraw one approval at a time. \n\nIn addition to this functionality, data holders may allow the relevant account holder(s) to withdraw approvals in bulk using the equivalent withdrawal mechanism the requester would use to withdraw an authorisation. This would allow the flow to be more intuitive and streamlined for the relevant account holder(s), rather than withdrawing approvals one by one. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7.","CDR Rule 4A.13(1)(d)–(h) | CX Guidelines: Withdrawal: Withdrawing approvals, Pathway 2: Ability to withdraw approvals in bulk [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.13","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.13(1)(d) and CDR Rule 4A.12(2), non-initiating account holders can withdraw approvals for their joint accounts within an authorisation, but cannot withdraw the other accounts shared by the initiating account holder.","CDR Rule 4A.13(1)(d), 4A.12(2) | Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.14","CX Guideline","Data Holder","MAY","Accounts that are no longer shared as part of an authorisation should be displayed as inactive. The precise wording is at the data holder’s discretion.","Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.15","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.14(3) and https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts, data holders may offer an alternative notification schedule to apply at the account level and the customer level. Any account holder(s) may control the frequency and channel of their joint account notifications. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings.","CDR Rule 4A.14(3) | CX Guidelines: CX Notification Standards [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings], Joint account notification settings [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.16","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.6, the data holder must provide joint account holders with a disclosure option management service (DOMS). Any joint account holder can manage account sharing permissions, such as to stop all sharing from an account, through DOMS. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service.","CDR Rule 4A.6 | CX Guidelines: Account permissions, Joint account disclosure option management service [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.17","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.12 and 4A.13, non-initiating account holders can withdraw approval for an account using their consumer dashboard. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7.","CDR Rule 4A.12, 4A.13 | CX Guidelines: Withdrawal: Withdraw an approval, Pathway 1: Withdrawing one approval at a time [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.18","CX Guideline","Data Holder","MAY","Sharing arrangements where no joint accounts are being shared should be displayed as inactive on the non-initiating account holder’s dashboard. The precise wording is at the data holder’s discretion.","Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.19","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n\n(e) is simple and straightforward to use, and is no more complicated to use than the process for giving the authorisation to disclose CDR data;\n(f) is prominently displayed and readily accessible to the CDR consumer;","CDR Rule 1.15(1)(e), (f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.33.0","2025-02-25","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.20","CDR Rule","Data Holder","MUST","(1) Where: \n(a) this Division applies in relation to a consumer data request; and \n(b) either the co‑approval option or the pre‑approval option applies, or has applied, to the joint account; \n\nthe data holder must provide each relevant account holder with an online service that: \n\n(g) is simple and straightforward to use; and \n(h) is prominently displayed and readily accessible by a relevant account holder.","CDR Rule 4A.13(1)(a)–(b), (g)–(h)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.33.0","2025-02-25","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.","CX Guideline","Data Holder","MAY","When updating the consumer dashboard, data holders should include:\n• An updated status of the consumer’s sharing arrangement.\n• A statement indicating to the consumer that the data recipient is no longer collecting and using their data\n• Updated information on sharing duration, including a consent withdrawal date",null,"CX Guidelines v1.4.0 PDF, p. 114 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.01","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.02","CX Standard","Data Holder","MUST","As part of the withdrawal process, the data holder MUST advise the consumer to review the consequences of withdrawal with the Data Recipient before they stop sharing their data.\nThe data holder MAY consider using or paraphrasing the following message(s):\n• ‘You should check with [Data Recipient] before you stop sharing to understand the consequences.’\n• ‘You should check with [Data Recipient] to see if your service will be impacted before you stop sharing.’","Withdrawal Standards, Withdrawing authorisation:\nConsequences [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-19"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.03","CX Standard","Data Holder","MUST","As part of the withdrawal process, the data holder MUST inform the consumer about the handling of redundant data and the right to delete. \nThe data holder MAY consider using or paraphrasing the following message(s):\n• ‘CDR data is either deleted or de-identified when it is no longer required.’\n• ‘[Data Recipient] will have specific policies on how to handle your data once it’s no longer required.’","Withdrawal Standards, Withdrawing authorisation: Redundant data [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-19"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.04","CX Guideline","Data Holder","MAY","Data holders should use the phrase 'Stop access', 'Stop sharing' or 'Stop data sharing' to refer to how a consumer can withdraw authorisation. \n\nA generic term like ‘stop access’ can refer to withdrawing authorisations or actions. If data holders use this wording, they should clarify its meaning with context-specific explanations. CX research found this wording easy to understand.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.05","CX Guideline","Data Holder","MAY","Data holders should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences.\n\nData holders may choose to do this via a 2-step authorisation withdrawal process.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.06","CX Guideline","Data Holder","MAY","Data holders should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.07","CX Guideline","Data Holder","MAY","Data holders should provide CDR Receipts reflecting the details of the authorisation shown on a consumer's dashboard.\n\nCDR Receipts should be provided in writing, such as in an email, when:\n1. Authorisations are successfully established\n2. Authorisations are withdrawn\n3. Authorisations expire\n4. Authorisations are amended\n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.08","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n(d) as part of the process of withdrawing an authorisation, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing an authorisation;","CDR Rule 1.15(1)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active","2025-02-26"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.09","CDR Rule","Data Holder","MUST","(1) A data holder must keep and maintain records that record and explain the following:\n(b) amendments to or withdrawals of authorisations to disclose CDR data;","CDR Rule 9.3(1)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.10","CX Guideline","Data Holder","MAY","Data holders are expected to record how the withdrawal was requested by the consumer in relation to CDR Rule 9.3(1)(b), but the rules do not require the method of withdrawal to be shown on the dashboard.\n\nHowever, data holders may wish to do this on the dashboard and/or in any CDR Receipt they choose to provide.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.11","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type.\n\nThey can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.12","CX Standard","Data Holder","MUST","Data holders MUST advise consumers to check with the relevant data recipient for information about how their data may be handled.\n\nThe precise wording of this message is at the discretion of the data holder. The data holder MAY consider using or paraphrasing the following message:\n\n• ‘You should check with [ADR brand/the data recipient] for more information on how they are handling your data, and for any other permissions you may have given them. See [ADR]’s CDR policy or their Dashboard for more information.’","Dashboard Standards, Data Holder Dashboards, Data Holder Dashboard: Data recipient handling details [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.01","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(c) contains the details referred to in paragraph 1.15(1)(b) that relate to the joint account data;","CDR Rule 4A.13(1)(a), (b), (c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.02","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(d) can be used by the relevant account holder to manage approvals in relation to each authorisation to disclose joint account data made by a requester;","CDR Rule 4A.13(1)(a), (b), (d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.03","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(g) is simple and straightforward to use; and\n(h) is prominently displayed and readily accessible by a relevant account holder.\n——————\n(4) A data holder does not contravene subrule (1) in relation to subparagraphs (1)(d)(iii) and (iv) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.","CDR Rule 4A.13(1)(a), (b), (g), (h) and (4)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.04","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(e) allows for the withdrawal, at any time, of an approval in relation to each authorisation to disclose joint account data made by a requester;","CDR Rule 4A.13(1)(a), (b), (e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.05","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(f) as part of the process for withdrawing an approval in relation to an authorisation, displays a message, in accordance with the data standards, about the consequences of withdrawing an approval in relation to an authorisation;","CDR Rule 4A.13(1)(a), (b), (f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.06","CDR Rule","Data Holder","MUST","(2) Where the data holder already provides a consumer dashboard for the relevant account holder under rule 1.15, the service under subrule (1) must be included in the consumer dashboard.\n\n(3) Where the data holder does not already provide a consumer dashboard for that relevant account holder under rule 1.15, the service under subrule (1) is the data holder’s consumer dashboard for the relevant account holder.","CDR Rule 4A.13(2), (3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.07","CDR Rule","Data Holder","MUST","(5) For paragraph 1.15(1)(d), if a relevant account holder’s consumer dashboard contains details of approvals under this Division, the dashboards of the other joint account holders must contain those details. ","CDR Rule 4A.13(5)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.08","CDR Rule","Data Holder","MUST","(1) If a relevant account holder:\n(a) approves of the disclosure of joint account data in accordance with this Division; or\n(b) is taken to have approved of the disclosure under the pre-approval option;\nthe approval is taken to apply while the authorisation referred to in paragraph 4A.10(4)(b) is current, unless withdrawn sooner in accordance with this Division.\n(2) Any relevant account holder may withdraw an approval given under this Division at any time, using their consumer dashboard.","CDR Rule 4A.12","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.09","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(b) to the requester, to inform them that:\n(ii) a relevant account holder has withdrawn an approval previously given;\nin accordance with the data standards.","CDR Rule 4A.14 (1)(b)(ii)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.10","CDR Rule","Data Holder","MUST","(2) The data holder must make the appropriate approval notification to a joint account holder in relation to an event mentioned in subrule (1):\n(a) as soon as practicable after the event occurs, unless the joint account holder has selected an alternative schedule of notifications; and\n(b) through its ordinary means of contacting the joint account holders.","CDR Rule 4A.14(2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.11","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.12","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.13","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2022-05-19"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.14","CX Standard","Data Holder","MUST","As part of the process of removing a joint account approval or changing to a more restrictive disclosure option, the data holder MUST advise the consumer:\n\n1. that doing this may impact existing services, including arrangements initiated by the other account holder(s)\n2. when removing an approval:\n◦ that even though sharing for this service has now stopped, the other account holder(s) can still create new data sharing arrangements for the joint account\n◦ how to change their disclosure option\n\nNote: The exact phrasing of the withdrawal message is at the discretion of the data holder. This standard does not affect data holders’ other notification obligations, including under rule 4A.7(3).","Withdrawal Standards, Withdrawal: Joint accounts [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2022-05-19"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.15","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2022-05-19"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.16","CX Guideline","Data Holder","MAY","As per CDR Rule 4A.13(1)(d)–(h), data holders are required to allow account holders to remove one approval at a time.\n\nIn addition to this functionality, data holders may allow the relevant account holder(s) to remove approvals in bulk using the equivalent withdrawal mechanism the requester would use to withdraw an authorisation. This would allow the flow to be more intuitive and streamlined for the relevant account holder(s) when compared to Pathway 1.","CDR Rule 4A.13(1)(d)–(h)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.17","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.14(3) and CX Notification Standards, data holders may offer an alternative notification schedule to apply at the account level and the customer level. Any account holders may control the frequency and channel of their joint account notifications. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings.","CDR Rule 4A.14(3) | CX Notification Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.18","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.19","CX Guideline","Data Holder","MAY","Data holders should use plain language to describe the call to action for removing an approval. These artefacts use 'stop sharing from this account' and 'stop sharing' to represent this action.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.20","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.14(2) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.14(2), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.21","CX Guideline","Data Holder","MAY","Where an alternative notification schedule is provided as per CDR Rule 4A.14(3), this notification may be omitted at the consumer's request.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.22","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type.\n\nThey can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.23","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.6, the data holder must provide joint account holders with a disclosure option management service (DOMS). Any joint account holder can manage account sharing permissions, such as to stop all sharing from an account, through DOMS. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service.","CDR Rule 4A.6 | CX Guidelines: Account permissions, Joint account disclosure option management service [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.01","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to:\n(a) change the disclosure option that applies to the account in accordance with rule 4A.7;\n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8; and\n(c) respond to a proposal by another joint account holder to change the disclosure option.\n\n(2) Such a service is a disclosure option management service.","CDR Rule 4A.6(1), (2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.02","CDR Rule","Data Holder","MUST","(3) The service must be provided online and, if there is a data holder’s consumer dashboard for a joint account holder, may be included in the dashboard.\n\n(4) The service may, but need not, also be provided other than online.","CDR Rule 4A.6(3), (4)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.03","CDR Rule","Data Holder","MUST","(5) The service must give effect to a change in the disclosure option as soon as practicable.","CDR Rule 4A.6(5)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.04","CDR Rule","Data Holder","MUST NOT","(6) The service must not do any of the following in relation to the processes that it provides for changing or proposing to change the disclosure option that applies to the joint account, or responding to such a proposal (the processes):\n(a) add any requirements to the processes beyond those specified in the data standards and these rules;\n(b) offer additional or alternative services as part of the processes;\n(c) include or refer to other documents, or provide any other information, so as to reduce comprehensibility;\n(d) offer any pre-selected options.","CDR Rule 4A.6(6)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.05","CDR Rule","Data Holder","MUST","(7) The service must indicate to the joint account holder which disclosure option currently applies.","CDR Rule 4A.6(7)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.06","CDR Rule","Data Holder","MUST","(8) The service must be in accordance with the data standards.","CDR Rule 4A.6(8)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.07","CDR Rule","Data Holder","MUST","(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following:\n(a) the pre-approval option, under which joint account data may be disclosed in response to a valid consumer data request on the authorisation of the requester without the approval of the relevant account holders;\n(c) the non-disclosure option, under which joint account data may not be disclosed even in response to a valid consumer data request.\n\n(2) The data holder must provide for the pre-approval and non-disclosure options to be available for a joint account.","CDR Rule 4A.5(1)(a), (c) and (2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.08","CDR Rule","Data Holder","MUST","(1) A joint account holder may at any time choose that the non-disclosure option will apply to the joint account, using the disclosure option management service.","CDR Rule 4A.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.09","CDR Rule","Data Holder","MUST","(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(a) explain to each of them what the consumer data right is;","CDR Rule 4A.7(3)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.10","CDR Rule","Data Holder","MUST","(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(b) inform them which disclosure option previously applied to the account; and\n(c) inform them that account holder A has changed the disclosure option, and of the disclosure option that now applies;","CDR Rule 4A.7(3)(b), (c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.11","CDR Rule","Data Holder","MUST","(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(d) explain to them the mechanisms for changing the disclosure option again.","CDR Rule 4A.7(3)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.12","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.13","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.14","CX Standard","Data Holder","MUST","As part of the process of removing a joint account approval or changing to a more restrictive disclosure option, the data holder MUST advise the consumer:\n\n1. that doing this may impact existing services, including arrangements initiated by the other account holder(s)\n2. when removing an approval:\n   ◦ that even though sharing for this service has now stopped, the other account holder(s) can still create new data sharing arrangements for the joint account\n   ◦ how to change their disclosure option\n\nNote: The exact phrasing of the withdrawal message is at the discretion of the data holder. This standard does not affect data holders’ other notification obligations, including under rule 4A.7(3).","Withdrawal Standards, Withdrawal: Joint accounts [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.15","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.16","CX Guideline","Data Holder","MAY","Data holders may consider providing a centralised location for managing various CDR account permissions, which could, for example, allow a consumer to access and manage their joint accounts, secondary user instructions, and any appropriate partnership and non-individual permissions. The disclosure option management service (DOMS) could be accessible from this location and in relation to the consumer dashboard.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.17","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.18","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.19","CX Guideline","Data Holder","MAY","Data holders may provide a mechanism for consumers to see a list of authorisations currently sharing data from that joint account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.20","CX Guideline","Data Holder","MAY","Data holders may offer an alternative notification schedule to apply at the account level and the customer level.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.21","CX Guideline","Data Holder","MAY","To aid intuitive disclosure option management, data holders may choose to semantically distinguish pre-approval and co-approval changes from changing to a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.22","CX Guideline","Data Holder","MAY","Existing approvals for specific authorisations are not automatically removed when a non-disclosure option is applied, but the joint account data cannot be shared due to the application of the non-disclosure option. If a joint account is changed from a non-disclosure to enable sharing again, joint account data sharing will recommence for any active authorisations that are associated with that joint account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.23","CX Guideline","Data Holder","MAY","Email is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.7(3) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.7(3), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.24","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.17.0","2022-06-08","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.08","CDR Rule","Data Holder","MUST","(1) This rule applies in relation to a particular joint account if:\n(a) the non-disclosure option applies to the account, and a joint account holder (account holder A) proposes, using the disclosure option management service, to change to the co-approval or pre-approval disclosure option;","CDR Rule 4A.8(1)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.09","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(a) explain to each of them what the consumer data right is;","CDR Rule 4A.8(2)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.10","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(b) inform them which disclosure option currently applies to the account;","CDR Rule 4A.8(2)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.11","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(c) inform them that account holder A has proposed that the co-approval or pre-approval option apply to the account, as the case may be;","CDR Rule 4A.8(2)(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.12","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(d) explain to them that this change requires the agreement of all account holders;","CDR Rule 4A.8(2)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.13","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(e) explain to them any alternative options for change that are available and how they can be made;","CDR Rule 4A.8(2)(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.14","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(f) invite them to either agree to or reject the proposal within a specified period.","CDR Rule 4A.8(2)(f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.15","CDR Rule","Data Holder","MUST","(3) At the end of the specified period, the data holder must, as soon as practicable through its ordinary means of contacting the joint account holders, inform them whether:\n(a) all the joint account holders have approved the change, and as a result the new disclosure option applies to the joint account; or\n(b) not all the joint account holders have approved the change, and as a result the disclosure option is unchanged.","CDR Rule 4A.8(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.16","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.17","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.18","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.19","CX Guideline","Data Holder","MAY","Data holders may consider providing a centralised location for managing various CDR account permissions, which could, for example, allow a consumer to access and manage their joint accounts, secondary user instructions, and any appropriate partnership and non-individual permissions. The disclosure option management service (DOMS) could be accessible from this location and in relation to the consumer dashboard.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.20","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.21","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant CDR Rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.22","CX Guideline","Data Holder","MAY","Data holders may provide a mechanism for consumers to see a list of authorisations currently sharing data from that joint account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.23","CX Guideline","Data Holder","MAY","Data holders may offer an alternative notification schedule to apply at the account level and the customer level.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.24","CX Guideline","Data Holder","MAY","Existing approvals for specific authorisations are not automatically removed when a non-disclosure option is applied, but the joint account data cannot be shared due to the application of the non-disclosure option. If a joint account is changed from a non-disclosure to enable sharing again, joint account data sharing will recommence for any active authorisations that are associated with that joint account.\n\nData holders should inform joint account holders of this fact when changing from a non-disclosure option to pre-approval or co-approval. Data holders may want to provide a way for the joint account holder to see who will access that data when sharing is enabled again, and may want to provide a simple mechanism for removing the approvals for the relevant sharing arrangements.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.25","CX Guideline","Data Holder","MAY","Data holders should indicate to the requester visually that an account requires further actions or approvals before a less restrictive disclosure option is applied.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.26","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.8(2) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.8(2), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.27","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.8(3) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.8(3), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.28","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.17.0","2022-06-08","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.01","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:\n(d) is simple and straightforward to use, and is no more complicated to use than the processes for giving the authorisation or instruction;","CDR Rule 1.15(5)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.02","CDR Rule","Data Holder","MUST","(1) A data holder must provide:\n(e) in relation to each account in relation to which a person has account privileges―a service that can be used by the account holder to: \n(ii) withdraw the instruction.\n\nNote 4: To avoid doubt, a service may be offered in an online form even if this subrule does not require it to be an online service.","CDR Rule 1.13(1)(e)(ii), (Note 4)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.03","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:\n(b) allows the account holder, at any time, to withdraw the secondary user instruction;","CDR Rule 1.15(5)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.04","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:\n(c) as part of the process of withdrawing a secondary user instruction, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a secondary user instruction;","CDR Rule 1.15(5)(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.05","CX Standard","Data Holder","MUST","As part of the secondary user instruction withdrawal process, data holders MUST advise the consumer:\n1. That removing a secondary user instruction will stop all current and future data sharing for the secondary user(s)\n2. To review the consequences of withdrawal with the secondary user(s) before removing the secondary user instruction\n\nNote: The exact phrasing of this message is at the discretion of the data holder.","Withdrawal Standards, Withdrawal: Secondary User Instruction [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.06","CX Guideline","Data Holder","MAY","Consumers may have various account permissions to manage, such as joint account disclosure option management, nominated representative services, and secondary user instructions. To facilitate consumer control and consent management, data holders should provide these services in intuitive and centralised locations in relation to their consumer dashboard.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.07","CX Guideline","Data Holder","MAY","If scrolling is required to view the total number of accounts, data holders should also allow consumers to search and filter their accounts.\n\nFor example: A consumer may want to filter account types or data sharing preferences.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.08","CX Guideline","Data Holder","MAY","Data holders may provide optional functionality that allows a consumer to see which authorisations are associated with the account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.09","CX Guideline","Data Holder","MAY","Data holders should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences. Data holders may choose to do this via a 2-step authorisation withdrawal process.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.10","CX Guideline","Data Holder","MAY","Data holders should notify the impacted secondary user(s) when their secondary user instruction is withdrawn. If a data holder does implement this functionality, the account owner withdrawing the instruction should be alerted to the fact that the secondary user(s) will be notified when the instruction is withdrawn.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.11","CX Guideline","Data Holder","MAY","Data holders should provide instructions on how to review and manage account permissions as part of the withdrawal process",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.12","CX Guideline","Data Holder","MAY","Data holders should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.13","CX Guideline","Data Holder","MAY","Data holders should provide support pathways at appropriate points throughout the consent model. These may include before and after key decision points, such as confirming or withdrawing a sharing arrangement or permission.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.14","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.17.0","2022-06-08","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.15","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that: \n(e) is prominently displayed and readily accessible to the account holder.","CDR Rule 1.15(5)(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.33.0","2025-02-26","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.01","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(a) to a relevant account holder, to inform them that the requester has given, amended or withdrawn an authorisation, or that the authorisation has expired;\nin accordance with the data standards.","CDR Rule 4A.14(1)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.02","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(b) to the requester, to inform them that:\n(ii) a relevant account holder has withdrawn an approval previously given;\nin accordance with the data standards.","CDR Rule 4A.14(1)(b)(ii)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.03","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(b) to the requester, to inform them that:\n(i) one or more of the relevant account holders has not given their approval for disclosure within the time frame referred to in paragraph 4A.11(e);\nin accordance with the data standards.","CDR Rule 4A.14(1)(b)(i)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.04","CDR Rule","Data Holder","MUST","(3) The data holder must, in accordance with any relevant data standards:\n(a) provide for alternative notification schedules (including reducing the frequency of notifications or not receiving notifications); and\n(b) give each joint account holder a means of selecting such an alternative, and of changing a selection.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.05","CX Standard","Data Holder","MAY","Data holders MAY allow a consumer to amend their notification schedule in line with existing notification management channels and experiences.\n\nThis MAY, for example, allow the joint account notification schedule to be amended in the same location as other notifications.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Amendment channels [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.06","CX Standard","Data Holder","MAY","For the content of the approval notification, data holders MAY provide the consumer with instructions for how any relevant authorisation(s) or approval(s) can be reviewed.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Notification content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.07","CX Standard","Data Holder","MAY","Data holders MAY provide a mechanism or entry point for a notification schedule to be amended from or in relation to the notification itself.\n\nThis MAY, for example, allow a consumer to stop receiving the type of notification(s) from the notification itself.\n\nThe notification MAY also, for example, include a link to amend the notification schedule or instructions to direct the consumer to the appropriate place.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Contextual amendment [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.08","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.09","CX Standard","Data Holder","MAY","Data holders MAY offer consumers the ability to specify which joint account notifications they do and do not want to receive.\n\nThis MAY, for example, allow a relevant joint account holder to only receive notifications when the requester gives or amends an authorisation.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Granular control [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.10","CX Standard","Data Holder","MAY","Data holders MAY allow consumers to elect to no longer receive any joint account notifications.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Turn off notifications [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.11","CX Standard","Data Holder","MAY","Data holders MAY offer consumers the ability to receive their joint account notifications less frequently and as a periodic summary.\n\nThis MAY, for example, outline all joint account activity at a frequency determined by the data holder and consumer, such as the previous quarter, month, fortnight, and so on.\n\nThis MAY also, for example, be provided with or in relation to other CDR notifications such as a CDR Receipt, which is optional for data holders.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Reduced frequency [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.12","CX Standard","Data Holder","MAY","Data holders MAY inform the consumer of the consequences of amending their joint account notification schedule.\n\nThis notification MAY include instructions for how to amend this schedule or reverse the amendment.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Consequences of amendment [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.13","CX Guideline","Data Holder","MAY","CDR Rule 4A.14(3) requires data holders to:  \n(a) provide for alternative notification schedules (including reducing the frequency of notifications or not receiving notifications), and \n(b) give each joint account holder a means of selecting such an alternative, and of changing an election.\n\nAlternative settings under rule 4A.14(3) only apply to the following notifications in rule 4A.14(1):\n1. The requester has given, amended, or withdrawn an authorisation\n2. Expiration of an authorisation\n3. A relevant account holder hasn’t given approval within the relevant time frame\n4. A relevant account holder has withdrawn an approval\n\nThe standards in this section provide a non-exhaustive list of options that data holders may implement to support their compliance with these rules. The specific implementation of an alternative notification schedule and offering, which may or may not include options listed here, are at the data holder’s discretion. It is the data holder’s responsibility to ensure it is meeting its obligations under the CDR Rules. Compliance with the CDR Rules on alternative notification schedules would require, at a minimum, implementation of a combination of options (being a combination of options listed below, other measures, or both).","CDR Rule 4A.14(1), (3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.14","CX Guideline","Data Holder","MAY","Data holders may offer an alternative notification schedule to apply at the account level and the customer level.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.15","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.16","CX Guideline","Data Holder","MAY","Data holders should provide information about the ADR to relevant account holders. This should include the ADR's name, accreditation number and a link to the their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.17","CX Guideline","Data Holder","MAY","Where an alternative notification schedule is provided as per CDR Rule 4A.14(3), this notification may be omitted at the consumer's request.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.18","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.19","CX Guideline","Data Holder","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","^"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.20","CX Guideline","Data Holder","MAY","Data holders should inform the consumer when a notification schedule change only applies for authorisation withdrawal/expiry and approval withdrawal, and not a change to the non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.21","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.17.0","2022-06-08","Active"]

{"sheet":"Active items","index":1,"n_rows":1348,"n_cols":13,"rows_kept":1348,"flags":["formulas_cached_only"]}
["Area","Focus area","Checklist ref","Type","Participant","Requirement level","Statement","Reference (file)","Example","Version introduced","Date introduced","Status","Date modified"]
["0AC. Accessibility","00. Accessibility","0AC.00.","CX Standard","Data Holder, Data Recipient","MUST","At a minimum, all CDR participants MUST seek to comply with accessibility guidelines throughout the Consent Model.\n\nThese standards SHOULD be assessed, tested, and refined further by accessibility consultants directly involved in implementation.","Accessibility Standards, Accessibility [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","01. Content distinction","0AC.01.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 1.4. This will make it easier to see and hear content, including separate foreground information from the background.","Accessibility Standards, Accessibility: Content distinction [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","02. Keyboard functionality","0AC.02.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 2.1. This will make all functionality available from a keyboard.","Accessibility Standards, Accessibility: Keyboard functionality [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","03. Pointer interactions","0AC.03.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 2.5. This will make it easier to operate functionality using various input devices.","Accessibility Standards, Accessibility Pointer interactions [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","04. Reading experience","0AC.04.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 3.1. This will make text content readable and understandable.","Accessibility Standards, Accessibility: Reading experiences [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0AC. Accessibility","05. Input assistance","0AC.05.","CX Standard","Data Holder, Data Recipient","MUST","Data recipients and data holders MUST seek to have all aspects of the Consent Model comply with WCAG 3.3. This will help users avoid and correct mistakes.","Accessibility Standards, Accessibility: Input assistance [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active"]
["0DL. Data Language","01. Language to be used","0DL.01.","CX Standard","Data Holder, Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-26"]
["0DL. Data Language","02. Detailed scope requests","0DL.02.","CX Standard","Data Holder, Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]",null,"1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-26"]
["1CO. Consent","00. Consent - general","1CO.00.02","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent:\n(a) that is not in a category of consents; or\n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:\n(i) identifying; or\n(ii) compiling insights in relation to; or\n(iii) building a profile in relation to;\nany identifiable person who is not the CDR consumer who made the consumer data request.\n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:\n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and\n(b) use that derived CDR data in order to provide the requested goods or services.","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active"]
["1CO. Consent","00. Consent - general","1CO.00.03","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n\n(a) must comply with any relevant data standards; and\n\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","00. Consent - general","1CO.00.04","CDR Rule","Data Recipient","MUST NOT","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(c), (d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","00. Consent - general","1CO.00.05","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","00. Consent - general","1CO.00.37","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","00. Consent - general","1CO.00.52","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","00. Consent - general","1CO.00.53","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","00. Consent - general","1CO.00.54","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active","2025-09-17"]
["1CO. Consent","00. Consent - general","1CO.00.55","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","00. Consent - general","1CO.00.56","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","00. Consent - general","1CO.00.57","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","00. Consent - general","1CO.00.58","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","01. DH selection","1CO.01.29","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","01. DH selection","1CO.01.30","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-17"]
["1CO. Consent","01. DH selection","1CO.01.31","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2026-03-18"]
["1CO. Consent","01. DH selection","1CO.01.59","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(aa) in the case of a use consent—either:\n\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.07","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\n\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(i) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.08","CDR Rule","Data Recipient","MUST NOT","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.09","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n\n(a) in the case of a collection consent or a disclosure consent—either:\n\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.10","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de‑identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.11","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d) ","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) |  CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.13","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) |  CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-05-01"]
["1CO. Consent","02. Collection and use consent","1CO.02.15","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.18","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.19","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.22","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.23","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(a) gives the accredited person a collection consent, use consent or disclosure consent; ","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.26","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.27","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.28","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.33","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.34","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.35","CX Guideline","Data Recipient","MAY","Data recipients should identify whether the user is sharing individual or non-individual accounts in order to surface the correct data language.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.36","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.40","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.47","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide information in relation to complaint handling at appropriate points throughout the Consent Model, such as: \n• during Pre-consent; \n• within the Consent Flow; and/or \n• within the CDR Receipt and/or Consumer Dashboards.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.16.1","2022-04-07","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.48","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.16.1","2022-04-07","Active","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.49","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","02. Collection and use consent","1CO.02.50","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.51","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\n\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03a. Using OSPs","1CO.03a.01","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(f) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the accredited person:\n(i) a statement of that fact;","CDR Rule 4.11(3)(f)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-05-01"]
["1CO. Consent","03a. Using OSPs","1CO.03a.02","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n\n(f) if the CDR data may be disclosed to, or collected by, a direct or indirect OSP (including one that is based overseas) of the accredited person: \n(i) a statement of that fact; and \n(ii) the name of the OSP; and\n(iii) the OSP’s accreditation number (if any); and\n(iv) if the OSP is based overseas—the country in which it is based; and\n(v) a link to a webpage where the accredited person’s CDR policy and the OSP’s CDR policy (if any) can be directly viewed; and\n(vi) a statement detailing why the OSP needs to access the consumer’s CDR data; and\n(vii) a statement that the consumer can obtain further information about why the OSP needs to access the consumer’s CDR data from the policy if desired;","CDR Rule 4.11(3)(f)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.03","CX Guideline","Data Recipient","MAY","Consumer research suggested that where direct or indirect OSPs are used, consumers expected transparency in this process, and that surfacing details about participants and their roles would facilitate trustworthiness and informed consent.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.06","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses direct or indirect OSPs; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf. \n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.07","CDR Rule","Data Recipient","MUST","The amendments of paragraph 4.11(3)(f) of the principal rules made by the amending rules apply on and after the day that is 12 months after the commencement of the amending rules.","CDR Rule 502","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03a. Using OSPs","1CO.03a.08","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03a. Using OSPs","1CO.03a.09","CX Guideline","Data Recipient","MAY","The previous requirements under CDR Rule 4.11(3)(f) of the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 will continue to apply until 11 November 2025. The new requirements apply on and after 12 November 2025.","CDR Rule 502","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.01","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.02","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n\n(i) if the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:\n(i) a statement of that fact; and \n(ii) the sponsor’s name; and \n(iii) the sponsor’s accreditation number; and \n(iv) if the sponsor is based overseas—the country in which it is based; and\n(v) a link to a webpage where the sponsor’s CDR policy can be directly viewed; and \n(vi) a statement detailing why the sponsor needs to access the consumer’s CDR data; and\n(vii) a statement that the CDR consumer can obtain further information about collections or disclosures of CDR data from the sponsor’s CDR policy if desired.","CDR Rule 4.11(3)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.03","CDR Rule","Data Recipient","MUST","(2B) If the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:\n(a) the request for a collection consent must specify that fact; and\n(b) a consent for the affiliate to collect the CDR data is taken to be consent for the sponsor to so collect it.","CDR Rule 4.3(2B)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.04","CDR Rule","Data Recipient","MUST","4.20A Application of Subdivision to sponsor and affiliate \n\nWhere this Subdivision would, if not for this rule, require both an affiliate and the affiliate’s sponsor to give a notice to a CDR consumer, the sponsor and the affiliate may choose which will give the notice.","CDR Rule 4.20A","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.05","CX Guideline","Data Recipient","MAY","For sponsorship arrangements, affiliates may display the sponsor's name and accreditation, as per CDR Rule 4.11(3)(i), where outsourced service provider involvement is surfaced to the consumer, as per CDR Rule 4.11(3)(f). \n\nAs demonstrated in these artefacts, this information should be readily accessible to the consumer.","CDR Rule 4.11(3)(f), (i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.06","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.20A, affiliates may provide the notifications specified in subdivision 4.3.5.","CDR Rule 4.20A","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.07","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 4.11(3)(a) and (b), the name and accreditation number of the affiliate should be displayed.","CDR Rule 4.11(3)(a), (b) | CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.08","CX Guideline","Data Recipient","MAY","Data recipients should provide a high level of transparency, control, and certainty around all parties who may collect or access the data in any way.\n\nData recipients can do this by surfacing relevant information and obligations regarding such parties and providers that would otherwise be found in CDR policies.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf. \n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03b. Sponsorship arrangement","1CO.03b.10","CX Guideline","Data Recipient","MAY","Various CDR Rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the sponsor to be referenced.\n\nThese artefacts demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the sponsor is only noted as a background detail.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.01","CDR Rule","Data Recipient","MUST","(1) In these rules, a CDR representative arrangement is a written contract between a person with unrestricted accreditation (the CDR representative principal) and a person without accreditation (the CDR representative):\n\n(a) under which the CDR representative will offer goods and services to CDR consumers, but not in their capacity as CDR business consumers, for which it will need to use or disclose CDR data of the CDR consumer; and\n\n(b) under which, where the CDR representative has obtained the consent of a CDR consumer to the collection, use and disclosure of CDR data in accordance with rule 4.3A:\n(i) the CDR representative principal will:\n(A) make any appropriate consumer data request; and\n(B) disclose the relevant CDR data to the CDR representative; and\n(ii) the CDR representative will use or disclose the CDR data to provide the relevant goods or services to the CDR consumer; and\n\n(d) under which the CDR representative is required to comply with:\n(i) any rules that are expressed as applying to a CDR representative; and\n(ii) any consumer experience data standards that are expressed as applying to an accredited data recipient, as if the CDR representative were an accredited data recipient.","CDR Rule 1.10AA(1)(a), (b), (d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.02","CDR Rule","Data Recipient","MUST","Note: From the point of view of a CDR consumer who is the customer of a CDR representative, the consumer deals with the CDR representative, as if it were an accredited person, and might not deal with the CDR representative principal at all. The consumer requests the goods or services from the CDR representative; the CDR representative identifies the CDR data that it needs in order to provide the goods and services; the consumer gives their consent to the CDR representative for the collection and use of the CDR data. The consumer is informed that the CDR representative principal will do the actual collecting, but as a background detail.\nA CDR representative cannot deal with a person in their capacity as a CDR business consumer.","CDR Rule 1.10AA (Note)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.03","CDR Rule","Data Recipient","MUST NOT","(4) A CDR representative arrangement must require the CDR representative to comply with the following requirements in relation to any service data:\n(c) the CDR representative must not use or disclose the service data other than in accordance with a contract with the CDR representative principal;","CDR Rule 1.10AA(4)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.04","CDR Rule","Data Recipient","MUST","(2) The CDR representative may, in accordance with Division 4.3A, ask the CDR consumer to give:\n(a) a collection consent for the CDR representative principal to collect the CDR consumer’s CDR data from the CDR participant and disclose it to the CDR representative; and\n(b) a use consent for the CDR representative to use it in order to provide those goods or services.\nNote 1: For a collection consent mentioned in paragraph (a), see subrule 1.10A(8).\nFor consents mentioned in paragraph (b), see rule 1.10A as applied to a CDR representative under subrule 1.10A(5).\nNote 2: In order to provide goods or services in accordance with the CDR consumer’s request, it might be necessary for the CDR representative principal to request CDR data from more than 1 CDR participant.\nNote 3: The CDR data may be collected and used only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3A(2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.06","CDR Rule","Data Recipient","MUST","(8) For an accredited person with a CDR representative, a consent given by a CDR consumer under these rules to the CDR representative for the accredited person to collect particular CDR data from a CDR participant for that CDR data and disclose it to the CDR representative is also a collection consent.","CDR Rule 1.10A(4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.12","CX Guideline","Data Recipient","MAY","For CDR representative arrangements, CDR representatives are required to display their own name as per rule 4.20E(3)(a), but as an unaccredited participant they are not required to display their accreditation number (as they do not have one).\n\nCDR representatives are required by rules 4.20E(3)(d) and (e) to display the CDR principal's name and accreditation number. The CDR representative may choose to display the principal's accreditation number in relation to the representative's name, and may also surface the principal's name, accreditation number, and other details, such as those specified in rules 4.20E(3)(b), (j) and (l) where outsourced service provider involvement is surfaced to the consumer, as per rule 4.20E(3)(k).\n\nAs demonstrated in these artefacts, this information should be readily accessible to the consumer.","CDR Rule 4.20E(3)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.13","CX Guideline","Data Recipient","MAY","CDR representatives can refer to the Principal as a background detail in the relevant artefacts, e.g. dashboard, withdrawal, notifications etc.","CDR Rule 1.10AA","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.15","CX Guideline","Data Recipient","MAY","Data recipients should provide a high level of transparency, control, and certainty around all parties who may collect or access the data in any way.\n\nData recipients can do this by surfacing relevant information and obligations regarding such parties and providers that would otherwise be found in CDR policies.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.16","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf. \n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.21","CDR Rule","Data Recipient","MUST","Note: Under rule 4.3A, if a CDR representative asks a CDR consumer for their consent to collect and use their CDR data, it must do so in accordance with this Division, and in particular, rules 4.20D, 4.20E and 4.20F. A failure to do so could result in the CDR representative principal being liable for one or more civil penalty provisions: see section 56EF of the Act and rule 1.16A.","CDR Rules, Subdivision 4.3A.2 (Note)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(d) the CDR representative principal’s name;\n(e) the CDR representative principal’s accreditation number;","CDR Rule 4.20E(3)(d), (e)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.23","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(b) the fact that the person is a CDR representative and that the CDR data will be collected by its CDR representative principal at its request;\n(j) a link to the CDR representative principal’s CDR policy;\n(l) a statement that the CDR consumer can obtain further information about the collections or disclosures for which consent is requested from the CDR representative principal’s CDR policy if desired;","CDR Rule 4.20E(3)(b), (j), (l)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.24","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(a) its name;","CDR Rule 4.20E(3)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.25","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n\n(m) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.20E(3)(m)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.26","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the CDR representative must give the CDR consumer the following information:\n(n) the following information about redundant data:\n(i) a statement, in accordance with rule 4.20N, regarding the CDR representative’s intended treatment of redundant data;","CDR Rule 4.20E(3)(n)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.27","CDR Rule","Data Recipient","MUST NOT","(1) A CDR representative must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.20F(1)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.29","CDR Rule","Data Recipient","MUST","A CDR representative must give the CDR consumer a notice that complies with the data standards as soon as practicable after:\n\n(a) the CDR consumer gives the CDR representative a collection consent, a use consent or a disclosure consent;","CDR Rule 4.20O(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.30","CDR Rule","Data Recipient","MUST","A request by a CDR representative for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines developed by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and\n(c) must not include or refer to the CDR representative principal’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.20D","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.31","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n (i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n (ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.20E(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.32","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.20E(1)(aa)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.33","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;","CDR Rule 4.20E(1)(b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.34","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, a CDR representative must:\n\n(d) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (c) for each relevant category of consents;","CDR Rule 4.20E(1)(d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.35","CDR Rule","Data Recipient","MUST NOT","(2) The CDR representative must not present direct marketing consents or de‑identification consents as pre-selected options to the CDR consumer for the purposes of subrule (1).","CDR Rule 4.20E(2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.36","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.20E(3)(n)(i), the CDR representative must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n\n (a) deleting the redundant data; or\n (b) de‑identifying the redundant data; or\n (c) deciding, when the CDR data becomes redundant data, whether to delete it or de‑identify it.","CDR Rule 4.20N(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.37","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.38","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active","2025-09-17"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.39","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 506 and further detailed in the Explanatory Statement issued for the Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024.\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.01","CDR Rule","Data Recipient","MUST","(9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.02","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;","CDR Rule 9.3(2)(eg)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.03","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n\n(a) is given in relation to a consent in one of the following categories:\n(i) use consents relating to the goods or services requested by the CDR business consumer;\n(ii) TA disclosure consents;\n(iii) insight disclosure consents;\n(iv) business consumer disclosure consents; and\n\n(b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).\n\nNote: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.","CDR Rule 1.10A(10)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.04","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement;","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.05","CDR Rule","Data Recipient","MUST NOT","(12) An accredited person must not make:\n(b) the giving of a business consumer statement;\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.06","CDR Rule","Data Recipient","MUST","(13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.","CDR Rule 1.10A(13)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n (i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n (ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.08","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time; and\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.09","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.10","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.11","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n(a) is given in relation to a consent in one of the following categories:\n(i) use consents relating to the goods or services requested by the CDR business consumer;","CDR Rule 1.10A(10)(a)(i)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.12","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.15","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.16","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.17","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-09-17"]
["1CO. Consent","04. Business consumer statement","1CO.04.18","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-09-17"]
["1CO. Consent","04. Business consumer statement","1CO.04.19","CX Guideline","Data Recipient","MAY","Data recipients should only request a business consumer statement if they have verified the consumer is a business consumer — per CDR Rule 1.10A(9) — and reasonably expect them to be intending to use the service for business purposes.\n\nAppropriate pre-consent and onboarding experiences can assist with funnelling consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for non-business consumers, and prevent consumers from inadvertently providing a business consumer statement.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.20","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 1.10A(9), when verifying the consumer is not an individual or has an active ABN, data recipients should be satisfied that the evidence given — such as the ABN — is current and relates to the consumer.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.21","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 4.11(1)(bb), data recipients must invite a business consumer to give a business consumer statement in the consent flow.\n\nThis invitation should be presented upfront. Doing so can help data recipients determine the appropriate consent duration and customer data language standards to surface, and whether a business consumer disclosure consent can be requested.","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.22","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 1.10A(10), a business consumer statement cannot be made in relation to a collection consent. As such, CDR Rule 4.12(1) stipulates that the maximum duration for collection consent is 12 months.","CDR Rule 1.10A(10), 4.12(1)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.23","CX Guideline","Data Recipient","MAY","Data recipients should only present business consumers with a pre-selected duration of more than 12 months where the service reasonably requires this and in compliance with the data minimisation principle, CDR Rule 1.8.","CDR Rule 1.8","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.24","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.25","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.26","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","04. Business consumer statement","1CO.04.27","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers fact sheet [https://www.cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.33.0","2025-03-05","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.01","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(a) must comply with any relevant data standards; and \n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; ","CDR Rule 4.10(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.02","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent). ","CDR Rule 4.10(c), (d)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.03","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle. ","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.04","CDR Rule","Data Recipient","MUST","(1) For the purposes of paragraph 56AJ(4)(c) of the Act, the following conditions are specified: \n(a) the person is an ADI or a relevant non-bank lender; and \n(aa) under Part 6 of this Schedule, these rules already apply to the person in their capacity as a data holder of other CDR data; and \n(b) the accredited person has collected CDR data, or any data directly or indirectly derived from CDR data (together, the relevant CDR data), in accordance with a collection consent; \n(c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data; \n(d) either: \n(i) the conditions specified in subclause (2); or \n(ii) the conditions specified in subclause (2A).","CDR Rule Clause 7.2(1) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.05","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or \n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply; \nwhere the period of consent is either: \n(iii) a single occasion; or \n(iv) a specified period of time; \n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13. ","CDR Rule 4.11(1)(b), (Note 2) |  CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.06","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months. ","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.07","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to; ","CDR Rule 4.11(3)(c)(i) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.08","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or \n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.09","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.10","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn; ","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.11","CDR Rule","Data Recipient","MUST","Conditions involving notification prior to first collection \n\n(2) For subparagraph (1)(d)(i), the conditions are:\n(a) either:\n(i) the accredited person is supplying the product to the CDR consumer; or\n(ii) the accredited person has received an application from the CDR consumer for the supply of the product to the CDR consumer, or is aware that the CDR consumer proposes to apply for the supply of the product; and\n(b) prior to the first collection of the relevant CDR data in accordance with the collection consent, the accredited person notified the CDR consumer that the accredited person would hold that data in accordance with the accredited person’s usual data holding practices for consumer data.\n\nNote: If, prior to the first collection of the relevant CDR data, an accredited person has notified the CDR consumer in accordance with this subclause, the accredited person does not need to notify the CDR consumer again before collecting further data in accordance with the collection consent. ",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.13","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent; ","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.14","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.15","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for language to be used when requesting banking data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.16","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.17","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.18","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.19","CX Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.20","CX Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.21","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.22","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.23","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter. ","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.24","CX Guideline","Data Recipient","MAY","Data recipients should list data holders in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders). ","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.25","CX Guideline","Data Recipient","MAY","Data recipients implementing CDR Rule Clause 7.2(2) need only comply with rules and standards for collection consents. Authorised deposit-taking institutions (ADIs) or non-bank lenders (NBLs) who are accredited persons, do not need to comply with CDR requirements for other consent types (such as use, de-identification, or disclosure). \n\nThese entities may use and disclose the collected data according to their usual data handling practices for the use case, even when these practices extend beyond the use and disclosure constraints in the CDR rules.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.26","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion'). \n\nExample DMP statement for data that is yet to be generated: \nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management]. \n\nExample DMP statement for historical data: \nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison]. ",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.27","CX Guideline","Data Recipient","MAY","Data recipients should identify whether the user is sharing individual or non-individual accounts in order to surface the correct data language.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.28","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.29","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets. \n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets. ","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.30","CX Guideline","Data Recipient","MAY","Privacy Safeguard 12 and the requirements to inform the consumer of the data recipient's redundant data handling practices do not apply, as the accredited ADI/NBL would would be handling the collected data in their capacity as a data holder.","CDR Rule 4.11(1)(e), 4.11(3)(h), 4.16, 4.17, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]; Withdrawal Standards, Withdrawing authorisation: Redundant data [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.31","CX Guideline","Data Recipient","MAY","If the data recipient uses an outsourced service provider (OSP) to facilitate the collection of CDR data on their behalf, they must provide the details outlined in CDR Rule 4.11(3)(f). For more details, see https://cx.dsb.gov.au/consent/collection-and-use-consents#block-1a1cbbcc3b934e85a5b966f2f8e560dc.\n\nIn instances where CDR data will only be disclosed to an OSP after collection, the data recipient does not need to provide these details. ","CDR Rule 4.11(3)(f)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.32","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.33","CX Guideline","Data Recipient","MAY","Data recipients may display the notification outlined in CDR Rule Clause 7.2(2)(b) of Schedule 3 as part of the terms for consent when seeking a collection consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.34","CX Guideline","Data Recipient","MAY","Regarding collection consent, CDR Rule 4.11(1)(c) requires data recipients to obtain the consumer's express consent to: \n• collect specific types of CDR data \n• collect that data for a specified time period ","CDR Rule 4.11(1)(a), (b), (c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.35","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05a. Conditions involving notification prior to first collection when holding data as a data holder","1CO.05a.36","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.01","CDR Rule","Data Recipient","MUST","(1) For the purposes of paragraph 56AJ(4)(c) of the Act, the following conditions are specified: \n(a) the person is an ADI or a relevant non-bank lender; and \n(aa) under Part 6 of this Schedule, these rules already apply to the person in their capacity as a data holder of other CDR data; and \n(b) the accredited person has collected CDR data, or any data directly or indirectly derived from CDR data (together, the relevant CDR data), in accordance with a collection consent; \n(c) the accredited person reasonably believes that the relevant CDR data is relevant to its supply of a product to the CDR consumer, for that data; \n(d) either: \n(i) the conditions specified in subclause (2); or \n(ii) the conditions specified in subclause (2A).","CDR Rule Clause 7.2(1) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.02","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(a) the accredited person is supplying the product to the CDR consumer; and \n(b) the accredited person has requested the CDR consumer to consent to the accredited person changing from an accredited data recipient of the relevant CDR data to a data holder of the relevant CDR data; ","CDR Rule Clause 7.2(2A)(a), (b) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.03","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(c) the accredited person has informed the CDR consumer: \n(iii) why the accredited person was entitled to request the consumer’s consent to the change; ","CDR Rule Clause 7.2(2A)(c)(iii) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.04","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(c) the accredited person has informed the CDR consumer: \n(i) that, if the consumer consents to that change, the privacy safeguards applicable to a data holder (rather than those applicable to an accredited data recipient) would apply to the accredited person in relation to the relevant CDR data;","CDR Rule Clause 7.2(2A)(c)(i) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.05","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that:(c) the accredited person has informed the CDR consumer: \n(ii) of the manner in which the accredited person proposes to treat the relevant CDR data; ","CDR Rule Clause 7.2(2A)(c)(ii) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.06","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(d) the CDR consumer has consented.","CDR Rule Clause 7.2(2A)(d) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.07","CDR Rule","Data Recipient","MUST","Conditions involving request for consent \n\n(2A) For subparagraph (1)(d)(ii), the conditions are that: \n(c) the accredited person has informed the CDR consumer: \n(iv) of the consequences of the consumer not giving their consent to the change; ","CDR Rule Clause 7.2(2A)(c)(iv) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.08","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for language to be used when requesting banking data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.09","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.10","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.11","CX Guideline","Data Recipient","MAY","When requesting for consent to become a data holder of the collected data, the accredited person should clearly display information about the data that will be handled under different protection frameworks.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","05b. Conditions involving request for permission to hold collected data as a data holder","1CO.05b.12","CX Guideline","Data Recipient","MAY","It is at the data recipient’s discretion in how they phrase the consequences of not giving consent as per Clause 7.2(2A)(c)(iv) of Schedule 3. \n\nFor example, they may offer alternative data collection methods if the consumer chooses to decline this permission, though they should consider emphasising the benefits of using CDR over these alternatives.","CDR Rule Clause 7.2(2A)(c)(iv) of Schedule 3","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.01","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.02","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.03","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.04","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.05","CX Guideline","Data Recipient","MAY","In cases where the brandGroup field is specified by the data holder, data recipients can visually present the related data holder/white label brands under a single grouping.","CDR Support Portal: White Labelled brands in the CDR [https://cdr-support.zendesk.com/hc/en-us/articles/900003938166-White-Labelled-brands-in-the-CDR]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO. Consent","06. Provider selection for white labeled brands","1CO.06.06","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.36.0","2026-03-18","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.01","CX Guideline","Data Recipient","MAY","CX research has demonstrated that transparency during the onboarding process, such as to outline what the ADR will and will not do with the consumer's data, increases the trustworthiness of the process and propensity to willingly consent.","CX Research: 2019 Phase 1; 2019 Phase 2, Stream 1-2","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.02","CX Guideline","Data Recipient","MAY","Appropriate pre-consent and onboarding experiences should be considered to funnel consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for consumers, and prevent consumers from inadvertently being presented incorrect steps and details.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.03","CX Guideline","Data Recipient","MAY","For disclosure consents, where the data recipient does not intend to offer the ability to actively select the disclosure recipient, it is recommended they clearly and upfront state who the disclosure recipient will be and their data handling practices as part of pre-consent. This supports informed consent and transparency.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.04","CX Guideline","Data Recipient","MAY","The following tools, models, and bodies of evidence can be used by CDR participants to inform the way they design value propositions and onboarding. These approaches have been demonstrated to support trustworthiness, increase propensity to consent, and influence perceptions of data sharing under the CDR. The following artefacts, based on CX research, provide useful behavioural insights:\n• Fogg Behavior Model – This model identifies three elements—Motivation, Ability, and a Prompt—as key to driving behaviour change. CX research (2019, 2021–2022) used this model to test various CDR value propositions as prompts, gauging consumer participants’ motivation and ability to proceed. For specific examples, see https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2#block-67baf9e84f3840a99895ae1269005da9 and https://cx.dsb.gov.au/overview/cx-reports/reports/one-time-password-research-report-q3-2022-r1#block-184993a5de9542acb85e07537b48d896.\n• Switching Canvas – This artefact captures the push and pull factors influencing whether consumers try something new. CX research (2019–2020) used it to explore consumer attitudes towards CDR and data sharing across various use cases. For more information, including a summary of factors, see https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80cdb723db0b24fcbd35.\n• Trust–Benefit Scale – This artefact explores attitudes and generalised characteristics across different scenarios. CX research (2020) used it to map consumer trust in CDR processes against perceived benefits from the data recipient. For more information, including generalised characteristics and attitudes, see https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80cdb723db0b24fcbd35.\n• Behavioural Archetypes – These archetypes describe four key behavioural segments based on attitudes, needs, and likelihood to consent. Developed and iterated through CX research (2020–2025), they provide a foundation for tailoring value propositions and content to different consumer types. For more information, see https://cx.dsb.gov.au/overview/behavioural-archetypes.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.05","CX Guideline","Data Recipient","MAY","Data recipients should clearly communicate the value of sharing data as part of the CDR. This may include information on the CDR process, data handling and data protections.","CX Research: 2019 Phase 1; 2020 Phase 3; 2021 Disclosure consent; 2022 Consent Review; Other 2022, 2023 (unpublished)","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.06","CX Guideline","Data Recipient","MAY","The CDR Rules do not prohibit alternative methods of data sharing. However, requests to obtain data through non-CDR mechanisms must remain separate from CDR consents. For more details, see https://cdr-support.zendesk.com/hc/en-us/articles/900005316646-Guidance-on-screen-scraping.","CDR Support Portal: Guidance on screen-scraping [https://cdr-support.zendesk.com/hc/en-us/articles/900005316646-Guidance-on-screen-scraping]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.07","CX Guideline","Data Recipient","MAY","Where possible and appropriate, data recipients may provide alternative methods for data access based on the use case, customer preferences, and to support voluntary consent. This may include manual upload.\n\nHowever, data recipients may also highlight the benefits of using CDR over alternatives, such as being considered a safer, more secure, and increasingly viable method for data access — particularly with the introduction of multi-factor authentication and other security controls that prevent other methods from being reliable or used at all.","CX Research: 2019 Phase 2, Stream 1-2; Other 2022, 2023 (unpublished)","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.08","CX Guideline","Data Recipient","MAY","CX research has shown that consumers are more likely to willingly consent when the value of doing so is clearly outlined before consent is requested.\n\nThis includes helping consumers understand:\n• Effort required – A simple statement like “This should only take a few minutes” helps set expectations and reduce friction.\n• Trust and confidence in data handling – Different consumer behavioural archetypes respond to different cues:\n    ◦ Sceptics gain confidence when they know who is involved and how their data will be handled.\n    ◦ Assurance seekers are reassured when the role of the government and data handling protections are explained.\n    ◦ Sensemakers benefit from a concise overview of how data is accessed, controlled, and protected in CDR.\n    ◦ Enthusiasts respond well to clear references to the government’s role, which reinforces trust.\n\nPresenting this information upfront helps build trust, reduce uncertainty, and increase the likelihood of consent.","CX Research: 2021 Disclosure consent","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.09","CX Guideline","Data Recipient","MAY","Accredited persons can use the CDR logo after accepting a Trade Mark Licencing Agreement (TMLA) with the ACCC. The CDR logo is a registered trade mark owned by the Commonwealth of Australia, and entities may only use the CDR logo for the Licensed Purpose specified in the TMLA.\n\nInline with the licence, \n• Prior to the consent request, the CDR logo can be used in relation to the CDR option and after its selection to support education and onboarding. \n• Accredited persons are permitted to use the CDR logo for 'collection' and 'use' consents, but not for 'disclosure' alone. The CDR logo may be used if collection, use, and disclosure consents are bundled in a single journey.\n• CDR representatives cannot use the CDR logo because they do not fall into a class of persons who can use the CDR logo for a Licensed Purpose.\n\nUse of the CDR logo helps facilitate consistency, familiarity, and trust in the CDR ecosystem.","CX Research: 2019 Phase 2, Stream 1 and 3 | ACCC CDR logo - Fact sheet [https://www.cdr.gov.au/resources/fact-sheets-providers#goto-cdr-logo]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.10","CX Guideline","Data Recipient","MAY","Data recipients should include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.\n\nReferencing government accreditation or trusted parties provides social proof, which increases trust and legitimacy. CX research found this gave consumers instant reassurance and positively influenced their decision to continue.\n\nThis was especially valued by the Assurance Seeker, Sensemaker, and Enthusiast behavioural archetypes.","CX Research: 2019 Phase 2, Stream 1; 2020 Phase 3, Round 3","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.11","CX Guideline","Data Recipient","MAY","Data recipients should include a pre-consent step before a consumer’s first consent. Pre-consent may not be necessary for subsequent consent flows, unless significant time has passed since the consumer’s last consent.",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.12","CX Guideline","Data Recipient","MAY","Information presented throughout the CDR journey should adhere to the https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards. This includes: \n• making it easier to see and hear content, including separate foreground information from the background; \n• making all functionality available from a keyboard; \n• making it easier to operate functionality using various input devices; \n• making text content readable and understandable; \n• helping users avoid and correct mistakes.","CX Research: 2019 Phase 2, Stream 1","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.13","CX Guideline","Data Recipient","MAY","These artefacts focus on the general CDR proposition and pre-consent experience. Additional considerations apply for specific consent types. For further guidance, see CX Guidelines:\n• https://cx.dsb.gov.au/consent/collection-and-use-consents#block-853072439fd14fa5a05a92159b3c7712\n• https://cx.dsb.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents#block-1bbf1af016ea8033a671f212cbd93ab5\n• https://cx.dsb.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents\n• https://cx.dsb.gov.au/consent/disclosure-consents/insight-disclosure-consents\n• https://cx.dsb.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents",null,"Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.14","CX Guideline","Data Recipient","MAY","The ability to return to earlier steps should be present and visible wherever possible throughout the consent flow to ensure user control and freedom.","10 Usability Heuristics for User Interface Design: User control and freedom (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.15","CX Guideline","Data Recipient","MAY","CDR participants should use visual cues, such as text styling and icons, to help break up content and assist in making content scannable, digestible and memorable.\n\nThis was especially valued by Enthusiast, Assurance seeker, Sensemaker behavioural archetypes.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]; 2021 Disclosure Consent","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.16","CX Guideline","Data Recipient","MAY","Data recipients should provide upfront information to help consumers understand and trust the process. CX research found that clear, early guidance increased confidence and helped consumers feel informed.\n\nWhen explaining the major stages of the Consent Flow, use plain, consistent language—such as Choose, Connect, and Confirm. Repeating these terms throughout the journey helps build familiarity with the CDR process.\n\nProviding this context before entering the flow encouraged users to explore CDR and reduced perceptions that the process was a ‘marketing trick’.\n\nThis was especially valued by the Sceptic, Sensemaker, and Enthusiast behavioural archetypes.","CX Research: 2021 Disclosure Consent | 10 Usability Heuristics for User Interface Design: Consistency and standards (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO0. Pre-Consent","00. Pre-consent - general","1CO0.00.17","CX Guideline","Data Recipient","MAY","To build trust, encourage adoption, and support understanding across all behavioural archetypes, data recipients should clearly and briefly indicate how they handle and protect consumer data. CX research found that this may include:\n• How data is protected\n• Not selling or sharing data without consent\n• Simple ways to manage or stop sharing at any time\n• Whether data will be deleted or de-identified after a set period\n• What happens in the event of a security breach\n• Links to CDR protections, complaint handling and other trusted sources\n\nTo reduce drop-off and improve completion, data recipients are encouraged to provide this information upfront during Pre-consent. This information is also required to be surfaced at key points in the Consent Model. For details, refer to the relevant stage in the https://cx.dsb.gov.au/.\n\nCX research found this helped consumers feel informed and more confident in continuing.","CX Research: 2019 Phase 1; 2019 Phase 2; 2021 Disclosure consent; 2022 Consent Review; Other 2022, 2023 (unpublished)","Consent: https://cx.dsb.gov.au/consent/pre-consent","1.35.0","2025-09-16","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.02","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent:\n(a) that is not in a category of consents; or\n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:\n(i) identifying; or\n(ii) compiling insights in relation to; or\n(iii) building a profile in relation to;\nany identifiable person who is not the CDR consumer who made the consumer data request.\n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:\n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and\n(b) use that derived CDR data in order to provide the requested goods or services.","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.03","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.04","CDR Rule","Data Recipient","MUST NOT","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and \n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(c)–(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.05","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply; where the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.08","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2024-03-06"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.13","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.16","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.17","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.19","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.20","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.28","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.29","CX Guideline","Data Recipient","MAY","Data recipients should show the accredited person’s accreditation number to facilitate consumer trust.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.30","CX Guideline","Data Recipient","MAY","Data recipients should provide a link to their CDR policy.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.32","CX Guideline","Data Recipient","MAY","Data recipients should encourage consumers to check the accredited person’s data handling policies before consenting to have their data disclosed.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.35","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an AP disclosure consent from a CDR consumer should refer to CDR Rule 4.3B(2) and Division 4.3A of the CDR Rules.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.36","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.37","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.38","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","Part 50—Transitional provisions, CDR Rule 503, Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.39","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.40","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s). \n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data. \n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.41","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025. \n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives). \n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.09","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.10","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.11","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1). ","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.24","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.25","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.26","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","01. AP disclosing unmodified data","1CO1.01.31","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.01","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.02","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.03","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de‑identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active","2025-03-19"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.04","CX Standard","Data Recipient","MUST","If:\n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.05","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.06","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.07","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.08","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.09","CX Guideline","Data Recipient","MAY","To describe data in easy to understand language, data recipients should have regard to the Accessibility Standards on reading experiences, with specific reference to WCAG success criteria 3.1.5, and draw from the Australian Government Style Guide on literacy and access.\n\nData recipients should, for example, describe data concisely, in plain language, with an Australian year 7 or lower readability level, and in a way that limits the use of unusual words, phrases, idioms, and jargon.","Accessibility Standards, Accessibility: Reading experiences [https://consumerdatastandardsaustralia.github.io/standards/#accessibility-standards] | WCAG Success Criterion 3.1.5 Reading Level (Level AAA) [https://www.w3.org/TR/WCAG22/#reading-level] | Literacy and access (Australian Government Style Manual) [https://www.stylemanual.gov.au/user-needs/understanding-needs/literacy-and-access]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","02. AP disclosing modified data","1CO1.02.10","CX Guideline","Data Recipient","MAY","In some scenarios, data recipients may not be able to identify the sector the data was derived from. This may occur, for example, in complex disclosure chains, significantly modified datasets, and in relation to sector-agnostic data.\n\nIn such scenarios, data recipients should describe the data in a way that is specific, meaningful, and comprehensible to the consumer.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data;\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.02","CDR Rule","Data Recipient","MUST","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; any identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3)–(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.03","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and\n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.04","CDR Rule","Data Recipient","MUST","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1). ","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.05","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(ba) in the case of a disclosure consent―either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or \n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: (b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or \n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply; where the period of consent is either: \n(iii) a single occasion; or \n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.08","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months. ","CDR Rule 4.12(1) | CX Research 4, 5","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.09","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:  \n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;","CDR Rule 4.11(3)(c)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.10","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.11","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(aa) in the case of a use consent—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or \n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.13","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.14","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.15","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.16","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.17","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.18","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: (a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.19","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.20","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.21","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.22","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.23","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.24","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.25","CX Standard","Data Recipient","MUST","If: \n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; \n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.26","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.27","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the terms of consent, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the terms of consent. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.28","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use\n[https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.29","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.31","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an AP disclosure consent from a CDR consumer should refer to CDR Rule 4.3B(2) and Division 4.3A of the CDR Rules.","CDR Rules 4.3B(2), Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.32","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards; \n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data. \n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.33","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.  \n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.  \n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a disclosure recipient and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this disclosure recipient. ","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.34","CX Guideline","Data Recipient","MAY","Data recipients should show the accredited person’s accreditation number to facilitate consumer trust.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.35","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion'). \n\nExample DMP statement for data that is yet to be generated: \nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management]. \n\nExample DMP statement for historical data: \nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.36","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.37","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets. \n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.38","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.39","CX Guideline","Data Recipient","MAY","Data recipients should encourage consumers to check the accredited person’s data handling policies before consenting to have their data disclosed.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.40","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.41","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.42","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide information in relation to complaint handling at appropriate points throughout the Consent Model, such as: \n• during Pre-consent; \n• within the Consent Flow; and/or \n• within the CDR Receipt and/or Consumer Dashboards. ","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.43","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.44","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.45","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.  \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.  \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure. \n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model. ","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.46","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025. \n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives). \n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date. ","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.47","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.48","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.49","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.50","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.36.0","2026-03-18","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.01","CDR Rule","Data Recipient","MUST","(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.","CDR Rule 4.12B(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.02","CDR Rule","Data Recipient","MUST","(2) The accredited person may give the invitation:\n\n(a) if its consumer dashboard allows a consent amendment in accordance with subrule 1.14(2A)―via its consumer dashboard; or\n\n(b) in writing directly to the CDR consumer.﻿","CDR Rule 4.12B(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.03","CDR Rule","Data Recipient","MUST","(3) The accredited person may invite a CDR consumer to amend a current consent if:\n(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or\n(b) the amendment would:\n(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and\n(ii) enable the accredited person to provide the modified goods or services.","CDR Rule 4.12B(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire;","CDR Rule 4.12B(4)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.06","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(b) give more than a reasonable number of such invitations within this period.","CDR Rule 4.12B(4)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.07","CDR Rule","Data Recipient","MUST","(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.\n\nExample: If an accredited person asks a CDR consumer who gave a consent as a CDR business consumer to amend a consent of a kind mentioned in paragraph 1.10A(10)(a), the accredited person must invite the CDR consumer to provide a further business consumer statement: see paragraph 4.11(1)(bb).","CDR Rule 4.12C(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2024-05-01"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.08","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent:\n(a) that is not in a category of consents; or\n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of:\n(i) identifying; or\n(ii) compiling insights in relation to; or\n(iii) building a profile in relation to;\nany identifiable person who is not the CDR consumer who made the consumer data request.\n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to:\n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and\n(b) use that derived CDR data in order to provide the requested goods or services.","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.09","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n\n(a) must comply with any relevant data standards; and\n\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(1)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.10","CDR Rule","Data Recipient","MUST NOT","A request by an accredited person for a CDR consumer to give or amend a consent: \n\n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(1)(c), (d)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.11","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(a) its name;\n(b) its accreditation number;","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.31","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division;","CDR Rule 4.18(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.36","CX Guideline","Data Recipient","MAY","Data recipients should present the realised benefits of data sharing as part of amending consent requests so consumers can assess the material value of providing consent.","CX Research: 2020 Phase 3, Round 3 report [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/05/CX-Report-_-Phase-3-_-Round-3.pdfhttps://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.42","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.58","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.59","CX Guideline","Data Recipient","MAY","CDR Representatives inviting consumers to amend their consent should refer to https://www.legislation.gov.au/F2020L00094/2023-07-22/2023-07-22/text/original/epub/OEBPS/document_1/document_1.html#_Toc143251412 of the CDR Rules.","CDR Rules Subdivision 4.3A.3","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.60","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-08-04"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.63","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.64","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.12","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies\nwith the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.13","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.14","CDR Rule","Data Recipient","MUST","(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer:\n(a) a statement that indicates the consequences of amending a consent; and\n(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.","CDR Rule 4.12C(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.15","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.16","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.17","CDR Rule","Data Recipient","MUST","(1) The Data Standards Chair must make one or more data standards about each of the following:\n(d) the types of CDR data and descriptions of those types, to be used by CDR participants in making and responding to requests;","CDR Rule 8.11(1)(d)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.19","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months: see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13. ","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.20","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2024-05-01"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n\n(g) a statement that, at any time, the consent can be withdrawn.","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.25","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.26","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.29","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) ask for the CDR consumer’s express consent to the choices referred to in paragraphs (a), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.33","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.34","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.35","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.37","CX Guideline","Data Recipient","MAY","Data recipients should communicate that consent will expire if request is not actioned.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.38","CX Guideline","Data Recipient","MAY","Data recipients should outline the consequences of not continuing to consent - such as service or data loss. This should include information about how data will be handled if re-consent is not provided.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.39","CX Guideline","Data Recipient","MAY","Data recipients should provide multiple reminders to warn consumers that their consent is about to expire. Such reminders should not be sent at unnecessarily high frequencies so as to cause notification fatigue.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.40","CX Guideline","Data Recipient","MAY","Data recipients should provide a clear ‘withdraw consent’ option in addition to allowing expiry by default.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.43","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.44","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.45","CX Guideline","Data Recipient","MAY","ADRs should present attributes to be amended in a way that is clearly distinct to attributes that have already been consented to. This may require specific design patterns and/or the use of signifiers, such as 'new' labels, to denote the change being requested.","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.46","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.49","CX Guideline","Data Recipient","MAY","Amendments to collection duration or dataset collection require data holder authentication and authorisation.\n\nAmendments to disclosure consents, use consents, including adding/removing uses or amending disclosure and/or use durations, do not require data holder authentication and authorisation.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.55","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide information in relation to complaint handling at appropriate points throughout the Consent Model, such as during Pre-consent; within the Consent Flow; and/or within the CDR Receipt and/or Consumer Dashboards.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.56","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Active","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.57","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.61","CX Standard","Data Recipient","MUST","When notifying a Data Holder of an amended collection consent as per rules 4.18C or 4.20S, Data Recipients MUST supply the relevant CDR Arrangement ID to the Data Holder according to https://consumerdatastandardsaustralia.github.io/standards/#specifying-an-existing-arrangement. Providing the CDR Arrangement ID is necessary to trigger the Data Holder authorisation flow simplifications outlined in the https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards. Failure to supply the CDR Arrangement ID will result in the full authorisation flow and a disconnected data sharing arrangement history on consumer dashboards.","Consent Standards, Consent: Amendment of Collection Consents and Authorisations [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.62","CX Standard","Data Recipient","MUST","Data recipients MUST indicate where datasets, uses, and durations are being amended.\n\nData recipients MAY apply this standard to other changing attributes where the attribute in the amending consent request differs to that of the previous consent. How a changed attribute is signified is at the data recipient’s discretion. ","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.66","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.67","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.68","Common Standard","Data Recipient","MAY","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.01","CDR Rule","Data Recipient","MUST","(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.","CDR Rule 4.12B(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.02","CDR Rule","Data Recipient","MUST","(2) The accredited person may give the invitation:\n(b) in writing directly to the CDR consumer.","CDR Rule 4.12B(2)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.03","CDR Rule","Data Recipient","MUST","(3) The accredited person may invite a CDR consumer to amend a current consent if:\n(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or\n(b) the amendment would:\n(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and\n(ii) enable the accredited person to provide the modified goods or services.","CDR Rule 4.12B(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire;","CDR Rule 4.12B(4)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.05","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(b) give more than a reasonable number of such invitations within this period.","CDR Rule 4.12B(4)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.06","CDR Rule","Data Recipient","MUST","(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.\nExample: If an accredited person asks a CDR consumer who gave a consent as a CDR business consumer to amend a consent of a kind mentioned in paragraph 1.10A(10)(a), the accredited person must invite the CDR consumer to provide a further business consumer statement: see paragraph 4.11(1)(bb).","CDR Rule 4.12C(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.08","CDR Rule","Data Recipient","MUST","(4) If the CDR consumer gave the consent as a CDR business consumer, the accredited person must take reasonable steps to re‑confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.\nNote: See subrule 1.10A(9).","CDR Rule 4.12C(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.09","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.10","CDR Rule","Data Recipient","MUST","(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer:\n(a) a statement that indicates the consequences of amending a consent; and\n(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.","CDR Rule 4.12C(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.11","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\n\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.13","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.14","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.15","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n\n(a) in the case of a collection consent or a disclosure consent—either:\n\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.18","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division;","CDR Rule 4.18(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.20","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.21","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.22","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.23","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-09-22"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.24","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active","2025-09-22"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.25","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.26","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.27","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.28","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.29","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.30","CX Guideline","Data Recipient","MAY","Data recipients should communicate that consent will expire if request is not actioned.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.31","CX Guideline","Data Recipient","MAY","Data recipients should outline the consequences of not continuing to consent - such as service or data loss. This should include information about how data will be handled if re-consent is not provided.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.32","CX Guideline","Data Recipient","MAY","Data recipients should provide multiple reminders to warn consumers that their consent is about to expire. Such reminders should not be sent at unnecessarily high frequencies so as to cause notification fatigue.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.35","CX Standard","Data Recipient","MUST","Data recipients MUST indicate where datasets, uses, and durations are being amended. \n\nData recipients MAY apply this standard to other changing attributes where the attribute in the amending consent request differs to that of the previous consent. How a changed attribute is signified is at the data recipient’s discretion. ","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.36","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-09-22"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.37","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [http://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.38","CX Guideline","Data Recipient","MAY","This flow demonstrates an amendment to a business consumer disclosure consent only. Data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10). Other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months.\n\nA detached disclosure consent amendment may occur where the original disclosure consent was given separate to the associated collection and use consents.\n\nIt may also occur where a bundled collection, use and disclosure consent was given, but different durations were selected for the disclosure consent and the collection consent. If this approach were taken, collection consent renewals would still need to be requested at least every 12 months, inline with the collection duration originally consented to.\n\nTo avoid detached amendments for consents originally given in a bundled fashion, data recipients may alternatively choose to propose a single duration of up to 12 months for all requested consents when inviting the consumer to give the initial consent. This would allow the data recipient to invite the consumer to renew all the consent types in a single action.","CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.39","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.40","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-08-04"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.41","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.01","CDR Rule","Data Recipient","MUST","(1) An accredited person may invite a CDR consumer to amend a consent given in accordance with this Division only in accordance with this rule.","CDR Rule 4.12B(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.02","CDR Rule","Data Recipient","MUST","(2) The accredited person may give the invitation:\n(b) in writing directly to the CDR consumer.","CDR Rule 4.12B(2)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.03","CDR Rule","Data Recipient","MUST","(3) The accredited person may invite a CDR consumer to amend a current consent if: \n(a) the amendment would better enable the accredited person to provide the goods or services referred to in paragraph 4.3(1)(a); or \n(b) the amendment would: \n(i) be consequential to an agreement between the accredited person and the CDR consumer to modify those goods or services; and \n(ii) enable the accredited person to provide the modified goods or services.","CDR Rule 4.12B(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(a) give the invitation any earlier than a reasonable period before the current consent is expected to expire;","CDR Rule 4.12B(4)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.05","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person must not, for an invitation to amend the period referred to in paragraph 4.11(1)(b):\n(b) give more than a reasonable number of such invitations within this period.","CDR Rule 4.12B(4)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.06","CDR Rule","Data Recipient","MUST","(1) Subject to this rule, if an accredited person allows CDR consumers to amend consents, it must allow them to do so in the same manner that it asks for CDR consumers to give consents.\n\nExample: If an accredited person asks a CDR consumer who gave a consent as a CDR business consumer to amend a consent of a kind mentioned in paragraph 1.10A(10)(a), the accredited person must invite the CDR consumer to provide a further business consumer statement: see paragraph 4.11(1)(bb).","CDR Rule 4.12C(1)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.07","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.08","CDR Rule","Data Recipient","MUST","(4) If the CDR consumer gave the consent as a CDR business consumer, the accredited person must take reasonable steps to re‑confirm that:(a) the CDR consumer is not an individual; or(b) the CDR consumer has an active ABN.\nNote: See subrule 1.10A(9).","CDR Rule 4.12C(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.09","CDR Rule","Data Recipient","MUST NOT","(2) The accredited person must not request direct marketing consents or de-identification consents by means of pre-selected options for the purposes of subrule (1).","CDR Rule 4.11(2)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.10","CDR Rule","Data Recipient","MUST NOT","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; \nany identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3), (4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.11","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; and\n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.12","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.13","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.14","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.15","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must: \n(a) not specify a period of time that is more than 7 years; and \n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.16","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.17","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.18","CDR Rule","Data Recipient","MUST","(3) In the case of an amendment to a consent, in addition to the information referred to in subrule 4.11(3), the accredited person must give the CDR consumer: \n(a) a statement that indicates the consequences of amending a consent; and\n(b) a statement that the accredited person will be able to continue to use any CDR data that has already been disclosed to it to the extent allowed by the amended consent.","CDR Rule 4.12C(3)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.19","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.20","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.21","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn.","CDR Rule 4.11(3)(g)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(h) the following information about redundant data: \n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data; ","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.23","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of: \n(a) deleting the redundant data; or \n(b) de-identifying the redundant data; or \n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it. ","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.24","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.25","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division;","CDR Rule 4.18(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.26","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.27","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.28","CX Standard","Data Recipient","MUST","When notifying a Data Holder of an amended collection consent as per rules 4.18C or 4.20S, Data Recipients MUST supply the relevant CDR Arrangement ID to the Data Holder according to https://consumerdatastandardsaustralia.github.io/standards/#specifying-an-existing-arrangement. Providing the CDR Arrangement ID is necessary to trigger the Data Holder authorisation flow simplifications outlined in the https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards. Failure to supply the CDR Arrangement ID will result in the full authorisation flow and a disconnected data sharing arrangement history on consumer dashboards.","Consent Standards, Consent: Amendment of Collection Consents and Authorisations [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.29","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.30","CX Standard","Data Recipient","MUST","Data recipients MUST indicate where datasets, uses, and durations are being amended. \n\nData recipients MAY apply this standard to other changing attributes where the attribute in the amending consent request differs to that of the previous consent. How a changed attribute is signified is at the data recipient’s discretion. ","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.31","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.32","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.33","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right. \n\nThis information SHOULD be immediately viewable by the consumer without further interaction. \n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.34","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.35","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.36","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.37","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.38","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. \n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation. \n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.39","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active","2025-09-22"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.40","CX Guideline","Data Recipient","MAY","Data recipients should communicate that consent will expire if request is not actioned.","CX Research 35 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.41","CX Guideline","Data Recipient","MAY","Data recipients should outline the consequences of not continuing to consent - such as service or data loss. This should include information about how data will be handled if re-consent is not provided.","CX Research 38 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.42","CX Guideline","Data Recipient","MAY","Data recipients should provide multiple reminders to warn consumers that their consent is about to expire. Such reminders should not be sent at unnecessarily high frequencies so as to cause notification fatigue.","CX Research 34 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.43","CX Guideline","Data Recipient","MAY","Data recipients should provide a clear ‘withdraw consent’ option in addition to allowing expiry by default.","CX Research 37 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.44","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [http://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.45","CX Guideline","Data Recipient","MAY","ADRs should present attributes to be amended in a way that is clearly distinct to attributes that have already been consented to. This may require specific design patterns and/or the use of signifiers, such as 'new' labels, to denote the change being requested.","Consent Standards, Amending consent: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_amending-consent-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.46","CX Guideline","Data Recipient","MAY","This flow demonstrates an amendment to extend the duration of a bundled collection, use and business consumer disclosure consent. Such a bundled amendment may occur where the original consent was given in a bundled fashion and each consent is due to expire shortly. While data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10), other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months.\n\nTo facilitate a streamlined amendment that matches how the original consent was given, data recipients may choose to propose a single duration of up to 12 months for all requested consents when inviting the consumer to give the initial consent. This would allow them to invite the consumer to renew all the consent types in a single action.\n\nAlternatively, data recipients can request detached consents of differing durations from the consumer, or a bundled consent with different durations for each consent type, with some consent types enduring for up to 7 years for business consumers. In those circumstances, these consents would be amended in a detached manner. If this approach were taken, collection consent renewals would need to be requested at least every 12 months, inline with the collection duration originally consented to.","CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.47","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where a duration of 12 months or less is proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.\n\nAs business consumer statements cannot be given in relation to collection consents, they have a maximum duration of 12 months. Data recipients wishing to offer durations greater than 12 months for business consumer disclosure consents will need to present 2 different durations for the 2 consent types.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.48","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.49","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.50","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.51","CX Guideline","Data Recipient","MAY","Data recipients should include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.52","CX Guideline","Data Recipient","MAY","Where an amendment includes changes to the collection duration or what datasets are being collected, the consumer will need to authenticate and authorise the amendment with the data holder.\n\nAn amendment that only changes the terms of a disclosure or use consent, such as adding/removing uses, changing what data is disclosed or amending the duration of disclosure and/or use consents, does not require data holder authentication and authorisation.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.53","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.54","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.55","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.56","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-08-04","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.57","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.58","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO2. Amending Consent","03. Amending business consumer disclosure consent - Bundled CDR Consents","1CO2.03.59","Common Standard","Data Recipient","MAY","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.35.0","2025-09-22","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\n\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.02","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.03","CDR Rule","Data Recipient","MUST","(1) An accredited person or CDR representative may invite a CDR consumer to nominate one or more persons as trusted advisers of the CDR consumer for the purposes of this rule.","CDR Rule 1.10C(1)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.04","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person or CDR representative must not make:\n(a) the nomination of a trusted adviser; or\n(b) the nomination of a particular person as a trusted adviser; or\n(c) the giving of a TA disclosure consent;\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10C(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.05","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.06","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.09","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.10","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.11","CX Standard","Data Recipient","MUST","If: \n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.12","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.13","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.14","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.15","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.16","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.17","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.22","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies when data is from multiple parties or sources.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.23","CX Guideline","Data Recipient","MAY","To describe data in easy to understand language, data recipients should have regard to the Accessibility Standards on reading experiences, with specific reference to WCAG 3.1.5, and draw from the Australian Government Style Manual on literacy and access.\n\nData recipients should seek to, for example, describe data concisely, in plain language, with an Australian year 7 or lower readability level, and in a way that limits the use of unusual words, phrases, idioms, and jargon.","Australian Government Style Manual: Literacy and access [https://www.stylemanual.gov.au/accessible-and-inclusive-content/literacy-and-access]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.24","CX Guideline","Data Recipient","MAY","The common disclosure consent data standards may also apply to trusted adviser disclosure consents.\n\nFor example, where a data recipient requests that transformed or modified data be disclosed to a trusted adviser.\n\nFor more information, see the CX guidelines about 'Disclosing modified data' (in 'Disclosure consents to accredited persons')","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.25","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.26","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the trusted adviser, explaining how the disclosed data will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.27","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.28","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.29","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. \n\nCX research highlighted the importance of including: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.30","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.32","CDR Rule","Data Recipient","MUST","(5) To avoid doubt, paragraphs (4)(a) and (c) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and provided to a trusted adviser.","CDR Rule 1.10C(5)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.33","CX Guideline","Data Recipient","MAY","CDR Representatives seeking a Trusted Adviser disclosure consent should refer to Division 4.3A of the CDR Rules.","CDR Rules Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.34","CX Guideline","Data Recipient","MAY","It is at the data recipient's discretion to offer a Trusted Adviser (TA) disclosure service to any TA of the consumer's choosing. This may be determined by existing and commercial arrangements with TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.35","CX Guideline","Data Recipient","MAY","Where a consumer has not previously nominated a Trusted Adviser (TA) at the time of giving a TA disclosure consent, data recipients may take the consumer’s selection/indication of a TA or the consumer’s agreement to a TA as presented to them when giving consent, to be the nomination of the TA.\n\nThe method of presenting nomination is at the discretion of the data recipient, and may consider their arrangements with specific TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.36","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:  \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.37","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.38","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.39","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.40","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a Trusted Adviser is required for their service. \n\nFor example, the selection step may be necessary where the data recipient offers a range of Trusted Advisers to which the consumer can disclose, including where a consumer has previously nominated multiple Trusted Advisers. \n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a Trusted Adviser and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this Trusted Adviser. ","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.41","CX Guideline","Data Recipient","MAY","Data recipients should consider providing upfront information to onboard consumer to the disclosure process. CX research suggested that the inclusion of clear information increased confidence and the ability for the consumer to be informed.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.42","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.43","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.01","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.02","CDR Rule","Data Recipient","MUST NOT","(4) The accredited person or CDR representative must not make:\n(a) the nomination of a trusted adviser; or\n(b) the nomination of a particular person as a trusted adviser; or\n(c) the giving of a TA disclosure consent;\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10C(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.03","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.04","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data;\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.05","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.08","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for language to be used when requesting banking data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.09","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-language section for banking data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.10","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.11","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.12","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.15","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.16","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.17","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.22","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies when data is from multiple parties or sources.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.23","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.24","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the trusted adviser, explaining how the disclosed data will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.25","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.26","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.27","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. \n\nCX research highlighted the importance of including:\n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.28","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.29","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.\n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.\n\nThe CX Guidelines demonstrate an intuitive grouping that presents collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt. This allows the receipts to be grouped according to relevant CDR Participant pairings.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.30","CDR Rule","Data Recipient","MUST","(5) To avoid doubt, paragraphs (4)(a) and (c) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and provided to a trusted adviser.","CDR Rule 1.10C(5)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.31","CX Guideline","Data Recipient","MAY","CDR Representatives seeking a Trusted Adviser disclosure consent should refer to Division 4.3A of the CDR Rules.","CDR Rules Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.32","CX Guideline","Data Recipient","MAY","It is at the data recipient's discretion to offer a Trusted Adviser (TA) disclosure service to any TA of the consumer's choosing. This may be determined by existing and commercial arrangements with TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.33","CX Guideline","Data Recipient","MAY","The intention of rule 1.10C(4)(b) is to prohibit a situation where a consumer is forced to select a particular person as a Trusted Adviser (TA) by an ADR, however there may be reasonable grounds to only offer a single TA to a consumer where they have a pre-existing relationship with a particular TA prior to engaging the ADR’s services.","CDR Rule 1.10C(4)(b) | Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.34","CX Guideline","Data Recipient","MAY","Where a consumer has not previously nominated a Trusted Adviser (TA) at the time of giving a TA disclosure consent, data recipients may take the consumer’s selection/indication of a TA or the consumer’s agreement to a TA as presented to them when giving consent, to be the nomination of the TA.\n\nThe method of presenting nomination is at the discretion of the data recipient, and may consider their arrangements with specific TAs.","Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/646]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.31.0","2024-10-03","Active","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.35","CDR Rule","Data Recipient","MUST","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; \nany identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3)–(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.36","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(a) must comply with any relevant data standards; and \n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids; \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and \n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent). ","CDR Rule 4.10","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.37","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.38","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or \n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;where the period of consent is either: \n(iii) a single occasion; or \n(iv) a specified period of time; \n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13. ","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.39","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.40","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed; and \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to; ","CDR Rule 4.11(3)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.41","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.42","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.43","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(h) the following information about redundant data:\n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.44","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of:\n(a) deleting the redundant data; or\n(b) de-identifying the redundant data; or\n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.45","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents; ","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.46","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.47","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.48","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.49","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.50","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the terms of consent, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the terms of consent. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.51","CX Guideline","Data Recipient","MAY","Data recipients should make the data holder list searchable if the number of data holders exceeds what can be displayed on the screen.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.52","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.54","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a Trusted Adviser is required for their service. \n\nFor example, the selection step may be necessary where the data recipient offers a range of Trusted Advisers to which the consumer can disclose, including where a consumer has previously nominated multiple Trusted Advisers. \n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a Trusted Adviser and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this Trusted Adviser.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.55","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.56","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.57","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible.\n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.58","CX Guideline","Data Recipient","MAY","ADRs should send CDR receipts via the consumer's preferred delivery channels.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-15"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.59","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025. \n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives). \n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.60","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.61","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.62","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.35.0","2025-09-15","Active"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.63","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.36.0","2026-03-18","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\n\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.02","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.03","CDR Rule","Data Recipient","MUST","(4) Despite paragraph 7.5(1)(e), disclosure of a CDR insight under an insight disclosure consent is not a permitted use or disclosure if the CDR insight includes or reveals sensitive information within the meaning of the Privacy Act 1988.","CDR Rule 7.5A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2024-03-06"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.04","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.05","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(ca) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;","CDR Rule 4.11(3)(ca)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.06","CDR Rule","Data Recipient","MUST","(3) For these rules, an insight disclosure consent in relation to particular CDR data of a CDR consumer held by an accredited data recipient, or a CDR representative that holds the CDR data as service data, is a disclosure consent given by the CDR consumer under these rules that:\n(a)  authorises the accredited data recipient or CDR representative to disclose the CDR data to a specified person for one or more of the following purposes:\n(i)  verifying the consumer’s identity;\n(ii)  verifying the consumer’s account balance;\n(iii)  verifying the details of credits to or debits from the consumer’s accounts; but\n(b)  where the CDR data relates to more than one transaction—does not authorise the accredited data recipient or CDR representative to disclose an amount or date in relation to any individual transaction.","CDR Rule 1.10A(3)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2024-03-06"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.07","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.10","CX Standard","Data Recipient","SHOULD","Data recipients SHOULD explain the purpose of generating the insight.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Purpose of insight [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.11","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language to describe what an insight would reveal or describe.\n\nWhere possible and practical, the actual insight SHOULD be displayed to the consumer prior to the insight being disclosed.\n\nWhere it is not possible to display the actual insight, accredited data recipients SHOULD include an example of the insight that demonstrates what the insight may reveal or describe. Accredited data recipients SHOULD make clear that any such examples are hypothetical.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.12","CX Standard","Data Recipient","MAY","Data recipients MAY explain how the insight will be generated using plain and concise language, which MAY include:\n• what method(s) would be used to generate the insight(s);\n• who would be involved in generating the insight(s), such as the specific actor(s); and\n• what information sources would be used to generate the insight, such as the specific dataset(s)","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight generation [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.13","CX Standard","Data Recipient","MUST","Data recipients MUST specify the period the insight will refer to and MAY note when the insight will be or is expected to be generated.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight timing [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.14","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.15","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.16","CX Standard","Data Recipient","MUST","If: \n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; or\n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data; \n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.17","CX Standard","Data Recipient","MUST","When seeking an insight disclosure consent, data recipients MUST provide instructions for how the consumer can access further records, including the actual insights (as per Rules 1.14 and 9.5).","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Insight records [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.18","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2024-03-06"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.19","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.20","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.21","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.22","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.23","CX Guideline","Data Recipient","MAY","Data recipients should consider providing upfront information to onboard consumers to the insight disclosure process. CX research suggested that the inclusion of clear information increased confidence and the ability for the consumer to be informed.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.27","CX Guideline","Data Recipient","MAY","Data recipients should explain what information will not be shared with the non-accredited person. Research suggested that clarifying this supported informed consent and confidence in the process.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.28","CX Guideline","Data Recipient","MAY","Where appropriate, data recipients should provide assurance that actual or permission-level data will only be accessed to generate insights and won't be disclosed to the non-accredited person or any other parties.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.29","CX Guideline","Data Recipient","MAY","As a matter of best practice, where possible, accredited data recipients and CDR representatives should show the consumer the CDR insight prior to it being disclosed. This will be unworkable in certain scenarios. However, as CX research suggested, doing this will aid comprehension and trust, and can also mitigate errors and incorrect outputs where the consumer is aware of incorrect details or insights being used.","OAIC Consumer Data Right insights [https://oaic.gov.au/consumer-data-right/guidance-and-advice/cdr-insights] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.30","CX Guideline","Data Recipient","MAY","CX standards require data recipients to use plain and concise language to describe insights. As a guide, data recipients may consider a reading grade of at least 7, and no more than 10, using the Flesch-Kincaid formula or the Automated Readability Index.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.31","CX Guideline","Data Recipient","MAY","The common disclosure consent data standards may also apply to insight disclosure consents.\n\nFor more information, see the CX guidelines about 'Disclosing modified data' (in 'Accredited Persons disclosure consents')","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Guidelines: Disclosure Consents, Accredited Persons disclosure consents [https://cx.dsb.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.32","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies when data is from multiple parties or sources.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.33","CX Guideline","Data Recipient","MAY","To describe data in easy to understand language, data recipients should have regard to the Accessibility Standards on reading experiences, with specific reference to WCAG 3.1.5, and draw from the Australian Government Style Manual on literacy and access.\n\nData recipients should seek to, for example, describe data concisely, in plain language, with an Australian year 7 or lower readability level, and in a way that limits the use of unusual words, phrases, idioms, and jargon.","Australian Government Style Manual: Literacy and access [https://www.stylemanual.gov.au/accessible-and-inclusive-content/literacy-and-access]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.34","CX Guideline","Data Recipient","MAY","As per the CX standards, data recipients should explain the insight's purpose. This explanation may be done at a high-level or, where known, based on how the data recipient expects the insight will be used.","CDR Rule 1.10A(3) | Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.35","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.36","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the insight recipient, explaining how the disclosed insights will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.37","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.38","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.39","CX Guideline","Data Recipient","MAY","Data recipients should surface information about the data deletion process: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.40","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptics, Assurance Seekers and Sensemakers. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.41","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that insight generation was successful, and that the insights were successfully shared. This message should be clearly visible and shown as soon as the action has taken place.\n\nThis may also be an appropriate location to display the actual insights prior to or immediately following their disclosure.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Active","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.44","CDR Rule","Data Recipient","MUST NOT","(4) An accredited person must not make:\n(a) the giving of an insight disclosure consent; or\n(b) the specification of a particular person for the purposes of paragraph (3)(a);\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.45","CDR Rule","Data Recipient","MUST","(7) To avoid doubt, paragraphs (4)(a), (5)(a) and (6)(a) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and CDR insights disclosed in accordance with the insight disclosure consent.","CDR Rule 1.10A(7)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.46","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an Insight disclosure consent should refer to CDR Rules 1.10A(5), 1.10A(6) and https://www.legislation.gov.au/F2020L00094/2023-07-22/2023-07-22/text/original/epub/OEBPS/document_1/document_1.html#_Toc143251404 of the CDR Rules.","CDR Rules 1.10A(5), 1.10A(6), Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.29.1","2024-03-06","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.47","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:   \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed; in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.48","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.49","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.50","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.51","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.52","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.53","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either: \n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data; \n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A). \nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.02","CDR Rule","Data Recipient","MUST","(4) Despite paragraph 7.5(1)(e), disclosure of a CDR insight under an insight disclosure consent is not a permitted use or disclosure if the CDR insight includes or reveals sensitive information within the meaning of the Privacy Act 1988.","CDR Rule 7.5A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.03","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either: \n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or \n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.04","CDR Rule","Data Recipient","MUST","(4) An accredited person must not make:\n(a) the giving of an insight disclosure consent; or\n(b) the specification of a particular person for the purposes of paragraph (3)(a);\na condition for supply of the goods or services requested by the CDR consumer.","CDR Rule 1.10A(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.05","CDR Rule","Data Recipient","MUST","(7) To avoid doubt, paragraphs (4)(a), (5)(a) and (6)(a) do not apply where the only good or service that is requested by the CDR consumer is for CDR data to be collected from a data holder and CDR insights disclosed in accordance with the insight disclosure consent.","CDR Rule 1.10A(7)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.06","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.07","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.08","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.09","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.10","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.11","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(ca) in the case of an insight disclosure consent—an explanation of the CDR insight that will make clear to the CDR consumer what the CDR insight would reveal or describe;","CDR Rule 4.11(3)(ca)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.12","CDR Rule","Data Recipient","MUST","(3) For these rules, an insight disclosure consent in relation to particular CDR data of a CDR consumer held by an accredited data recipient, or a CDR representative that holds the CDR data as service data, is a disclosure consent given by the CDR consumer under these rules that:\n(a)  authorises the accredited data recipient or CDR representative to disclose the CDR data to a specified person for one or more of the following purposes:\n(i)  verifying the consumer’s identity;\n(ii)  verifying the consumer’s account balance;\n(iii)  verifying the details of credits to or debits from the consumer’s accounts; but\n(b)  where the CDR data relates to more than one transaction—does not authorise the accredited data recipient or CDR representative to disclose an amount or date in relation to any individual transaction.","CDR Rule 1.10A(3)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.13","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:   \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including: \n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed; in order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.14","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.15","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.16","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(h) the following information about redundant data: \n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.17","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of: \n(a) deleting the redundant data; or \n(b) de-identifying the redundant data; or \n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.18","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.19","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: \n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.20","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.21","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.22","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.23","CX Standard","Data Recipient","MAY","Data recipients MAY explain how the insight will be generated using plain and concise language, which MAY include:\n• what method(s) would be used to generate the insight(s);\n• who would be involved in generating the insight(s), such as the specific actor(s); and\n• what information sources would be used to generate the insight, such as the specific dataset(s)","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight generation [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.24","CX Standard","Data Recipient","SHOULD","Data recipients SHOULD explain the purpose of generating the insight.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Purpose of insight [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.25","CX Standard","Data Recipient","MUST","When seeking an insight disclosure consent, data recipients MUST provide instructions for how the consumer can access further records, including the actual insights (as per Rules 1.14 and 9.5).","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Insight records [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.26","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.27","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.28","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language to describe what an insight would reveal or describe.\n\nWhere possible and practical, the actual insight SHOULD be displayed to the consumer prior to the insight being disclosed.\n\nWhere it is not possible to display the actual insight, accredited data recipients SHOULD include an example of the insight that demonstrates what the insight may reveal or describe. Accredited data recipients SHOULD make clear that any such examples are hypothetical.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.29","CX Standard","Data Recipient","MUST","Data recipients MUST specify the period the insight will refer to and MAY note when the insight will be or is expected to be generated.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight timing [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.30","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.31","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.32","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.33","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.34","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.35","CX Guideline","Data Recipient","MAY","Data recipients should consider providing upfront information to onboard consumer to the insight disclosure process. CX research suggested that the inclusion of clear information increased confidence and the ability for the consumer to be informed.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.36","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.37","CX Guideline","Data Recipient","MAY","Data recipients should explain what information will not be shared with the non-accredited person. Research suggested that clarifying this supported informed consent and confidence in the process.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.38","CX Guideline","Data Recipient","MAY","Where appropriate, data recipients should provide assurance that actual or permission-level data will only be accessed to generate insights and won't be disclosed to the non-accredited person or any other parties.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.39","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the terms of consent.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.40","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the terms of consent, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the terms of consent. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.41","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.42","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.44","CX Guideline","Data Recipient","MAY","CDR Representatives seeking an Insight disclosure consent should refer to rules 1.10A(5), 1.10A(6) and Division 4.3A of the CDR Rules.","CDR Rules 1.10A(5), 1.10A(6), Division 4.3A","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.45","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data: \nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.46","CX Guideline","Data Recipient","MAY","CX standards require data recipients to use plain and concise language to describe insights. As a guide, data recipients may consider a reading grade of at least 7, and no more than 10, using the Flesch-Kincaid formula or the Automated Readability Index.","Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.47","CX Guideline","Data Recipient","MAY","As per the CX standards, data recipients should explain the insight's purpose. This explanation may be done at a high-level or, where known, based on how the data recipient expects the insight will be used.","CDR Rule 1.10A(3) | Consent Standards, Disclosure Consent: Insight Descriptions, Insight disclosure: Insight comprehension [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-insight-descriptions]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.48","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.49","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible. \n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control. \n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.50","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide simple summaries, developed with the insight recipient, explaining how the disclosed insights will be handled. This summary may, for example, highlight differences between CDR and non-CDR protections","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.51","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.52","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. \n\nCX research highlighted the importance of including: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.53","CX Guideline","Data Recipient","MAY","Where applicable, data recipients should surface external links to '.gov.au' websites to allow consumers to further read about the CDR, if desired.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.54","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.55","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.56","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.57","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that insight generation was successful, and that the insights were successfully shared. This message should be clearly visible and shown as soon as the action has taken place.\n\nThis may also be an appropriate location to display the actual insights prior to or immediately following their disclosure.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.58","CX Guideline","Data Recipient","MAY","As a matter of best practice, where possible, accredited data recipients and CDR representatives should show the consumer the CDR insight prior to it being disclosed. This will be unworkable in certain scenarios. However, as CX research suggested, doing this will aid comprehension and trust, and can also mitigate errors and incorrect outputs where the consumer is aware of incorrect details or insights being used.\n\nWhen possible and practical, data recipients should allow the consumer to review their actual insight(s) before it is disclosed to the non-accredited person. Data recipients should also provide the consumer with the option to: \n• deny disclosure;\n• amend insights or data clusters; \n• confirm disclosure.","OAIC Consumer Data Right insights [https://www.oaic.gov.au/consumer-data-right/consumer-data-right-guidance-for-business/privacy-obligations/consumer-data-right-insights] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.59","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.60","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts. \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent. \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure.\n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.61","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.62","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.63","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.64","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.65","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.36.0","2026-03-18","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.01","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(b) after the CDR consumer has given a collection consent requested under subrule (2) in relation to the CDR data whether or not the CDR data has yet been collected.\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(b), (Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.02","CDR Rule","Data Recipient","MUST","(11) For these rules, a business consumer disclosure consent in relation to particular CDR data of a CDR business consumer held by an accredited data recipient is a disclosure consent given by the CDR business consumer under these rules that: \n(a) authorises the accredited data recipient to disclose the CDR data to a specified person; and \n(b) includes a business consumer statement.","CDR Rule 1.10A(11)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.03","CDR Rule","Data Recipient","MUST NOT","(12) An accredited person must not make:\n(c) the specification of a particular person for the purposes of paragraph (11)(a);\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.04","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.05","CDR Rule","Data Recipient","MUST","(9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.06","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;","CDR Rule 9.3(2)(eg)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.07","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n\n(a) is given in relation to a consent in one of the following categories: \n(i) use consents relating to the goods or services requested by the CDR business consumer; \n(ii) TA disclosure consents; \n(iii) insight disclosure consents; \n(iv) business consumer disclosure consents; and\n\n(b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).\n\nNote: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.","CDR Rule 1.10A(10), (Note)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.08","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.09","CDR Rule","Data Recipient","MUST NOT","(12) An accredited person must not make:\n(b) the giving of a business consumer statement;\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.10","CDR Rule","Data Recipient","MUST","(13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.","CDR Rule 1.10A(13)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.11","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time; and\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.12","CDR Rule","Data Recipient","MUST NOT","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.13","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.14","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.15","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.18","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.19","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.20","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.21","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.22","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.23","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right.\n\nThis information SHOULD be immediately viewable by the consumer without further interaction.\n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.24","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.25","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.26","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.27","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.\n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation.\n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.28","CX Guideline","Data Recipient","MAY","Data recipients may invite a consumer to give a use consent to confirm whether they are a business consumer, per the requirements of CDR Rule 1.10A(9). This could be requested in conjunction with a collection consent, or could be requested as a detached use for already collected data.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.29","CX Guideline","Data Recipient","MAY","Data recipients should only request a business consumer statement if they have verified the consumer is a business consumer — per CDR Rule 1.10(9) — and reasonably expect them to be intending to use the service for business purposes. \n\nAppropriate pre-consent and onboarding experiences can assist with funnelling consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for non-business consumers, and prevent consumers from inadvertently providing a business consumer statement.","CDR Rule 1.10(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.32","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 1.10A(9), when verifying the consumer is not an individual or has an active ABN, data recipients should be satisfied that the evidence given — such as the ABN — is current and relates to the consumer.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.33","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 4.11(1)(bb), data recipients must invite a business consumer to give a business consumer statement in the consent flow.\nThis invitation should be presented upfront. Doing so can help data recipients determine the appropriate consent duration and customer data language standards to surface, and whether a business consumer disclosure consent can be requested.","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.34","CX Guideline","Data Recipient","MAY","Data recipients must only present business consumers with a pre-selected duration of more than 12 months where the service reasonably requires this and in compliance with the data minimisation principle, CDR Rule 1.8.","CDR Rule 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.35","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | Nielsen Norman Group: 10 Usability Heuristics for User Interface Design (Error prevention) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.36","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.37","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.38","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.39","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.40","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.41","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.42","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [https://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.43","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.44","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible. \n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control. \n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.45","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset.","Data Language Standards: Common [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common] | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.46","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.47","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.01","CDR Rule","Data Recipient","MUST","(11) For these rules, a business consumer disclosure consent in relation to particular CDR data of a CDR business consumer held by an accredited data recipient is a disclosure consent given by the CDR business consumer under these rules that:\n\n(a) authorises the accredited data recipient to disclose the CDR data to a specified person; and\n\n(b) includes a business consumer statement.","CDR Rule 1.10A(11)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.02","CDR Rule","Data Recipient","MUST","(9) For these rules, a CDR consumer is taken to be a CDR business consumer in relation to a consumer data request to be made by an accredited person if the accredited person has taken reasonable steps to confirm that:\n(a) the CDR consumer is not an individual; or\n(b) the CDR consumer has an active ABN.","CDR Rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.03","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(eg) any steps taken for the purposes of subrule 1.10A(9) to confirm that a CDR consumer is a CDR business consumer;","CDR Rule 9.3(2)(eg)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.04","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n\n(a) is given in relation to a consent in one of the following categories:\n (i) use consents relating to the goods or services requested by the CDR business consumer;\n (ii) TA disclosure consents;\n (iii) insight disclosure consents;\n (iv) business consumer disclosure consents; and\n\n(b) certifies that the consent is given for the purpose of enabling the accredited person to provide goods or services to the CDR business consumer in its capacity as a business (and not as an individual).\n\nNote: Only an accredited person is able to deal with a CDR consumer in the CDR consumer’s capacity as a CDR business consumer, and is hence able to invite a CDR consumer to provide a business consumer statement.","CDR Rule 1.10A(10), (Note)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.05","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(bb) where the accredited person proposes, or is offering, to deal with a person in their capacity as a CDR business consumer in relation to a consent of a kind mentioned in paragraph 1.10A(10)(a)―invite the CDR business consumer to provide the business consumer statement;","CDR Rule 1.10A(11)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.06","CDR Rule","Data Recipient","MUST","(12) An accredited person must not make:\n(b) the giving of a business consumer statement;\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.07","CDR Rule","Data Recipient","MUST","(13) To avoid doubt, paragraphs (12)(a) and (b) do not apply where the only good or service that is requested by the CDR business consumer is for CDR data to be collected from a data holder and provided to a specified person.","CDR Rule 1.10A(13)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.08","CDR Rule","Data Recipient","MUST","(2A) The accredited person may also ask a CDR consumer to give a disclosure consent in relation to CDR data, either:\n(a) at the same time the accredited person asks the CDR consumer to give a collection consent under subrule (2) in relation to the CDR data;\n\nNote 1: Requests for collection consent, use consent and disclosure consent may be bundled together (see subrules 4.3(2) and (2A).\nNote 2: The CDR data may be disclosed only in accordance with the data minimisation principle: see rule 1.8.","CDR Rule 4.3(2A)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.09","CDR Rule","Data Recipient","MUST","(3) An accredited person must not ask for a consent: \n(a) that is not in a category of consents; or \n(b) subject to subrule (4), for using the CDR data, including by aggregating the data, for the purpose of: \n(i) identifying; or \n(ii) compiling insights in relation to; or \n(iii) building a profile in relation to; \nany identifiable person who is not the CDR consumer who made the consumer data request. \n\n(4) Paragraph (3)(b) does not apply in relation to a person whose identity is readily apparent from the CDR data, if the accredited person is seeking consent to: \n(a) derive, from that CDR data, CDR data about that person’s interactions with the CDR consumer; and \n(b) use that derived CDR data in order to provide the requested goods or services. ","CDR Rule 4.12(3)–(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.10","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent:\n(a) must comply with any relevant data standards; and\n(b) having regard to any consumer experience guidelines made by the Data Standards Body—must be reasonably easy to understand, including by use of plain concise language and, where appropriate, visual aids;","CDR Rule 4.10(a)–(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.11","CDR Rule","Data Recipient","MUST","A request by an accredited person for a CDR consumer to give or amend a consent: \n(c) must not include or refer to the accredited person’s CDR policy or other documents in a way that reduces understandability; and\n(d) must not be combined with other requests except for a consent under these rules (other than a request for direct marketing or de-identification consent).","CDR Rule 4.10(c)–(d)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.12","CDR Rule","Data Recipient","MUST","(2) An accredited person must not ask for a collection consent, use consent or disclosure consent unless the collection, use or disclosure of CDR data in accordance with the consent would comply with the data minimisation principle.","CDR Rule 4.12(2) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.13","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(b) in relation to the period of the collection consent, use consent, or disclosure consent (as appropriate)—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the period of consent; or\n(ii) seek the CDR consumer’s agreement to the period of consent (as presented to the CDR consumer) to which the consent will apply;\nwhere the period of consent is either:\n(iii) a single occasion; or\n(iv) a specified period of time;\n\nNote 2: For paragraph (b), the specified period may not be more than 12 months (or 7 years for certain consents by a CDR business consumer): see subrule 4.12(1). After the end of the period, redundant data would need to be dealt with in accordance with subsection 56EO(2) of the Act (privacy safeguard 12) and rules 7.12 and 7.13.","CDR Rule 4.11(1)(b), (Note 2) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.14","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (1A), an accredited person must not specify a period of time for the purposes of paragraph 4.11(1)(b) that is more than 12 months.","CDR Rule 4.12(1) | CX Research 4, 5 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.15","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(ba) in the case of a disclosure consent―either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the persons to whom the CDR data may be disclosed; or\n(ii) seek the CDR consumer’s agreement to the persons (as presented to the CDR consumer) to whom the CDR data may be disclosed;","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.16","CDR Rule","Data Recipient","MUST","(12) An accredited person must not make:\n(c) the specification of a particular person for the purposes of paragraph (11)(a);\na condition for supply of the goods or services requested by the CDR business consumer.","CDR Rule 1.10A(12)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.17","CDR Rule","Data Recipient","MUST","(10) For these rules, a business consumer statement is a statement made by a CDR business consumer that:\n(a) is given in relation to a consent in one of the following categories:\n(i) use consents relating to the goods or services requested by the CDR business consumer;\n(iv) business consumer disclosure consents;","CDR Rule 1.10A(10)(a)(i),(iv)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.18","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.19","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n\n(i) in the case of a collection consent in relation to the provision of requested goods or services—an explanation of why that collection is reasonably needed, and relates to a time period that is no longer than is reasonably needed;\n\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.20","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(a) in the case of a collection consent or a disclosure consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the particular types of CDR data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the particular types of CDR data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.21","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must: \n(aa) in the case of a use consent—either:\n(i) allow the CDR consumer to actively select or otherwise clearly indicate the specific uses of collected data to which the consent will apply; or\n(ii) seek the CDR consumer’s agreement to the specific uses of collected data (as presented to the CDR consumer) to which the consent will apply;","CDR Rule 4.11(1)(aa) | CX Research 2, 6 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.22","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(c) in the case of a collection consent, use consent or disclosure consent—information about how the collection, use or disclosure indicated in a manner consistent with the requirements set out in subrule (1) complies with the data minimisation principle, including:\n(ii) in the case of a use consent or disclosure consent—an explanation of why that use or disclosure does not go beyond what is reasonably needed;\nin order to provide the requested goods or services to the CDR consumer, or to effect the permitted uses or disclosures consented to;","CDR Rule 4.11(3)(c)(ii) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.23","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(a) its name; \n(b) its accreditation number; ","CDR Rule 4.11(3)(a), (b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.24","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(g) a statement that, at any time, the consent can be withdrawn;","CDR Rule 4.11(3)(g) | CX Research 7, 32","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.25","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information: \n(h) the following information about redundant data: \n(i) a statement, in accordance with rule 4.17, regarding the accredited person’s intended treatment of redundant data;","CDR Rule 4.11(3)(h)(i)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.26","CDR Rule","Data Recipient","MUST","(1) For subparagraph 4.11(3)(h)(i), the accredited person must state whether they have a general policy, when collected CDR data becomes redundant data, of: \n(a) deleting the redundant data; or \n(b) de-identifying the redundant data; or \n(c) deciding, when the CDR data becomes redundant data, whether to delete it or de-identify it.","CDR Rule 4.17(1) | CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.27","CDR Rule","Data Recipient","MUST","(1) When asking a CDR consumer to give a consent, an accredited person must:\n(c) seek the CDR consumer’s express consent to the matters referred to in paragraphs (a), (aa), (b) and (ba) for each relevant category of consents;","CDR Rule 4.11(1)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.28","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent;","CDR Rule 4.18(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.29","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.30","CX Standard","Data Recipient","MUST","Data recipients MUST use plain and concise language when inviting a consumer to give a business consumer statement.","Consent Standards, Business consumer statement: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.31","CX Standard","Data Recipient","MUST","When seeking a business consumer statement, data recipients MUST invite the business consumer to give the business consumer statement in a manner that is explicit, express, and through an active selection or declaration.\n\nThe giving of a business consumer statement MUST be clearly separated from any other interaction or information provided to the consumer and MUST NOT be implied or bundled with any other permission.","Consent Standards, Business consumer statement: Method [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.32","CX Standard","Data Recipient","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.33","CX Standard","Data Recipient","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.34","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.35","CX Standard","Data Recipient","MUST","Data recipients MUST state that data disclosed to a non-accredited person will not be regulated as part of the Consumer Data Right. \n\nThis information SHOULD be immediately viewable by the consumer without further interaction. \n\nData recipients MAY include a plain and concise explanation of what this means, which MAY include information on the Consumer Data Right, and MAY include a link to the https://www.oaic.gov.au/consumer-data-right.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: CDR protections [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.36","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.37","CX Standard","Data Recipient","MUST","Data recipients MUST provide plain and concise information on dispute resolution and making a complaint. This SHOULD reflect the process and information contained in the data recipient’s CDR policy related to complaints. This MAY also include a link to the accredited data recipient’s CDR policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.38","CX Standard","Data Recipient","MUST","Data recipients MUST advise the consumer to review how the non-accredited person will handle their data.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Review [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.39","CX Standard","Data Recipient","MAY","If available, data recipients MAY include a link to any relevant data handling policies of the non-accredited person, such as their Privacy Policy.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Data handling [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.40","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.41","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. \n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation. \n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.42","CX Guideline","Data Recipient","MAY","Data recipients should only request a business consumer statement if they have verified the consumer is a business consumer — per CDR Rule 1.10(9) — and reasonably expect them to be intending to use the service for business purposes. \n\nAppropriate pre-consent and onboarding experiences can assist with funnelling consumers towards the most appropriate consent flow for their needs.\n\nThis can reduce cognitive load for non-business consumers, and prevent consumers from inadvertently providing a business consumer statement.","CDR Rule 1.10(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.43","CX Guideline","Data Recipient","MAY","The rules do not allow an individual without an active ABN to be treated as a CDR business consumer.","ACCC CDR business consumers - Fact sheet [https://cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.44","CX Guideline","Data Recipient","MAY","Inline with CDR Rule 1.10A(9), when verifying the consumer is not an individual or has an active ABN, data recipients should be satisfied that the evidence given — such as the ABN — is current and relates to the consumer.","CDR rule 1.10A(9)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.45","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 4.11(1)(bb), data recipients must invite a business consumer to give a business consumer statement in the consent flow. \nThis invitation should be presented upfront. Doing so can help data recipients determine the appropriate consent duration and customer data language standards to surface, and whether a business consumer disclosure consent can be requested.","CDR Rule 4.11(1)(bb)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.46","CX Guideline","Data Recipient","MAY","Data recipients may choose to present data holder selection screens before or after the data request occurs.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.47","CX Guideline","Data Recipient","MAY","While data recipients may choose to present the data holder selection screens before or after the data request occurs, for disclosure consents recipients must ensure they meet the CX Standard Disclosure consent: Collection source as part of the data request. In some instances, this may require the data holder selection to be presented upfront.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.48","CX Guideline","Data Recipient","MAY","Data recipients should present data holder brands in a way that is intuitive and allows consumers to search, sort and filter.","CX Research: Other 2025 (unpublished) | 10 Usability Heuristics for User Interface Design (Nielsen): Match Between the System and the Real World; Flexibility and efficiency of use [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.49","CX Guideline","Data Recipient","MAY","Data recipients should list data holder brands in an easily scannable way. This can be done alphabetically or contextually (for example, starting with popular data holders).","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2026-03-18"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.51","CX Guideline","Data Recipient","MAY","This flow demonstrates bundled collection, use, and business consumer disclosure consents. Data recipients may propose a consent duration of up to 7 years to business consumers for permitted consents under 1.10A(10). Other consents, such as collection consents (and the corresponding data holder authorisations), are limited to a maximum of 12 months.\n\nData recipients may choose to propose durations that differ based on the consent type. If this approach were taken, collection consent renewals would still need to be requested at least every 12 months, inline with the collection duration originally consented to.\n\nData recipients may alternatively choose to propose a single duration of up to 12 months for all the requested consents, despite being able to request up to 7 years for the use and disclosure consent. This would allow the data recipient to invite the consumer to renew all the consent types in a single action.","CDR Rules 1.10A(10), 4.11(1)(b), 4.12(1)–(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.52","CX Guideline","Data Recipient","MAY","In accordance with CDR Rule 1.10A(10), a business consumer statement cannot be made in relation to a collection consent. As such, CDR Rule 4.12(1) stipulates that the maximum duration for collection consent is 12 months.","CDR Rule 1.10A(10), 4.12(1)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.53","CX Guideline","Data Recipient","MAY","Data recipients should use their discretion to determine whether a step to select a non-Accredited Person is required for their service.\n\nFor example, the selection step may be necessary where the data recipient offers a range persons to whom the consumer can disclose.\n\nBy contrast, the selection step may not be necessary where the consumer has a pre-existing relationship with a non-Accredited Person and the data recipient can reasonably assume that the consumer is engaging their service to disclose their data to this non-AP.","CDR Rule 4.11(1)(ba)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.54","CX Guideline","Data Recipient","MAY","Data recipients should only present business consumers with a pre-selected duration of more than 12 months where the service reasonably requires this and in compliance with the data minimisation principle, CDR Rule 1.8.","CDR Rule 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.55","CX Guideline","Data Recipient","MAY","Data recipients will need to explain how the time period complies with the data minimisation principle (DMP). This is required for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe need to collect and use your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe need to collect the last 12 months of your data so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 4.11(3)(c), 1.8 | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle] | CX Research 1, 3 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.56","CX Guideline","Data Recipient","MAY","When data is requested and accessed, language used to describe the data must be described in accordance with the relevant CX standards;\n• ‘Data Language Standards: Language to be used’ and ‘Data Language Standards: Detailed scope requests’ applies when describing unmodified data from data holder(s).\n• ‘Consent Standards, Disclosure consent: Collection source’ applies to any data collected, but can be stated once where the collection source is the same for all data.\n• ‘Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed’ applies when describing any dataset. ","Data Language Standards: Common | Consent Standards [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.57","CX Guideline","Data Recipient","MAY","Data recipients should identify whether the user is sharing individual or non-individual accounts in order to surface the correct data language.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.58","CX Guideline","Data Recipient","MAY","Data recipients should make the consent process as easy to understand as possible. \n\nData recipients should nudge consumers to be more privacy conscious and should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control. \n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.59","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose of the consent request in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.","CDR Rule 4.11(3)(c), 1.8","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.60","CX Guideline","Data Recipient","MAY","Data recipients should also include a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes. ",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.61","CX Guideline","Data Recipient","MAY","Where a data recipient presents a duration over 12 months for a consent that includes a business consumer statement, they must give the consumer at least one option of 12 months or less, to meet CDR Rule 4.12(1A)(b). For example, if a data recipient presents a 3 year duration, they might offer a 12 month option, a 6 month option, or both, but at least one must be offered.\n\nData recipients are not required to allow the consumer to choose an alternative duration where durations of 12 months or less are proposed. However, data recipients may voluntarily provide this choice.\n\nWhen presenting duration options, data recipients should present consumers with a limited selection of duration options to reduce cognitive load. The options presented should represent the most common and/or most appropriate durations for the service being offered and be in compliance with the data minimisation principle.","CDR Rule 4.12(1A)(b) | 10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.62","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy.","CDR Rule 7.2(4)(k) | CX Research: 2019 Phase 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-1-reports-2019#block-162f1af016ea80b0bc03e29ecdf9b7d9]; 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.63","CX Guideline","Data Recipient","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.64","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.65","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to provide links to the non-accredited person’s data handling information for the consumer to review.\n\nCX research and consultation suggested that accurate information on data handling provided by the non-accredited person would increase trustworthiness and consumer comfort.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.66","CX Guideline","Data Recipient","MAY","If the non-accredited person does not have a Privacy Policy, data recipients are encouraged to provide the consumer with other details;\n• to contact the non-accredited person; or\n• to review up-to-date information on the non-accredited person's data handling policies.","CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.67","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.68","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts. \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent. \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure.\n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.69","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.70","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.71","Common Standard","Data Recipient",null,"Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.72","Common Standard","Data Recipient","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.35.0","2025-09-12","Active"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.73","CX Guideline","Data Recipient","MAY","Data recipients should populate the data holder/provider selection list using the data holder brandName field provided in the CDR Register APIs.\n\nFor additional guidance on surfacing brand names and brand groups, see the CX Guidelines on Consent: Collection and use consents - Provider selection for white labeled brands [https://cx.dsb.gov.au/consent/collection-and-use-consents#block-321f1af016ea801fa3bbe3544664f859].","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.36.0","2026-03-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.01","CDR Rule","Data Holder","MUST","(8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.","CDR Rule 7.2(8)","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active","2024-02-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.02","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT include forgotten details links in redirect screens.","Authentication Standards, Redirect to Web with OTP, Authentication: Password Link [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.06","Technical Standard","Data Holder","SHOULD","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.16","CX Guideline","Data Holder","MAY","Data holders should use the Brand Name of the data recipient wherever the data recipient is referenced in consumer-facing authentication processes, including cancellation screens and One Time Password (OTP) delivery.\n\nIf the data recipient is not referenced in certain processes, such as the OTP message, data holders should not introduce the Brand Name for the purposes of this guideline. Data holders should not present the Software Product Name in relation to these processes.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.17","CX Guideline","Data Holder","MAY","Data holders should consider including their CDR policy in the authentication process as this will likely be the first online service the CDR consumer uses to interact with their data holder for the purposes of CDR.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.18","CX Guideline","Data Holder","MAY","Data holders may choose to include relevant organisation credentials if it reflects existing authentication processes, such as their ABN.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.22","CX Guideline","Data Holder","MAY","Data holders will need to determine appropriate authentication methods in accordance with the standards, including the appropriate identifiers and OTP delivery channels.\n\nAs per Schedule 4 Rules 2.1 and 2.3(2) for the energy sector, some consumers may not have online access to an account.\n\nIn such a scenario, an appropriate credential and/or OTP delivery channel may need to be determined by the data holder to successfully authenticate the consumer.\n\nTo facilitate authentication in this scenario, a data holder may, for example, provide a support pathway to help such an offline consumer locate or register an appropriate credential.\n\nFor OTP delivery, a data holder may note, in the authentication flow, that they do not possess the appropriate details to deliver the OTP, along with instructions for how to contact the data holder and register or provide these details, which should be external to the CDR flow.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.23","CX Guideline","Data Holder","MAY","Support pathways should be provided to help consumers who may have forgotten their credentials or may not have the appropriate credentials and/or contact details.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active","2022-05-05"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.24","CX Guideline","Data Holder","MAY","‘Offline customers’ are eligible energy consumers without online access to their energy account(s).\n\nData holders must take reasonable steps to support data sharing for offline customers and must not impose additional eligibility requirements, such as requiring online access prior to data sharing.","CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.1","2022-05-17","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.25","CX Guideline","Data Holder","MAY","Data holders can offer online registration to an offline customer as part of their own processes, but this should be external to the authentication and authorisation flows.","CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.1","2022-05-17","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.26","Common Standard","Data Holder","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication, and Decoupled Authentication is not supported, data holders MUST continue to support the 'Redirect to Web with OTP' flow in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule Standard, Fallback Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.27","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT introduce unwarranted friction into the authentication process.\nIn line with CDR Rule 4.24 on restrictions when asking CDR consumers to authorise disclosure of CDR data, unwarranted friction for authentication flows and methods is considered to include, but is not limited to:\n• The addition of any requirements beyond normal data holder practices for authenticating the consumer, including, but not limited to, One Time Password (OTP) verification code delivery. \n• Providing or requesting additional information beyond normal data holder practices for authenticating the consumer, including, but not limited to, OTP verification code delivery.\n• Offering additional or alternative services.\n• Referencing or including other documents.","Authentication Standards, Common Authentication Standards, Authentication: Friction [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.28","Technical Standard","Data Holder","MUST","A Single LoA value is carried in the acr claim which is described in https://openid.net/specs/openid-connect-core-1_0.html#IDToken of https://consumerdatastandardsaustralia.github.io/standards/#nref-OIDC.\n\n• An LoA of 2 is represented by the URI: urn:cds.au:cdr:2\n  • The authenticators used to attain this level MUST achieve Single Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL1' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Levels of Assurance (LoAs), Single Ordinal [https://consumerdatastandardsaustralia.github.io/standards/#levels-of-assurance-loas]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.29","CX Standard","Data Holder","MAY","Data holders MAY invite consumers using ‘Redirect to Web’ flows to install the data holder app used for the purposes of CDR authentication. This invitation MUST NOT introduce unwarranted friction.","Authentication Standards, Common Authentication Standards, Authentication: App Install [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.30","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder MUST request a user identifier in accordance with https://consumerdatastandardsaustralia.github.io/standards/#user-identifiers.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.31","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.32","Technical Standard","Data Holder","MUST NOT","The following credential constraints apply such that Authenticators:\n• MUST NOT permit Memorised Secrets defined by https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation to achieve 'LoA 2' (as a single factor of authentication only).","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.33","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\n\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.34","CX Guideline","Data Holder","MAY","Data holders may use alternative methods for authentication in accordance with the relevant standards for https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.35","CX Guideline","Data Holder","MAY","A user with valid credentials that is not authorised to share data should still be able to successfully authenticate. This may include a user that not a nominated representative, or is otherwise ineligible to share data. In this situation, the user should be able to successfully authenticate before seeing details in the authorisation flow outlining that they cannot share data, which may include a list of unavailable accounts and instructions on how to gain the ability to share data. A user that is ineligible or not a nominated representative should not fail at the point of authentication where they otherwise have valid credentials and meet the necessary criteria to successfully authenticate.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.36","CX Guideline","Data Holder","MAY","When the ‘Redirect to Web with OTP’ flow is used, the ‘App Install’ CX Standard allows data holders to prompt users to install their app for the purposes of CDR authentication. \n\nThis may be achieved via a banner, included in the footer, included in OTP delivery, or shared to a user's contact details following the completion of authentication, for example. \n\nThe delivery channel and method for any additional invitations are at the discretion of the data holder. The exact wording of the message provided in the Redirect to Web flow is also at the data holder's discretion. However, data holders should avoid including links that could unnecessary friction or trigger phishing concerns.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.35.0","2025-09-22","Active"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.37","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.36.0","2026-03-18","Active"]
["2AU. Redirect to Web with OTP","01. User identifier","2AU.01.07","Technical Standard","Data Holder","MUST","If a data holder requests a user identifier for the purposes of identifying the customer during authentication, then the data holder:\n• MUST request a user identifier that can uniquely identify the customer.\n• MUST request a user identifier that is already known by the customer in the redirected page.","Security Profile, Credential Requirements, User Identifiers [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","01. User identifier","2AU.01.20","CX Guideline","Data Holder","MAY","Data holders should use a user identifier that is consistent and familiar with their existing digital channel experiences and use terminology that aligns with the intended sector. Some example user identifiers are email address, user name, mobile number and customer ID.",null,"Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","01. User identifier","2AU.01.21","CX Guideline","Data Holder","MAY","User identifiers need to be unique to each single eligible CDR consumer. Data holders should aim to do this by using identifiers unique to each customer (e.g. Customer IDs for the banking sector) and/or verifying the consumer has primary access to their device/service (e.g. mobile number or email address).\n\nUser identifiers need to be registered and verified external to the CDR authentication flow. If the consumer changes their primary access identifier (e.g. email address), data holders need to verify that the consumer is the intended user of that identifier before changing it (e.g. verifying email with an activation link).\n\nData holders considering suitable user identifiers should exclude any identity attributes that are shared across two or more people or cannot be registered as a verified claim for only one person.","Security Profile: Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.16.0","2022-02-25","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.05","CX Standard","Data Holder","MUST","Data holders MUST communicate the expiry period of the OTP to the consumer in the authentication flow.","Authentication Standards, Redirect to Web with OTP, Authentication: OTP Expiry [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 12, 27 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.08","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The provided OTP MUST be invalidated after a period of time at the discretion of the data holder. This expiry period SHOULD facilitate enough time for the customer to reasonably complete the authorisation process.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements] | CDR Rule 4.24 | CX Research 12, 27 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.10","Technical Standard","Data Holder","MUST","Data Holders MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.11","Technical Standard","Data Holder","SHOULD","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page. \n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.12","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder SHOULD implement additional controls to minimise the risk of interception of the OTP through the selected delivery mechanism.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.13","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The provided OTP MUST be numeric digits and be between 4 and 6 digits in length.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.14","Technical Standard","Data Holder","SHOULD","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The algorithm for the creation of the OTP is at the discretion of the data holder but SHOULD incorporate a level of pseudo-randomness appropriate for the use case.\n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.15","Technical Standard","Data Holder","MUST NOT","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The delivery mechanism for the OTP is at the discretion of the data holder, but MUST align to existing and preferred channels for the customer. \n\nNB: This is a subset of the Technical Standard referenced. ","Security Profile: Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows] | CDR Rule 4.24 | CX Research 12, 27 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.19","CX Guideline","Data Holder","MAY","Data holders should include functionality that allows a consumer to request that a One Time Password be resent.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/] | Decision Proposal 127 [https://github.com/ConsumerDataStandardsAustralia/standards/issues/127]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.5.1","2020-12-18","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.01","Common Standard","Data Holder","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication, and Decoupled Authentication is not supported, data holders MUST continue to support the 'Redirect to Web with OTP' flow in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule Standard, Fallback Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.02","Common Standard","Data Holder","MUST","If a data holder provides an app, the data holder MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data holders MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data holders subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.03","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipient [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.04","Common Standard","Data Holder","MAY","Where Redirect to App is unable to be used for the purposes of CDR authentication:\n• Data recipients MAY provide decoupled consent experiences that facilitate separation of the Consumption Device from the authorisation flow.\n• Data holders MAY provide decoupled authorisation experiences that facilitate separation of the Consumption Device from the Authentication Device.\n\nIf implemented, data holders and data recipients MUST support decoupled authentication in accordance with any relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule, Decoupled Authentication [https://consumerdatastandardsaustralia.github.io/standards/#decoupled-authentication]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.05","CX Standard","Data Holder","MUST NOT","Where a data holder implements Redirect to App, the authentication flow and method MUST NOT involve more steps than the consumer would reasonably encounter when logging in to the data holder’s app for non-CDR purposes, unless otherwise specified in the data standards.","Authentication Standards, Redirect to App, Authentication: Steps [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.06","Technical Standard","Data Holder","MUST","Data holders MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data holders MUST use a single issuer identifier per app.\n• Data holders MUST only support Authorization Code Flow for Redirect to App authentication.\n• Data holders MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252.\n• After authentication, the data holder MUST continue the authorisation flow within the data holder app.\n• Data holders SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.","Security Profile, Authentication Flows, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.07","Technical Standard","Data Holder","MUST NOT","The following credential constraints apply such that Authenticators:\n• MUST NOT permit Memorised Secrets defined by https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation to achieve 'LoA 2' (as a single factor of authentication only).","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.08","Technical Standard","Data Holder","MUST","A Single LoA value is carried in the acr claim which is described in https://openid.net/specs/openid-connect-core-1_0.html#IDToken of https://consumerdatastandardsaustralia.github.io/standards/#nref-OIDC.\n\n• An LoA of 2 is represented by the URI: urn:cds.au:cdr:2\n  • The authenticators used to attain this level MUST achieve Single Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL1' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 3 is represented by the URI: urn:cds.au:cdr:3\n  • The authenticators used to attain this level MUST achieve Multi-Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL2' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 4 is represented by the URI: urn:cds.au:cdr:4\n  • The authenticators used to attain this level MUST conform with the Authentication Level 'AL3' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n\nREAD operations SHALL only be allowed where at least an LoA of 2 has been achieved during the establishment of consent.\n\nWRITE operations SHALL only be allowed where:\n• At least an LoA of 3 has been achieved during the establishment of consent, or\n• At least an LoA of 2 has been achieved during the establishment of consent and a subsequent challenge/response has resulted in an LoA of 3 being achieved within the lifespan of the current Access Token.","Security Profile, Levels of Assurance (LoAs), Single Ordinal [https://consumerdatastandardsaustralia.github.io/standards/#levels-of-assurance-loas]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.09","CX Standard","Data Holder","MUST","When the authorisation flow is presented to the consumer in a data holder app, the data holder MUST provide consumers with the ability to switch or add user profiles based on the profiles supported by that app.","Authorisation Standards, Authorisation: Add or Switch Profiles [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.10","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.11","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.12","Technical Standard","Data Recipient","MUST","Data recipients MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data recipients MUST register separate Redirect URIs where they provide both app-based and web-based redirection.\n• If data recipients initiate consent from an app, they MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252 for their app Redirect URI.","Security Profile, Authentication Flows, Redirect to App, Data Recipient [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.13","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT introduce unwarranted friction into the authentication process.\nIn line with CDR Rule 4.24 on restrictions when asking CDR consumers to authorise disclosure of CDR data, unwarranted friction for authentication flows and methods is considered to include, but is not limited to:\n• The addition of any requirements beyond normal data holder practices for authenticating the consumer, including, but not limited to, One Time Password (OTP) verification code delivery. \n• Providing or requesting additional information beyond normal data holder practices for authenticating the consumer including, but not limited to, OTP verification code delivery.\n• Offering additional or alternative services.\n• Referencing or including other documents.","Authentication Standards, Common Authentication Standards, Authentication: Friction [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.14","CX Standard","Data Holder","MAY","Data holders MAY invite consumers using ‘Redirect to Web’ flows to install the data holder app used for the purposes of CDR authentication. This invitation MUST NOT introduce unwarranted friction.","Authentication Standards, Common Authentication Standards, Authentication: App Install [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.15","CX Standard","Data Holder","MUST NOT","Data holders MUST NOT include forgotten details links in redirect screens.","Authentication Standards, Redirect to Web with OTP, Authentication: Password Link [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.16","Technical Standard","Data Holder","MUST","Where a data holder supports the ‘Redirect to Web with OTP’ flow:\n• The data holder MUST request a user identifier in accordance with https://consumerdatastandardsaustralia.github.io/standards/#user-identifiers.\n• The data holder MUST provide a one-time password (OTP) to the customer through an existing channel or mechanism that the customer can then enter into the redirected page. \n• The delivery mechanism for the OTP is at the discretion of the data holder, but MUST align to existing and preferred channels for the customer. \n• The data holder SHOULD implement additional controls to minimise the risk of interception of the OTP through the selected delivery mechanism.\n• The provided OTP MUST only be used for authentication for CDR based sharing and MUST NOT be usable for the authorisation of other transactions or actions.\n• The provided OTP MUST be invalidated after a period of time at the discretion of the data holder. This expiry period SHOULD facilitate enough time for the customer to reasonably complete the authorisation process.\n• The provided OTP MUST be numeric digits and be between 4 and 6 digits in length.\n• The algorithm for the creation of the OTP is at the discretion of the data holder but SHOULD incorporate a level of pseudo-randomness appropriate for the use case.\n• The data holder SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.","Security Profile, Credential Requirements, One Time Password Credential Requirements [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.17","CX Standard","Data Holder","MUST","Data holders MUST communicate the expiry period of the OTP to the consumer in the authentication flow.","Authentication Standards, Redirect to Web with OTP, Authentication: OTP Expiry [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.18","CX Guideline","Data Holder","MAY","CDR Participants may choose to voluntarily implement Redirect to App before the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations of 10 May 2027.\nIf implemented prior to this date, they will also need to meet other relevant standards, including https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows, unless otherwise stated.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.19","CX Guideline","Data Holder","MAY","In line with existing practices, a data holder may provide functionality that allows a consumer to add, register, or switch profiles prior to, or after, authentication.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU0. Fallback Authentication Framework","00. Fallback Authentication Framework","2AU0.00.20","CX Guideline","Data Holder","MAY","Where a consumer has not logged into the app before, or has been logged out, the data holder may require them to log in using a username and password as per their existing practices. Where this occurs, the data holder must still have regard for the standard that prohibits memorised secrets being relied upon as a single factor for the purposes of sharing CDR data.","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/fallback-authentication-framework","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.01","Common Standard","Data Holder","MUST","Where Redirect to App is unable to be used for the purposes of CDR authentication, and Decoupled Authentication is not supported, data holders MUST continue to support the 'Redirect to Web with OTP' flow in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards.","Authentication Schedule Standard, Fallback Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.02","Common Standard","Data Holder","MUST","If a data holder provides an app, the data holder MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data holders MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data holders subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.03","Common Standard","Data Recipient","MUST","Data recipients MUST implement Redirect to App in accordance with the relevant https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile standards. Data recipients MAY implement Redirect to App ahead of the date specified in the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations schedule.\n\nNote: As per the future dated obligation schedule, data recipients subject to this standard are required to implement Redirect to App on and from 10 May 2027.","Authentication Schedule, Redirect to App, Data Recipients [https://consumerdatastandardsaustralia.github.io/standards/#redirect-to-app]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.04","CX Standard","Data Holder","MUST NOT","Where a data holder implements Redirect to App, the authentication flow and method MUST NOT involve more steps than the consumer would reasonably encounter when logging in to the data holder’s app for non-CDR purposes, unless otherwise specified in the data standards.","Authentication Standards, Redirect to App, Authentication: Steps [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.05","Technical Standard","Data Holder","MUST","Data holders MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data holders MUST use a single issuer identifier per app.\n• Data holders MUST only support Authorization Code Flow for Redirect to App authentication.\n• Data holders MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252.\n• After authentication, the data holder MUST continue the authorisation flow within the data holder app.\n• Data holders SHOULD implement additional controls to minimise the risk of enumeration attacks via the redirect page.","Security Profile, Authentication Flows, Redirect to App, Data Holders [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.06","Technical Standard","Data Holder","MUST NOT","The following credential constraints apply such that Authenticators:\n• MUST NOT permit Memorised Secrets defined by https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation to achieve 'LoA 2' (as a single factor of authentication only).","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.07","Technical Standard","Data Holder","MUST","A Single LoA value is carried in the acr claim which is described in https://openid.net/specs/openid-connect-core-1_0.html#IDToken of https://consumerdatastandardsaustralia.github.io/standards/#nref-OIDC.\n\n• An LoA of 2 is represented by the URI: urn:cds.au:cdr:2\n  • The authenticators used to attain this level MUST achieve Single Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL1' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 3 is represented by the URI: urn:cds.au:cdr:3\n  • The authenticators used to attain this level MUST achieve Multi-Factor Authentication as defined in https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule.\n  • The authenticators used to attain this level MAY conform with the Authentication Level 'AL2' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n• An LoA of 4 is represented by the URI: urn:cds.au:cdr:4\n  • The authenticators used to attain this level MUST conform with the Authentication Level 'AL3' rules specified under the Digital ID Accreditation Data Standards https://consumerdatastandardsaustralia.github.io/standards/#nref-DigitalID-Accreditation Authentication Levels (Chapter 2) requirements.\n\nREAD operations SHALL only be allowed where at least an LoA of 2 has been achieved during the establishment of consent.\n\nWRITE operations SHALL only be allowed where:\n• At least an LoA of 3 has been achieved during the establishment of consent, or\n• At least an LoA of 2 has been achieved during the establishment of consent and a subsequent challenge/response has resulted in an LoA of 3 being achieved within the lifespan of the current Access Token.","Security Profile, Levels of Assurance (LoAs), Single Ordinal [https://consumerdatastandardsaustralia.github.io/standards/#levels-of-assurance-loas]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.08","CX Standard","Data Holder","MUST","When the authorisation flow is presented to the consumer in a data holder app, the data holder MUST provide consumers with the ability to switch or add user profiles based on the profiles supported by that app.","Authorisation Standards, Authorisation: Add or Switch Profiles [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.09","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\n\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.10","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.11","Technical Standard","Data Recipient","MUST","Data recipients MUST support Redirect to App in accordance with the https://consumerdatastandardsaustralia.github.io/standards/#authentication-schedule, and:\n• Data recipients MUST register separate Redirect URIs where they provide both app-based and web-based redirection.\n• If data recipients initiate consent from an app, they MUST support Claimed \"https\" Scheme URI redirection in accordance with https://datatracker.ietf.org/doc/html/rfc8252#section-7.2 and https://datatracker.ietf.org/doc/html/rfc8252#section-8 of https://consumerdatastandardsaustralia.github.io/standards/#nref-RFC8252 for their app Redirect URI.","Security Profile, Authentication Flows, Redirect to App, Data Recipient [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.12","CX Guideline","Data Holder","MAY","CDR Participants may choose to voluntarily implement Redirect to App before the https://consumerdatastandardsaustralia.github.io/standards/#future-dated-obligations of 10 May 2027.\nIf implemented prior to this date, they will also need to meet other relevant standards, including https://consumerdatastandardsaustralia.github.io/standards/#fallback-authentication-flows, unless otherwise stated.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.13","CX Guideline","Data Holder","MAY","In line with existing practices, a data holder may provide functionality that allows a consumer to add, register, or switch profiles prior to, or after, authentication.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.14","CX Guideline","Data Holder","MAY","Data holders may use alternative methods for authentication in accordance with the relevant standards for https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_authentication-standards and https://consumerdatastandardsaustralia.github.io/standards/#security-profile.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.15","CX Guideline","Data Holder","MAY","Where a consumer has not logged into the app before, or has been logged out, the data holder may require them to log in using a username and password as per their existing practices. Where this occurs, the data holder must still have regard for the standard that prohibits memorised secrets being relied upon as a single factor for the purposes of sharing CDR data.","Security Profile, Credential Requirements, Restricted Credentials [https://consumerdatastandardsaustralia.github.io/standards/#credential-requirements]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.16","CX Guideline","Data Holder","MAY","In the instance a user installs a data holder app, or is logged out after a session, data holders are permitted to require users to log in with their user ID and password. This guideline should be considered in conjunction with the https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_common-authentication-standards.",null,"Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.35.0","2025-09-22","Active"]
["2AU1. Redirect to App","00. Redirect to App - general","2AU1.00.17","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authenticate: https://cx.dsb.gov.au/authenticate/redirect-to-app","1.36.0","2026-03-18","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.01","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(a) subject to subrule (2), the name of the accredited person that made the request;","CDR Rule 4.23(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.02","CDR Rule","Data Holder","MUST NOT","When asking a CDR consumer to authorise the disclosure of CDR data or to amend a current authorisation, the data holder must not do any of the following:\n(a) add any requirements to the authorisation process beyond those specified in the data standards and these rules;\n(b) provide or request additional information during the authorisation process beyond that specified in the data standards and these rules;\n(c) offer additional or alternative services as part of the authorisation process;\n(d) include or refer to other documents.","CDR Rule 4.24","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.28","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","00. Authorise - general","3AU.00.30","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.36.0","2026-03-18","Active"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.12","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.25","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.16.0","2022-03-17","Active"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.27","CX Standard","Data Holder","MAY","Data holders MAY include additional functionality to support account discovery and selection where further navigation or interaction is required to view all accounts. This may, for example, include search, sort, filter, scroll, grouping, and pagination, or other controls in line with existing consumer experiences. Any such functionality MUST NOT introduce unwarranted friction. \n\nNote: Unwarranted friction should have regard to CDR Rule 4.24 and is considered to include the addition of any requirements beyond normal data holder practices for an equivalent account selection process.","Authorisation Standards, Authorisation: Account selection functionality [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.03","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(c) the types of CDR data for which the data holder is seeking an authorisation to disclose;","CDR Rule 4.23(1)(c)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.04","CDR Rule","Data Holder, Data Recipient","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(b) the period of time to which the CDR data that was the subject of the request relates;","CDR Rule 4.23(1)(b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.05","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(e) if authorisation is being sought for disclosure over a period of time―what that period is;","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.06","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(d) whether the authorisation is being sought for:\n(i) disclosure of CDR data on a single occasion; or\n(ii) disclosure of CDR data over a period of time of not more than 12 months;\n\nNote: While certain consents by a CDR business consumer can have a period of 7 years, a corresponding authorisation cannot be for more than 12 months before renewal under subparagraph (1)(d)(ii).","CDR Rule 4.23(1)(d)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-02-22"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.07","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(f) a statement that, at any time, the authorisation can be withdrawn;","CDR Rule 4.23(1)(f) | CX Research 30, 32 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.08","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(g) instructions for how the authorisation can be withdrawn.","CDR Rule 4.23(1)(g) | CX Research 30, 32 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.09","CDR Rule","Data Holder","MUST","(1) A CDR consumer who has given an authorisation to a data holder to disclose particular CDR data to an accredited person may withdraw the authorisation at any time:\n(a) by using the data holder’s consumer dashboard; or\n(b) by using a simple alternative method of communication to be made available by the data holder for that purpose.","CDR Rule 4.25(1) | CX Research 30, 32 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-02-22"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.10","CDR Rule","Data Holder","MUST","(2) If the withdrawal was in accordance with paragraph (1)(b), the data holder must give effect to the withdrawal as soon as practicable, and in any case within 2 business days after receiving the communication.\n\nNote: This subrule is a civil penalty provision (see rule 9.8).","CDR Rule 4.25(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2024-02-22"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.11","CDR Rule","Data Holder","MUST","For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.","CDR Rule 7.2(8)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.13","CX Standard","Data Holder","MUST","Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. \n\nThe data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account confirm [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.14","CX Standard","Data Holder","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-24"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.15","CX Guideline","Data Holder","MAY","CDR Rules 4.23(1)(a) and (2) require data holders to refer to the accredited person's name using the legal entity name held in the Register during Authorisation.","CDR Rule 4.23(1)(a) and (2) | 10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.16","CX Guideline","Data Holder","MAY","Data holders can meet CX Standard on Authorisation: Account confirm with the account selection step only. The selected accounts do not need to be displayed again on the final confirmation page.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.17","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(b) requires data holders to give consumers information about the historical range of data that may be accessed under the authorisation.\nThe historical range of consumer data a data holder may disclose can be:\n• up to 2 years, as required by the rules; \n• a shorter historical period, for example, if the consumer became a customer more recently or if the account was opened more recently (except in the energy sector, where LCCD requirements apply. See Energy sector information below); or \n• a longer historical period, such as the earliest holding date or a more recent date, which may be applicable if the data holder chooses to provide additional historical data voluntarily.\n\nNote 1: If historical ranges differ across datasets — for example, if one dataset goes back to 1 April 2023 and another dataset goes back to 30 August 2023 — then the data holder may consider either:\n• showing the specific historical range for each dataset, as demonstrated in the CX Guidelines, or \n• displaying the earliest historical date across all datasets (in this example, 1 April 2023). \n\nNote 2: The technical standards allow data recipients to limit how much historic data is collected when calling the relevant APIs using the oldest-time or oldest-date fields. Data holders must use these fields to constrain the data that they disclose. Data holders should be mindful of the fact that data recipients may wish to collect more or less historical data than the data holder makes available when developing wording to meet the requirements of rule 4.23(1)(b). The precise wording is at the data holder's discretion, but may consider, for example:\nThis may include historical data that dates back [n years / to date], depending on your agreement with [ADR].\n\nBanking and Non-Bank Lender sector\nData holders must also refer to Subclauses 3.2(6) and (7) of Schedule 3. For open accounts, data holders must share a historical range of up to 2 years before the request date for transaction data, and up to 13 months for account data related to an authorisation for direct debit data. Data holders may voluntarily share older data. For closed accounts, if the relevant account is closed on the request date, CDR data, including historical data, related to that account is not considered required consumer data but can be shared voluntarily by the data holders.\n\nEnergy sector\nData holders must also refer to Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4. The last 2 years of billing data for a relevant account is required consumer data.\n'Electricity usage’ energy data language data cluster — which pertains to metering data held by AEMO, as per clause 1.2–1.3(4) of Schedule 4 — is available for up to 2 years before the request date. This includes usage data for the duration that a customer has been the account holder for the given NMI, including any time before they became a customer of their current retailer.","CDR Rule 4.23(1)(b); Subclauses 3.2(6) and (7) of Schedule 3; Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4 | Technical Standards: Banking APIs, oldest-time field [https://consumerdatastandardsaustralia.github.io/standards/#banking-apis]; Energy APIs, oldest-date field [https://consumerdatastandardsaustralia.github.io/standards/index.html?examples#cdr-energy-api_get-usage-for-service-point] | CDR Support Portal: Historical transaction data: Earliest Holding Day [https://cdr-support.zendesk.com/hc/en-us/articles/10085678783759-Historical-transaction-data-Earliest-Holding-Day]; Guidance on Energy Last Consumer Change Date (LCCD) [https://cdr-support.zendesk.com/hc/en-us/articles/12444620614799-Guidance-on-Energy-Last-Consumer-Change-Date-LCCD]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2025-09-24"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.18","CX Guideline","Data Holder","MAY","Data holders should use plain language phrases such as 'stop sharing' to refer to how a consumer can withdraw authorisation.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.19","CX Guideline","Data Holder","MAY","In addition to providing withdrawal instructions, data holders should provide instructions for how to review sharing arrangements.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.20","CX Guideline","Data Holder","MAY","Data holders should include their CDR policy in the Authorisation flow.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.21","CX Guideline","Data Holder","MAY","Data holders should use terms that align with equivalent authorisation actions already in use in their digital experiences. The chosen language should clearly communicate a final affirmative action to mitigate user error. CX research suggests that terms like 'confirm' and 'authorise' successfully and meaningfully communicate the final affirmative action.","10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.22","CX Guideline","Data Holder","MAY","Data holders should redirect the consumer back to the data recipient following the final affirmative action.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.23","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data.\n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nThe CDR receipt should be given in writing and available through the data holder consumer dashboard.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.24","CX Standard","Data Holder","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-24"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.26","CDR Rule","Data Holder","MUST","If an authorisation to disclose particular CDR data to an accredited person is withdrawn or otherwise expires, the data holder must notify the accredited person in accordance with the data standards.\nNote: This rule is a civil penalty provision (see rule 9.8).","CDR Rule 4.26A","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.29.0","2024-02-22","Active"]
["3AU. Authorisation to disclose","02. Confirmation","3AU.02.29","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(e) requires data holders to state the forward-looking time period where the authorisation is sought for the disclosure of CDR data. This cannot be more than 12 months.","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.01","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.02","CX Standard","Data Holder","MUST","If certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.\n\nData holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nData holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nNote: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.","Authorisation Standards, Unavailable Accounts: Displaying accounts  [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.03","CX Guideline","Data Holder","MAY","In accordance with the Unavailable Accounts: Displaying accounts standard, data holders should display unavailable accounts as part of the account selection step, with an explanation of why these are unable to be shared. \n\nWhere data holders are unable to display unavailable accounts, they may instead provide a generic explanation for unspecified accounts, in accordance with the Unavailable Accounts: No accounts can be shown standard.\n\nUnavailable accounts may include accounts that are not in scope for data sharing under CDR, accounts for which data sharing is voluntary, or where a data holder deems it necessary to prevent financial harm or abuse.\n\nDespite being unavailable, data holders are recommended to show these accounts to avoid confusion and align with consumer expectations.\n\nFor further detail about covered products and required and voluntary CDR data, refer to the https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors.","CDR Rules Clause 3.2 of Schedule 3; Clause 3.2 of Schedule 4 | Authorisation Standards, Unavailable Accounts: Displaying accounts [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]; Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | ACCC Compliance guide for data holders in the banking and non-bank lender sectors [https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2025-09-24"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.04","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.06","CX Standard","Data Holder","MAY","If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.07","CX Guideline","Data Holder","MAY","If an account holder has not given a secondary user instruction for an account with a secondary user, that account will appear as unavailable to the secondary user.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.08","CX Guideline","Data Holder","MAY","The request function is optional but permitted under the standards. It can be presented within the authorisation flow or elsewhere, at the data holder’s discretion.\n\nThis functionality would allow non-nominated persons or secondary users without sharing rights to request access. This could alert the account owner(s) or administrator(s) of the steps required to grant sharing rights, leading them to the relevant services for managing secondary users or nominated representatives.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active","2025-09-24"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.09","CX Guideline","Data Holder","MAY","Data holders should provide clear explanations to consumer about why their accounts are unavailable.\n\nThese explanations should only reference account types that the consumer holds, and should be contextually shown in relation to the account where possible.\n\nData holders should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","03a. Unavailable accounts - Unavailable accounts cannot be shown","3AU.03a.01","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","03a. Unavailable accounts - Unavailable accounts cannot be shown","3AU.03a.02","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03a. Unavailable accounts - Unavailable accounts cannot be shown","3AU.03a.03","CX Guideline","Data Holder","MAY","In accordance with the Unavailable Accounts: Displaying accounts standard, data holders should display unavailable accounts as part of the account selection step, with an explanation of why these are unable to be shared. \n\nWhere data holders are unable to display unavailable accounts, they may instead provide a generic explanation for unspecified accounts, in accordance with the Unavailable Accounts: No accounts can be shown standard.\n\nUnavailable accounts may include accounts that are not in scope for data sharing under CDR, accounts for which data sharing is voluntary, or where a data holder deems it necessary to prevent financial harm or abuse.\n\nDespite being unavailable, data holders are recommended to show these accounts to avoid confusion and align with consumer expectations.\n\nFor further detail about covered products and required and voluntary CDR data, refer to the https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors.","CDR Rules Clause 3.2 of Schedule 3; Clause 3.2 of Schedule 4 | Authorisation Standards, Unavailable Accounts: Displaying accounts [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]; Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | ACCC Compliance guide for data holders in the banking and non-bank lender sectors [https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2025-09-24"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.01","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.02","CX Standard","Data Holder","MAY","If a successfully authenticated user cannot proceed to establish an authorisation in accordance with the rules on eligible consumers and required consumer data, data holders MAY provide the option of concluding the authorisation process.","Authorisation Standards, Unavailable Accounts: Authorisation not permitted [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.03","CX Standard","Data Holder","MAY","If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.04","CX Guideline","Data Holder","MAY","Some scenarios may result in a user without sharing rights not seeing any accounts in the account selection step. Data holders may provide a generic explanation and instructions in place of the account selection step and/or unavailable account pattern.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.05","CX Guideline","Data Holder","MAY","Data holders should provide additional information to help users without sharing rights understand how they might gain sharing rights. This may, for example, state that the account owner has to grant them sharing rights before data sharing can occur. Similarly, data holders may include instructions for how to request sharing rights from the account owner(s) or administrator if that functionality is provided by the data holder.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.06","CX Guideline","Data Holder","MAY","If no accounts can be shown, data holders should provide a message to consumers confirming that data will not be shared during this process.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.07","CX Guideline","Data Holder","MAY","Some scenarios may result in a user without sharing rights not seeing any accounts in the account selection step. A data holder may choose to provide optional functionality to allow a user without sharing rights to send a request to the account owner(s) or administrators from the authorisation flow.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.08","CX Guideline","Data Holder","MAY","The request function is optional but permitted under the standards. It can be presented within the authorisation flow or elsewhere, at the data holder’s discretion.\n\nThis functionality would allow non-nominated persons or secondary users without sharing rights to request access. This could alert the account owner(s) or administrator(s) of the steps required to grant sharing rights, leading them to the relevant services for managing secondary users or nominated representatives.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active","2025-09-24"]
["3AU. Authorisation to disclose","03b. Unavailable accounts - No accounts can be shown","3AU.03b.09","CX Guideline","Data Holder","MAY","If a data holder provides the optional request functionality and a user acts upon it, the data holder should provide a message to confirm that the request has been sent. This message should be clearly visible and shown as soon as the action has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Active"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.01","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.02","CX Standard","Data Holder","MUST","Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. The data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account confirm [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.03","CX Guideline","Data Holder","MAY","Where a consumer only has one account, data holders can meet CX Standards for Authorisation by omitting the account selection step and only displaying the account on the final confirmation page.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.01","CX Standard","Data Holder","MAY","Data holders MAY add a 'profile selection' step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts.\n\nThe 'profile selection' step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).","Authorisation Standards, Authorisation: Profile selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-16"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.02","CX Standard","Data Holder","MAY","Data holders MAY include additional functionality to support account discovery and selection where further navigation or interaction is required to view all accounts. This may, for example, include search, sort, filter, scroll, grouping, and pagination, or other controls in line with existing consumer experiences. Any such functionality MUST NOT introduce unwarranted friction. \n\nNote: Unwarranted friction should have regard to CDR Rule 4.24 and is considered to include the addition of any requirements beyond normal data holder practices for an equivalent account selection process.","Authorisation Standards, Authorisation: Account selection functionality [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.03","CX Guideline","Data Holder","MAY","These artefacts show an example implementation of selection functionality, which may or may not be suitable in every situation. Data holders should use their discretion and implement the most appropriate options for their use cases.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.04","CX Guideline","Data Holder","MAY","Data holders should allow consumers to search, sort, filter and select their accounts in a way that is aligned to the outcomes consumers are seeking.\n\nFor example, a consumer may want to search, sort, and filter by nicknames, account numbers, account type, or other elements the account may refer to such as any related plans, services, properties, numbers, and products.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.05","CX Guideline","Data Holder","MAY","If enhanced selection functionality is implemented alongside pagination, filter or search, data holders should consider consumer expectations, technical feasibility and their existing user experiences. \n\nData holders should provide feedback to users to:\n• Prevent errors- This ensures the system aligns with user expectations. For example, if “Select all” applies only to the current page, this limitation should be clearly communicated to avoid misunderstandings.\n• Minimise cognitive load- Users shouldn’t have to manually track selections across multiple pages.\n\nOffering selection options like “Select all [n] accounts on this page,” “Select all [n] accounts on all pages,” and “Select none” helps ensure clarity and simplifies bulk actions.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World, Error Prevention, Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.06","CX Guideline","Data Holder","MAY","If scrolling is required to view the total number of accounts, data holders should allow consumers to search and filter their accounts in a way that is aligned to the outcomes consumers are seeking.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.32.0","2024-12-10","Active"]
["3AU. Authorisation to disclose","05. Selection functionality","3AU.05.07","CX Standard","Data Holder","MUST","When the authorisation flow is presented to the consumer in a data holder app, the data holder MUST provide consumers with the ability to switch or add user profiles based on the profiles supported by that app.","Authorisation Standards, Authorisation: Add or Switch Profiles [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","05. Selection functionality (3)","3AU.05.08","CX Guideline","Data Holder","MUST","In line with existing practices, a data holder may provide functionality that allows a consumer to add, register, or switch profiles prior to, or after, authentication.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","05. Selection functionality (2)","3AU.05.09","CX Guideline","Data Holder","MUST","Data holders may present the profile selection step at different points in the authorisation process, depending on the authentication flow. For example, it may occur after authentication for Redirect to Web flows, or when switching or adding users for in-app authorisation flows.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.35.0","2025-09-24","Active"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.01","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(e) if authorisation is being sought for disclosure over a period of time―what that period is;","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.02","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(d) whether the authorisation is being sought for:\n(i) disclosure of CDR data on a single occasion; or\n(ii) disclosure of CDR data over a period of time of not more than 12 months;\n\nNote: While certain consents by a CDR business consumer can have a period of 7 years, a corresponding authorisation cannot be for more than 12 months before renewal under subparagraph (1)(d)(ii).","CDR Rule 4.23(1)(d)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-02-22"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.03","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is absent or 0, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nData holders may consider communicating the sharing period as a single disclosure instance, but the phrasing is at the discretion of the data holder.","Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","06. Duration","3AU.06.04","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is greater than 0 but less than 24 hours, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nData holders may consider communicating the sharing period as a single disclosure instance occurring within a specific timeframe, but the phrasing is at the discretion of the data holder.","Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","07. Layout variation","3AU.07.01","CX Guideline","Data Holder","MAY","Data holders should align the authorisation flow to their design systems and/or experience languages to facilitate familiar, intuitive, and trustworthy authorisations",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","08. Cancellation","3AU.08.01","CX Guideline","Data Holder","MAY","Data holders should outline the consequences of choosing to cancel throughout the authentication and authorisation process.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active"]
["3AU. Authorisation to disclose","08. Cancellation","3AU.08.02","CX Guideline","Data Holder","MAY","If a consumer cancels at some point in the Consent Flow, CDR participants should confirm that data was not or will not be shared.\n\nThe CDR receipt should be given in writing.","CX Workshop: Error handling [https://miro.com/app/board/o9J_khmXIzU=/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Active","2022-03-16"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.01","CDR Rule","Data Holder","MUST","(1) If a data holder has received a notice under rule 4.18C or 4.20S, the data holder must, in accordance with this Division, invite the CDR consumer to amend the authorisation to disclose CDR data accordingly.","CDR Rule 4.22A(1)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2024-02-22"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.02","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(a) subject to subrule (2), the name of the accredited person that made the request;","CDR Rule 4.23(1)(a)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.03","CDR Rule","Data Holder","MUST NOT","When asking a CDR consumer to authorise the disclosure of CDR data or to amend a current authorisation, the data holder must not do any of the following:\n(a) add any requirements to the authorisation process beyond those specified in the data standards and these rules;\n(b) provide or request additional information during the authorisation process beyond that specified in the data standards and these rules;\n(c) offer additional or alternative services as part of the authorisation process;\n(d) include or refer to other documents.","CDR Rule 4.24","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.16","CX Guideline","Data Holder","MAY","CDR Rules 4.23(1)(a) and (2) require data holders to refer to the accredited person's name using the legal entity name held in the Register during Authorisation.","CDR Rule 4.23(1)(a) and (2) | 10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.27","CX Standard","Data Holder","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that third parties do not need consumer passwords to access CDR data. The exact phrasing of this is at the discretion of the data holder and data recipient.\n\nNote: In this context, 'third parties' refers to entities on the ADR-side and does not include any third parties that the data holder may engage.","Authentication Standards, Common Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","00. Amending authorisation - general","3AU1.00.29","CX Guideline","Data Holder","MAY","Data holders should display the name of the brand receiving the consumer data request. This should match the specified brandName value on the register.","CDR Support Portal: Brands in the CDR ecosystem [https://cdr-support.zendesk.com/hc/en-us/articles/900005881263-Brands-in-the-CDR-ecosystem]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.36.0","2026-03-18","Active"]
["3AU1. Amending Authorisation","01. Account selection","3AU1.01.12","CX Standard","Data Holder","MUST","Where account selection applies, Data Holders MUST pre-select accounts that were associated with the previous authorisation provided these accounts remain eligible and available to share. Data Holders MAY allow these accounts to be amended, and MAY provide information regarding the pre-selection of accounts.","Amending Authorisation Standards, Authorisation: Account Selection [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","01. Account selection","3AU1.01.13","CX Standard","Data Holder","MUST","Data holders MUST show which accounts the data is being shared from prior to confirming authorisation if the data request includes account-specific data. The data holder MAY omit this information if none of the data being requested is specific to an account (e.g. Saved Payees).","Authorisation Standards, Authorisation: Account confirm [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["3AU1. Amending Authorisation","01. Account selection","3AU1.01.26","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.16.0","2021-03-17","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.04","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(c) the types of CDR data for which the data holder is seeking an authorisation to disclose;","CDR Rule 4.23(1)(c)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.05","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(b) the period of time to which the CDR data that was the subject of the request relates;","CDR Rule 4.23(1)(b)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.06","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(e) if authorisation is being sought for disclosure over a period of time―what that period is;","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.07","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(d) whether the authorisation is being sought for:\n(i) disclosure of CDR data on a single occasion; or\n(ii) disclosure of CDR data over a period of time of not more than 12 months;\n\nNote: While certain consents by a CDR business consumer can have a period of 7 years, a corresponding authorisation cannot be for more than 12 months before renewal under subparagraph (1)(d)(ii).","CDR Rule 4.23(1)(d)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2024-02-22"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.08","CDR Rule","Data Holder","MUST","(1) An authorisation to disclose particular CDR data to an accredited person expires at the earliest of the following:\n(g) if the authorisation was for disclosure of CDR data over a specified period—the end of:\n(ii) if the period of the authorisation has been amended in accordance with this Division―that period as last amended;","CDR Rule 4.26(1)(g)(ii)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.09","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(g) instructions for how the authorisation can be withdrawn.","CDR Rule 4.23(1)(g)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.10","CDR Rule","Data Holder","MUST","(1) When asking a CDR consumer to authorise the disclosure of CDR data, or amend a current authorisation, a data holder must give the CDR consumer the following information about the authorisation or amendment:\n(f) a statement that, at any time, the authorisation can be withdrawn;","CDR Rule 4.23(1)(f)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.11","CDR Rule","Data Holder","MUST","For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.","CDR Rule 7.2(8)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.14","CX Standard","Data Holder","MUST","Data Recipients and Data Holders MUST use data language standards to describe data clusters and permissions in consumer-facing interactions. See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for language to be used when requesting banking and non-bank lending data; and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for language to be used when requesting energy data.\n\nData language standards MUST be used when CDR data is being requested, reviewed, or access to such data is withdrawn.\n\nData Recipients and Data Holders MUST use the appropriate data standards language for business consumers as denoted with an '*' for the relevant data.\n\nData Recipients and Data Holders SHOULD expand on the proposed language where appropriate to communicate further details of what is being shared.\n\nAdditional details MAY include additional information in context, such as in-line help or tool tips, and/or additional permissions where they may exist.\n\nExamples of permission details that MAY be used and provided as in-line help are denoted with an '†' for the relevant data.","Data Language Standards: Common, Data Language Standards: Language to be used [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-09-24"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.15","CX Standard","Data Holder","MUST","Data Holders MUST indicate where a dataset is being added to an authorisation or a disclosure duration is being amended. Data Holders MAY apply this standard to other changing attributes, but this MUST ONLY apply where the attribute in the new authorisation differs to that of the previous authorisation. How a changed attributed is signified is at the Data Holder’s discretion.","Amending Authorisation Standards, Authorisation: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.17","CX Guideline","Data Holder","MAY","Data holders can meet CX Standard on Authorisation: Account confirm with the account selection step only. The selected accounts do not need to be displayed again on the final confirmation page.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.18","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(b) requires data holders to give consumers information about the historical range of data that may be accessed under the authorisation.\nThe historical range of consumer data a data holder may disclose can be:\n• up to 2 years, as required by the rules; \n• a shorter historical period, for example, if the consumer became a customer more recently or if the account was opened more recently (except in the energy sector, where LCCD requirements apply. See Energy sector information below); or \n• a longer historical period, such as the earliest holding date or a more recent date, which may be applicable if the data holder chooses to provide additional historical data voluntarily.\n\nNote 1: If historical ranges differ across datasets — for example, if one dataset goes back to 1 April 2023 and another dataset goes back to 30 August 2023 — then the data holder may consider either:\n• showing the specific historical range for each dataset, as demonstrated in the CX Guidelines, or \n• displaying the earliest historical date across all datasets (in this example, 1 April 2023). \n\nNote 2: The technical standards allow data recipients to limit how much historic data is collected when calling the relevant APIs using the oldest-time or oldest-date fields. Data holders must use these fields to constrain the data that they disclose. Data holders should be mindful of the fact that data recipients may wish to collect more or less historical data than the data holder makes available when developing wording to meet the requirements of rule 4.23(1)(b). The precise wording is at the data holder's discretion, but may consider, for example:\nThis may include historical data that dates back [n years / to date], depending on your agreement with [ADR].\n\nBanking and Non-Bank Lender sector\nData holders must also refer to Subclauses 3.2(6) and (7) of Schedule 3. For open accounts, data holders must share a historical range of up to 2 years before the request date for transaction data, and up to 13 months for account data related to an authorisation for direct debit data. Data holders may voluntarily share older data. For closed accounts, if the relevant account is closed on the request date, CDR data, including historical data, related to that account is not considered required consumer data but can be shared voluntarily by the data holders.\n\nEnergy sector\nData holders must also refer to Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4. The last 2 years of billing data for a relevant account is required consumer data.\n'Electricity usage’ energy data language data cluster — which pertains to metering data held by AEMO, as per clause 1.2–1.3(4) of Schedule 4 — is available for up to 2 years before the request date. This includes usage data for the duration that a customer has been the account holder for the given NMI, including any time before they became a customer of their current retailer.","CDR Rule 4.23(1)(b); Subclauses 3.2(6) and (7) of Schedule 3; Subclauses 3.2(2)(b)(iii), (6) and (7) of Schedule 4 | Technical Standards: Banking APIs, oldest-time field [https://consumerdatastandardsaustralia.github.io/standards/#banking-apis]; Energy APIs, oldest-date field [https://consumerdatastandardsaustralia.github.io/standards/index.html?examples#cdr-energy-api_get-usage-for-service-point] | CDR Support Portal: Historical transaction data: Earliest Holding Day [https://cdr-support.zendesk.com/hc/en-us/articles/10085678783759-Historical-transaction-data-Earliest-Holding-Day]; Guidance on Energy Last Consumer Change Date (LCCD) [https://cdr-support.zendesk.com/hc/en-us/articles/12444620614799-Guidance-on-Energy-Last-Consumer-Change-Date-LCCD]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2025-09-24"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.19","CX Guideline","Data Holder","MAY","Data holders should use plain language phrases such as 'stop sharing' to refer to how a consumer can withdraw authorisation.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.20","CX Guideline","Data Holder","MAY","In addition to providing withdrawal instructions, data holders should provide instructions for how to review sharing arrangements.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.21","CX Guideline","Data Holder","MAY","Data holders should include their CDR policy in the Authorisation flow.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.22","CX Guideline","Data Holder","MAY","Data holders should use terms that align with equivalent authorisation actions already in use in their digital experiences. The chosen language should clearly communicate a final affirmative action to mitigate user error. CX research suggests that terms like 'confirm' and 'authorise' successfully and meaningfully communicate the final affirmative action.","10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.23","CX Guideline","Data Holder","MAY","Data holders should redirect the consumer back to the data recipient following the final affirmative action.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.24","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data.\n\nThe receipt should provide the consumer with a record of their sharing arrangement and highlight changes to the authorisation.\n\nThe CDR receipt should be given in writing and available through the data holder consumer dashboard.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.25","CX Standard","Data Holder","MUST","If a scenario requires it, Data Holders and Data Recipients MUST merge and amend Basic and Detailed data cluster and permission language to show that Detailed scopes include Basic data.\n\nData Holders and Data Recipients MUST use the alternative language denoted with an '‡' for the relevant scope(s). See the https://consumerdatastandardsaustralia.github.io/standards/#banking-and-non-bank-lending-language section for banking and non-bank lending data and the https://consumerdatastandardsaustralia.github.io/standards/#energy-language section for energy data.\n\nExample: A Data Recipient presents the Detailed data cluster in a data request to a consumer but does not present the Basic data cluster. The Detailed scope includes Basic data, but this is not apparent to the consumer based on the data cluster language and permissions used for the Detailed scope.","Data Language Standards: Common, Data Language Standards: Detailed scope requests [https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.16.0","2021-03-17","Active","2025-09-24"]
["3AU1. Amending Authorisation","02. Confirmation","3AU1.02.28","CX Guideline","Data Holder","MAY","CDR Rule 4.23(1)(e) requires data holders to state the forward-looking time period where the authorisation is sought for the disclosure of CDR data. This cannot be more than 12 months. \n\nCDR Rule 4.23(1)(e)","CDR Rule 4.23(1)(e)","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","03. Multiple customer profiles","3AU1.03.01","CX Standard","Data Holder","MUST","Where customer profile selection applies, Data Holders  SHOULD omit the profile selection step and assume the customer profile associated with the existing authorisation. Data Holders MAY indicate which profile the authorisation relates to during the authorisation process.","Amending Authorisation Standards, Authorisation: Customer Profile [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active","2022-03-16"]
["3AU1. Amending Authorisation","04. Layout variation","3AU1.04.01","CX Guideline","Data Holder","MAY","Data holders may align the authorisation flow to their design systems and/or experience languages to facilitate familiar, intuitive, and trustworthy authorisations.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.8.0","2021-04-29","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.01","CX Standard","Data Holder","MUST","Where account selection applies, Data Holders MUST pre-select accounts that were associated with the previous authorisation provided these accounts remain eligible and available to share. Data Holders MAY allow these accounts to be amended, and MAY provide information regarding the pre-selection of accounts.","Amending Authorisation Standards, Authorisation: Account Selection [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.02","CX Standard","Data Holder","SHOULD","If certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.\n\nData holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nData holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n\nNote: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.","Authorisation Standards, Unavailable Accounts: Displaying accounts  [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.03","CX Standard","Data Holder","MAY","If unavailable accounts cannot be shown in the account selection step, data holders MAY display a generic explanation and instructions.","Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.04","CX Standard","Data Holder","MAY","If a user does not have sharing rights for a particular account or set of accounts, data holders MAY invite the user to request sharing rights from the authorisation flow. The presentation of this mechanism MUST NOT introduce unwarranted friction as defined in rule 4.24 on restrictions.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.05","CX Guideline","Data Holder","MAY","In accordance with the Unavailable Accounts: Displaying accounts standard, data holders should display unavailable accounts as part of the account selection step, with an explanation of why these are unable to be shared. \n\nWhere data holders are unable to display unavailable accounts, they may instead provide a generic explanation for unspecified accounts, in accordance with the Unavailable Accounts: No accounts can be shown standard.\n\nUnavailable accounts may include accounts that are not in scope for data sharing under CDR, accounts for which data sharing is voluntary, or where a data holder deems it necessary to prevent financial harm or abuse.\n\nDespite being unavailable, data holders are recommended to show these accounts to avoid confusion and align with consumer expectations.\n\nFor further detail about covered products and required and voluntary CDR data, refer to the https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors.","CDR Rules Clause 3.2 of Schedule 3; Clause 3.2 of Schedule 4 | Authorisation Standards, Unavailable Accounts: Displaying accounts [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]; Authorisation Standards, Unavailable Accounts: No accounts can be shown [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | ACCC Compliance guide for data holders in the banking and non-bank lender sectors [https://www.cdr.gov.au/resources/guides/compliance-guide-data-holders-banking-and-non-bank-lenders-sectors]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.06","CX Guideline","Data Holder","MAY","If an account holder has not given a secondary user instruction for an account with a secondary user, that account will appear as unavailable to the secondary user.",null,"Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.07","CX Guideline","Data Holder","MAY","Data holders should provide clear explanations to consumer about why their accounts are unavailable. \n\nThese explanations should only reference account types that the consumer holds, and should be contextually shown in relation to the account where possible.\n\nData holders should use appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of microinteractions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU1. Amending Authorisation","05. Unavailable accounts","3AU1.05.08","CX Guideline","Data Holder","MAY","The request function is optional but permitted under the standards. It can be presented within the authorisation flow or elsewhere, at the data holder’s discretion.\n\nThe purpose would be to allow non-nominated persons or secondary users without sharing rights to request access. This could alert the account owner(s) or administrator(s) of the steps required to grant sharing rights, leading them to the relevant services for managing secondary users or nominated representatives.","Authorisation Standards, Unavailable Accounts: Request sharing rights [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/amending-authorisations","1.35.0","2025-09-24","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.01","CDR Rule","Data Holder","MUST","(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following: \n(a) the pre-approval option, under which joint account data may be disclosed in response to a valid consumer data request on the authorisation of the requester without the approval of the relevant account holders","CDR Rule 4A.5(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.02","CDR Rule","Data Holder","MUST","(2) The data holder must provide for the pre-approval and non-disclosure options to be available for a joint account.","CDR Rule 4A.5(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.03","CDR Rule","Data Holder","MUST","(4) For the purposes of rule 4A.12, where the pre-approval option applies to a joint account and the requester authorises the disclosure of joint account data in response to a valid consumer data request:\n(a) each relevant account holder is taken to have approved the disclosure;","CDR Rule 4A.5(4)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.04","CDR Rule","Data Holder","MUST","(5) Unless a sector Schedule provides otherwise, the pre-approval option applies to a joint account by default.","CDR Rule 4A.5(5)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.05","CDR Rule","Data Holder","MUST","The disclosure option that applies to a joint account may be changed in accordance with rule 4A.7 or 4A.8.","CDR Rule 4A.5(6)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.06","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to:\n(a) change the disclosure option that applies to the account in accordance with rule 4A.7; and\n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8;","CDR Rule 4A.6(1)(a), (b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.07","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(a) to a relevant account holder, to inform them that the requester has given, amended or withdrawn an authorisation, or that the authorisation has expired;\nin accordance with the data standards.","CDR Rule 4A.14(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.08","CDR Rule","Data Holder","MUST","(2) The data holder must make the appropriate approval notification to a joint account holder in relation to an event mentioned in subrule (1):\n(a) as soon as practicable after the event occurs, unless the joint account holder has selected an alternative schedule of notifications; and\n(b) through its ordinary means of contacting the joint account holders.","CDR Rule 4A.14(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.09","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.10","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.11","CX Standard","Data Holder","MAY","For the content of the approval notification, data holders MAY provide the consumer with instructions for how any relevant authorisation(s) or approval(s) can be reviewed.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Notification content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.12","CX Standard","Data Holder","MAY","Data holders MAY provide a mechanism or entry point for a notification schedule to be amended from or in relation to the notification itself.\n\nThis MAY, for example, allow a consumer to stop receiving the type of notification(s) from the notification itself.\n\nThe notification MAY also, for example, include a link to amend the notification schedule or instructions to direct the consumer to the appropriate place.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Contextual amendment [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.13","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.14","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.15","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.16","CX Guideline","Data Holder","MAY","Data holders should provide instructions for how a disclosure option can be changed.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.17","CX Guideline","Data Holder","MAY","Email is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.14(2)and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.11(a) and 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.18","CX Guideline","Data Holder","MAY","Data holders should include information about data sharing with the CDR.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.19","CX Guideline","Data Holder","MAY","Data holders should provide information about the ADR to relevant account holders. This should include the ADR's name, accreditation number and a link to the their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.20","CX Guideline","Data Holder","MAY","Where an alternative notification schedule is provided as per CDR Rule 4A.14(3), this notification may be omitted at the consumer's request.","CDR Rule 4A.14(3)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","01. Default (Pre-approval)","3AU2.01.21","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.16.0","2022-03-17","Active"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.01","CDR Rule","Data Holder","MUST","A data holder is not liable under these rules for a failure to comply with this Part if it considered that the relevant act or omission was necessary in order to prevent physical, psychological or financial harm or abuse to any person.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.02","CX Standard","Data Holder","MUST","Where rule 4A.15 is leveraged to allow a vulnerable requester to share their joint account data as if it were an individual account, the data holder MUST alert the requester, in the context of the authorisation flow, that the other joint account holder(s) will not be notified.\n\nThis alert SHOULD be applied where appropriate for joint account management in general, including the consumer dashboard and the Disclosure Option Management Service (DOMS).","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Rule 4A.15 exemptions [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.03","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.04","CX Guideline","Data Holder","MAY","Data holders may choose to leverage CDR Rule 4A.15 by allowing a vulnerable joint account holder to share joint account data as if it were from an individual account.\n\nThis may mean that the other account holder(s) are not alerted to the sharing of that data, and are not provided with an equivalent dashboard as per CDR Rule 4A.13.\n\nThe CX research and community consultation suggested that such an approach would support vulnerable consumers in accessing and benefitting from the CDR.","CDR Rule 4A.15 and 4A.13 | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; Joint accounts & the Consumer Data Right (Consumer Policy Research Centre) [https://cx.dsb.gov.au/overview/cx-reports/reports/community-engagement-reports-2018-2022#block-162f1af016ea80a08e25e56b8351c949]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.05","CX Guideline","Data Holder","MAY","Data holders should outline that sharing arrangements made by the vulnerable requester will not be visible to the other relevant account holder(s) on their consumer dashboard(s).",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.06","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","02. Vulnerable consumers","3AU2.02.07","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.16.0","2022-03-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.01","CDR Rule","Data Holder","MUST","(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following: \n(b) the co-approval option, under which joint account data may be disclosed in response to a valid consumer data request only after:\n(i) the requester has authorised the disclosure; and\n(ii) each of the relevant joint account holders has approved the disclosure;","CDR Rule 4A.5(1)(b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.02","CDR Rule","Data Holder","MUST","(3) The data holder may provide for the co-approval option to be available for a joint account.","CDR Rule 4A.5(3)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.03","CDR Rule","Data Holder","MUST","(6) The disclosure option that applies to a joint account may be changed in accordance with rule 4A.7 or 4A.8.","CDR Rule 4A.5(6)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.04","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to:\n(a) change the disclosure option that applies to the account in accordance with rule 4A.7; and\n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8;","CDR Rule 4A.6(1)(a), (b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.05","CDR Rule","Data Holder","MUST","(4) If the co-approval option applies to the joint account, the data holder must, subject to subrule (5):\n(a) ask the requester for authorisation in accordance with rule 4.5 and Division 4.4;","CDR Rule 4A.10(4)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.06","CDR Rule","Data Holder","MUST","(4) If the co-approval option applies to the joint account, the data holder must, subject to subrule (5):\n(b) if the authorisation is given, invite the approval of the relevant account holders in accordance with rule 4A.11","CDR Rule 4A.10(4)(b)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.07","CDR Rule","Data Holder","MUST","(4) If the co-approval option applies to the joint account, the data holder must, subject to subrule (5):\n(c) if all the relevant account holders give their approval, or are taken to have given their approval, comply with rules 4.6 to 4.7.","CDR Rule 4A.10(4)(c)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.08","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(a) indicate that an accredited person has requested disclosure of CDR data that relates to the joint account on behalf of the requester;","CDR Rule 4A.11(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.09","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(b) indicate that:\n(i) the requester has authorised, under Division 4.4, the disclosure of the joint account data; and","CDR Rule 4A.11(b)(i)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.10","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(b) indicate that:\n(ii) a co-approval option applies to the joint account;","CDR Rule 4A.11(b)(ii)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.11","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(c) indicate the matters referred to in paragraphs 4.23(1)(a), (b), (c), (d) and (e) so far as they relate to the request;","CDR Rule 4A.11(c)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.12","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(d) ask the relevant account holder to approve or not approve disclosure of the joint account data;","CDR Rule 4A.11(d)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.13","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(e) specify the time by which the data holder needs to receive any approval, and inform them that if an approval is not received by that time, the joint account data will not be disclosed;","CDR Rule 4A.11(e)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.14","CDR Rule","Data Holder","MUST","For the purposes of paragraph 4A.10(4)(b), the data holder must, through its ordinary means of contacting each relevant account holder:\n(f) inform them that any relevant account holder may, at any time, withdraw the approval using their consumer dashboard\n(g) indicate what the effect of removing the approval would be.","CDR Rule 4A.11(f), (g)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.15","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(a) to a relevant account holder, to inform them that the requester has given, amended or withdrawn an authorisation, or that the authorisation has expired;\nin accordance with the data standards.","CDR Rule 4A.14(1)(a)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.16","CDR Rule","Data Holder","MUST","(2) The data holder must make the appropriate approval notification to a joint account holder in relation to an event mentioned in subrule (1):\n(a) as soon as practicable after the event occurs, unless the joint account holder has selected an alternative schedule of notifications; and\n(b) through its ordinary means of contacting the joint account holders.","CDR Rule 4A.14(2)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.17","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.19","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.20","CX Standard","Data Holder","MUST","Where an account requires further actions or approvals before data can be disclosed, data holders MUST indicate this to the user visually and MUST provide an explanation of what is required or expected.\n\nThis MAY, for example, be achieved with a visual icon to indicate that the account is ‘pending’. This indication MUST be accompanied by an in-context explanation to describe what the status means. This explanation SHOULD include any required actions and any specified time frames.","Authorisation Standards, Authorisation: Pending status [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.21","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.22","CX Standard","Data Holder","MAY","For the content of the approval notification, data holders MAY provide the consumer with instructions for how any relevant authorisation(s) or approval(s) can be reviewed.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Notification content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2022-03-17"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.23","CX Guideline","Data Holder","MAY","CDR Rules allow, but do not require data holders to provide a co-approval disclosure option. Data holders may want to consider offering co-approval to align with consumer expectations, as identified in CX research and concerns raised by the community.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 1 and 2 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80df9a3ade191e9cf49e]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2020 Phase 3, Round 6 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80cdb723db0b24fcbd35]; Joint accounts & the Consumer Data Right (Consumer Policy Research Centre) [https://cx.dsb.gov.au/overview/cx-reports/reports/community-engagement-reports-2018-2022#block-162f1af016ea80a08e25e56b8351c949] | Submissions: Design Paper: an ‘opt-out’ data sharing model for joint accounts in the banking and energy sectors #176 [https://github.com/ConsumerDataStandardsAustralia/standards/issues/176]; Consumer Data Right rules amendments (version 3), Exposure Draft [https://treasury.gov.au/consultation/c2021-187223].","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.24","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.25","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.26","CX Guideline","Data Holder","MAY","Data holders should provide instructions for how a disclosure option can be changed.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.27","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.11(a) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.11(a) and 1.7(1)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.28","CX Guideline","Data Holder","MAY","The invitation to approve data sharing (CDR Rule 4A.10(4)(b)) and the approval notification (CDR Rule 4A.14(1)(a)) can be provided in the same notification. This notification can also relate to more than 1 joint account.\n\nWhere an alternative notification schedule is provided as per CDR Rule 4A.14(3), the approval notification may be omitted at the consumer's request.","CDR Rule 4A.10(4)(b), 4A.14(1)(a) and 4A.14(3)","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.29","CX Guideline","Data Holder","MAY","Data holders should include information about data sharing with the CDR.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.30","CX Guideline","Data Holder","MAY","Data holders should provide more information about the ADR to relevant account holders. Doing so can help remove a key barrier to co-approval data sharing requests.\n\nIn addition to the ADR's name, data holders should also include the ADR's accreditation number and a link to their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.31","CX Guideline","Data Holder","MAY","Data holders should provide a pathway for relevant account holders to find out how their data will be handled by the data recipient.","CX Research: 2020 Phase 3, Round 1 and 2 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea80df9a3ade191e9cf49e]; Joint accounts & the Consumer Data Right (Consumer Policy Research Centre) [https://cx.dsb.gov.au/overview/cx-reports/reports/community-engagement-reports-2018-2022#block-162f1af016ea80a08e25e56b8351c949]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active","2025-02-26"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.32","CX Guideline","Data Holder","MAY","Where there are multiple joint accounts, data holders should provide a way for the relevant account holder(s) to select which joint accounts they approve for data sharing.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.33","CX Guideline","Data Holder","MAY","Data holders should inform the requester when approval has been given by the relevant account holder(s).","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Active"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.34","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.16.0","2022-03-17","Active"]
["4CM. Consent Management","01. Withdrawing consent","4CM.01.","CX Standard","Data Recipient","MUST","If a data recipient does not have a general policy to delete redundant data, and the consumer has not already requested that their redundant data be deleted:\n\n• Data recipients MUST allow consumers to elect to have their redundant data deleted as part of the withdrawal process prior to the final withdrawal step.\n• Data recipients SHOULD consider prompting consumers to exercise this right at appropriate times (e.g. when inaction on the part of the consumer may cause them to lose the opportunity to exercise the right to delete their redundant data).","Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","CX Guidelines v1.4.0 PDF, p. 101 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.01","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(a) can be used by the CDR consumer to manage:\n(i) such requests; and\n(ii) associated consents; and\n(b) contains the details of each consent specified in subrule (3) and the information specified in subrule (3A);","CDR Rule 1.14(1)(a)–(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-03-14"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.02","CDR Rule","Data Recipient","MUST","(2) Such a service is the accredited person’s consumer dashboard for that consumer.","CDR Rule 1.14(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.03","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.19(1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.04","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(g) if the consent is not current—when it expired;","CDR Rule 1.14(3)(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.05","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(b) for a use consent―details of the specific use or uses for which the CDR consumer has given their consent;","CDR Rule 1.14(3)(b) | OAIC Chapter C: Consent (Data minimisation principle) [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-c-consent-the-basis-for-collecting-and-using-cdr-data/#data-minimisation-principle]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.06","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(c) when the CDR consumer gave the consent;","CDR Rule 1.14(3)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.07","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(f) if the consent is current—when it is scheduled to expire;\n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.09","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(c) allows the CDR consumer, at any time, to withdraw a current consent; and \n(d) as part of the process of withdrawing a consent, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a consent;","CDR Rule 1.14(1)(c)–(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.10","CDR Rule","Data Recipient","MUST","(2A) The consumer dashboard may also allow a CDR consumer to amend a current consent.","CDR Rule 1.14(2A)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.11","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(a) details of the CDR data to which the consent relates; ","CDR Rule 1.14(3)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.12","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(h) information relating to CDR data that was collected or disclosed pursuant to the consent (see rules 7.4 and 7.9);","CDR Rule 1.14(3)(h)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.13","CDR Rule","Data Recipient","MUST","(1) For section 56EH of the Act, and subject to subrule (2), an accredited data recipient that collected the CDR data in accordance with section 56EF of the Act as a result of a collection consent must update the person’s consumer dashboard as soon as practicable to indicate:\n(a) what CDR data was collected; and\n(b) when the CDR data was collected; and\n(c) the CDR participant for the CDR data from which the CDR data was collected.","CDR Rule 7.4(1) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.14","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(d) whether the consent applies:\n(i) on a single occasion; or\n(ii) over a period of time;","CDR Rule 1.14(3)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.15","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(e) if a collection consent or disclosure consent applies over a period of time:\n(i) what that period is; and\n(ii) how often data has been, and is expected to be, collected or disclosed over that period;","CDR Rule 1.14(3)(e)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.16","CDR Rule","Data Recipient","MUST","(8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.\n\n(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy: \n(a) electronically; or \n(b) in hard copy; \nas directed by the consumer.","CDR Rule 7.2(8), (9)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.17","CX Guideline","Data Recipient","MAY","Data recipients and data holders should provide the consumer with a contextual 'walkthrough’ or ‘tutorial' to introduce them to the concept of the dashboard if they are not familiar with it.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.18","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, archived), or presenting key details up front, such as when consent was granted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.19","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.\n\nFor example, a consumer may want to sort by data recipient, data cluster, or by a user-defined tag.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.20","CX Guideline","Data Recipient","MAY","Data recipients should organise consents by data holder brand names in a way that is consistent with how data holders are referenced in the provider/data holder selection step when consent is first being sought.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.21","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to create user-defined tags, names, and/or descriptions (e.g. home deposit) for each data sharing arrangement.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.22","CX Guideline","Data Recipient","MAY","Data recipients should include a link to the data holder's specific page on  http://www.cdr.gov.au/find-a-provider for verification purposes. ",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.23","CX Guideline","Data Recipient","MAY","Data recipients should organise consents by referring to the use case/purpose, the brand name, and software product name to aid consent and authorisation recognitions and management across dashboards.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.24","CX Guideline","Data Recipient","MAY","Data recipients should show the status of the consent, which may refer to it being 'active', 'cancelled', 'expired', or relating to a 'once-off’ instance of sharing.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.25","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.\n\nThis may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent).","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.26","CX Guideline","Data Recipient","MAY","Data recipient dashboards should display which accounts they are collecting data from to facilitate consumer comprehension and consent management.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.27","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to download and/or request a record of the sharing arrangement, and/or a copy of their Receipt(s).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.28","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.29","CX Guideline","Data Recipient","MAY","Data recipients may allow consumers to add or remove accounts from an existing consent.\n\nThis process may be initiated by the ADR, such as by inviting them to add new account types to an existing consent, or by allowing the consumer to trigger this process on their ADR consumer dashboard.\n\nThe account amendment process should trigger the consent flow and DH authentication/authorisation process to add or remove the account(s) from the associated authorisation.\n\nData recipients should supply the relevant cdr_arrangement_id to the DH when seeking to have a current authorisation amended.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.30","CX Guideline","Data Recipient","MAY","Data recipients should explain how the time period complies with the data minimisation principle (DMP) for data that is yet to be generated (e.g. for an ongoing consent) as well as historical data (e.g. for a collection on a 'single occasion').\n\nExample DMP statement for data that is yet to be generated:\nWe're accessing your data for 12 months so [we can update your financial position in real-time] to [deliver accurate and tailored personal financial management].\n\nExample DMP statement for historical data:\nWe're accessing data that dates back to [earliest date of record] so [we can assess seasonal changes] to [provide an accurate energy comparison].","CDR Rule 1.8","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.31","CX Guideline","Data Recipient","MAY","Data recipients should present the purpose in relation to each data cluster unless this statement applies equally to all datasets.\n\nIf the statement applies equally to all datasets, data recipients should present this to the consumer clearly in relation to all of the datasets.\n\nThis information should clearly communicate the purposes and benefits of data sharing to the consumer.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.32","CX Guideline","Data Recipient","MAY","Privacy Safeguard 5\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection. \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection). \n\nNote: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance.","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.33","CX Guideline","Data Recipient","MAY","Data recipients should use the phrases ‘Granted’, 'Expire' and ‘Sharing period’ to refer to the time-based qualities of the data sharing arrangement.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.34","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(e) allows the CDR consumer to elect that redundant data be deleted in accordance with these rules and be able to withdraw such an election; ","CDR Rule 1.14(1)(e)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.35","CDR Rule","Data Recipient","MUST","(3A) For paragraph (1)(b), the other information is:\n(a) a statement that the CDR consumer is entitled to request further records in accordance with rule 9.5; and\n(b) information about how to make such a request.","CDR Rule 1.14(3A)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.36","CDR Rule","Data Recipient","MUST","(2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:\n(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and\n(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);\nthat relates to the CDR consumer.","CDR Rule 9.5(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2024-03-06"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.37","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to surface information on dispute resolution and making a complaint. This may include:\n• a link to the complaints section of the ADR’s CDR policy; and/or\n• a summary of the complaint handling process.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.38","CX Guideline","Data Recipient","MAY","Data recipients can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include any known information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.40","CX Guideline","Data Recipient","MAY","To build consumer trust and confidence, data recipients should surface information about data deletion. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(k), and a link to read the policy. CX research highlighted the importance of including: \n• when data will be deleted; \n• why data may need to be retained (e.g. business or legal reasons); \n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.41","CX Guideline","Data Recipient","MAY","These artefacts demonstrate what a consumer might see where an ADR has a policy to delete redundant data by default. \n\nAs per CDR Rule 1.14(1)(e), where an ADR will de-identify redundant data instead of deleting it, the ADR is required to provide the consumer with the ability to elect that redundant data be deleted instead. ADRs should consider providing this functionality in a way that is consistent with any other data handling information and functionality, and may surface the right to delete election in a location similar to the 'Data handling' component found on this screen.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Active","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.42","CX Guideline","Data Recipient","MAY","CX research suggested that further information on data handling, including from government sources, can aid comprehension and confidence for Sceptic, Assurance Seeker and Sensemaker behavioural archetypes. Based on these insights, data recipients are encouraged to provide a link to OAIC’s guidance on Privacy Safeguard 12, which outlines information on data security and redundant data handling.","CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.1","2022-04-07","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.43","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(f) is simple and straightforward to use; and \n(g) is prominently displayed and readily accessible to the CDR consumer.","CDR Rule 1.14(1)(f)–(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.44","CX Guideline","Data Recipient","MAY","In addition to the CX Standards for CDR receipt delivery, data recipients should also make the CDR receipt available on the dashboard.","Notification Standards, CDR Receipt: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.01","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(a) can be used by the CDR consumer to manage:\n(i) such requests; and\n(ii) associated consents; and\n(b) contains the details of each consent specified in subrule (3) and the information specified in subrule (3A);","CDR Rule 1.14(1)(a), (b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.02","CDR Rule","Data Recipient","MUST","(2) Such a service is the accredited person’s consumer dashboard for that consumer.","CDR Rule 1.14(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.03","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(g) if the consent is not current—when it expired;","CDR Rule 1.14(3)(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.04","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(c) when the CDR consumer gave the consent;","CDR Rule 1.14(3)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.05","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(f) if the consent is current—when it is scheduled to expire;\n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.06","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(e) if a collection consent or disclosure consent applies over a period of time:\n(i) what that period is; and\n(ii) how often data has been, and is expected to be, collected or disclosed over that period;","CDR Rule 1.14(3)(e)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.08","CDR Rule","Data Recipient","MUST","(8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.\n\n(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy:\n(a) electronically; or\n(b) in hard copy;\nas directed by the consumer.","CDR Rule 7.2(8), (9)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.09","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(c) has a functionality that:\n(i) allows a CDR consumer, at any time, to:\n(A) withdraw current consents; and\n(B) elect that redundant data be deleted in accordance with these rules and withdraw such an election; and\n(ii) is simple and straightforward to use; and\n(iii) is prominently displayed.","CDR Rule 1.14(1)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.10","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following:\n(a) details of the CDR data to which the consent relates;","CDR Rule 1.14(3)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.11","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(h) information relating to CDR data that was collected or disclosed pursuant to the consent (see rules 7.4 and 7.9);","CDR Rule 1.14(3)(h)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.12","CDR Rule","Data Recipient","MUST","(2) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to an accredited person must, as soon as practicable, update each\nconsumer dashboard that relates to the request to indicate:\n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the accredited person, identified in accordance with any entry on the Register of Accredited Persons specified as being for that purpose.","CDR Rule 7.9(2) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.13","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(d) whether the consent applies:\n(i) on a single occasion; or\n(ii) over a period of time;","CDR Rule 1.14(3)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.14","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.15","CX Standard","Data Recipient","MUST","If:\n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; or\n2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.","Consent Standards, Disclosure Consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.16","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, inactive), or presenting key details up front, such as when consent was granted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.17","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.\n\nFor example, a consumer may want to sort by data recipient, data cluster, or by a user-defined tag.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.18","CX Guideline","Data Recipient","MAY","Data recipients should organise disclosures to accredited persons using the brand and software product name. The logo held at the brand level should also be presented in relation to the consent to aid recognition and management.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.19","CX Guideline","Data Recipient","MAY","Data recipients should surface the legal entity of the ADR being disclosed to for the AP Disclosure.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.20","CX Guideline","Data Recipient","MAY","Data recipients should provide a link for consumers to verify a data recipient's accreditation via the CDR website. The following link could be used for this purpose: https://www.cdr.gov.au/find-a-provider","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.21","CX Guideline","Data Recipient","MAY","Data recipients should show the status of the consent, which may refer to it being 'active', 'cancelled', 'expired', or relating to a 'once-off’ instance of sharing.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.22","CX Guideline","Data Recipient","MAY","Data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the data recipient for additional information.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.23","CX Guideline","Data Recipient","MAY","Data recipients should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.\nThis may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent).","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.24","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to download and/or request a record of the sharing arrangement, and/or a copy of their Receipt(s).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.25","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.26","CX Guideline","Data Recipient","MAY","The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.27","CX Guideline","Data Recipient","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure). \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure). \n\nIf a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.","CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active","2022-03-14"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.28","CX Guideline","Data Recipient","MAY","Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.29","CDR Rule","Data Recipient","MUST","(2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:\n(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and\n(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);\nthat relates to the CDR consumer.","CDR Rule 9.5(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.30","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n\n(f) is simple and straightforward to use; and\n(g) is prominently displayed and readily accessible to the CDR consumer.","CDR Rule 1.14(1)(f)–(g)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.31","CX Guideline","Data Recipient","MAY","In addition to the CX Standards for CDR receipt delivery, data recipients should also make the CDR receipt available on the dashboard.","Notification Standards, CDR Receipt: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","01. AP Disclosure consent","4CM1.01.32","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to surface information on dispute resolution and making a complaint. This may include:\n• a link to the complaints section of the ADR’s CDR policy; and/or\n• a summary of the complaint handling process.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.33.1","2025-03-07","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.01","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.19","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.02","CDR Rule","Data Recipient","MUST","(1) An accredited person must give the CDR consumer a notice that complies with this rule (a CDR receipt) as soon as practicable after:\n(aa) the CDR consumer amends such a consent in accordance with this Division;","CDR Rule 4.18(1)(aa)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.03","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(i) details of each amendment (if any) that has been made to the consent.","CDR Rule 1.14(3)(i)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.04","CDR Rule","Data Recipient","MUST","An amendment of a consent takes effect when the CDR consumer amends the consent.","CDR Rule 4.12A","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.05","CX Guideline","Data Recipient","MAY","Data recipients may provide customers with pathways to past CDR Receipts from the sharing arrangement.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.06","CX Guideline","Data Recipient","MAY","Data recipients may allow consumers to access the associated amendment request that was sent to the consumer such as the invitation specified in CDR Rule 4.12B(1) and (2)(b).","CDR Rule 4.12B(1), (2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM1. DR Dashboard","02. Amending consent","4CM1.02.07","CX Guideline","Data Recipient","MAY","Data recipients should allow consumers to access the details of past amendments from the current version of the consent.\n\nThe details of past amendments should be accessible on the dashboard as per CDR Rule 1.14(3)(i) as well as CDR receipts relating to past consent amendments. \n\nAmendment details should refer to the specific attributes, including additional uses, that were amended, added, or removed, along with the date of the amendment.","CDR Rule 1.14(3)(i)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.11.0","2021-07-02","Active"]
["4CM1. DR Dashboard","03a. Using OSPs","4CM1.03a.06","CX Guideline","Data Recipient","MAY","Data recipients should outline what the outsourced service provider, sponsor or principal is doing in relation to the specific consent and data, for example: collection; use; transformation; storage; de-identification; etc.","CDR Rule 4.11(3)(f)(i) | CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03a. Using OSPs","4CM1.03a.07","CX Guideline","Data Recipient","MAY","Where outsourced service providers are used, CDR Rule 4.11(3)(f) requires the accredited person to give the consumer information about the OSP in the consent flow but not on dashboards. These guidelines recommend that any OSP listed during consent and their roles be surfaced in dashboards as well to support consistency and meet consumer expectations, as identified in consumer research.","CDR Rule 4.11(3)(f) | CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03a. Using OSPs","4CM1.03a.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf.\n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.01","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(ha) if the accredited person is an affiliate and the CDR data will be collected by a sponsor at its request:\n(i) the sponsor’s name; and\n(ii) the sponsor’s accreditation number;","CDR Rule 1.14(3)(ha)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.02","CDR Rule","Data Recipient","MUST","(2) Where the CDR data was collected by a sponsor on behalf of an affiliate: \n(a) the sponsor is not required to provide the consumer dashboard; \n\nNote: The affiliate, as an accredited person that makes the consumer request through the sponsor, is required to provide the consumer dashboard under subrule 1.14(1).","CDR Rule 7.4(2)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.03","CDR Rule","Data Recipient","MUST","(2) Where the CDR data was collected by a sponsor on behalf of an affiliate:\n(c) the dashboard must also indicate that the CDR data was collected by the sponsor on behalf of the affiliate.","CDR Rule 7.4(2)(c)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-03-06"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement","4CM1.03b.05","CX Guideline","Data Recipient","MAY","For a generic example demonstrating how CDR Rule 7.4, privacy safeguard 5 may be implemented, see annotations 12, 13, and 32 in https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents#block-1012235b83724b498179a1467287abec","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data/] | CX Guidelines: Consent Management (Data recipient): Collection and use consents, Collection and use consents - default example [https://cx.dsb.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents#block-1012235b83724b498179a1467287abec]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement","4CM1.03b.06","CX Guideline","Data Recipient","MAY","Data recipients should outline what the outsourced service provider, sponsor or principal is doing in relation to the specific consent and data, for example: collection; use; transformation; storage; de-identification; etc.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.08","CX Guideline","Data Recipient","MAY","Various CDR Rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the sponsor or principal to be referenced. \n\nThese artefacts demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the sponsor or principal is only noted as a background detail.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement","4CM1.03b.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf.\n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03b. Sponsorship arrangement ","4CM1.03b.10","CDR Rule","Data Recipient","MUST","(2) Where the CDR data was collected by a sponsor on behalf of an affiliate \n(b) the sponsor and the affiliate may choose which of them will be responsible for updating the consumer’s dashboard in accordance with subrule (1);","CDR Rule 7.4(2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.04","CDR Rule","Data Recipient","MUST","(5) Where a CDR representative principal makes a consumer data request at the request of a CDR representative, it may arrange for the CDR representative to provide the consumer dashboard on its behalf.","CDR Rule 1.14(5)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2024-03-06"]
["4CM1. DR Dashboard","03c. CDR representative arrangement","4CM1.03c.06","CX Guideline","Data Recipient","MAY","Data recipients should outline what the outsourced service provider, sponsor or principal is doing in relation to the specific consent and data, for example: collection; use; transformation; storage; de-identification; etc.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement","4CM1.03c.08","CX Guideline","Data Recipient","MAY","Various CDR Rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the sponsor or principal to be referenced. \n\nThese artefacts demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the sponsor or principal is only noted as a background detail.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03c. CDR representative arrangement","4CM1.03c.09","CX Guideline","Data Recipient","MAY","These artefacts demonstrate a consolidated pattern that CDR participants may choose to implement for various sharing models, including: \n• where an accredited data recipient uses an outsourced service provider; \n• for an affiliate using a sponsor to collect data; and \n• for a CDR representative requesting that a CDR principal collect data on their behalf.\n\nUsing a consistent pattern will help provide familiar, trustworthy, and intuitive experiences while also providing flexible and reusable designs to support various implementation requirements.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.15.0","2021-12-23","Active","2025-03-07"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.11","CDR Rule","Data Recipient","MUST","(1) A CDR representative must inform the CDR representative principal as soon as practicable after the information required to be contained on the CDR representative principal’s consumer dashboard changes.\nNote: The CDR representative principal may allow the CDR representative to provide the consumer dashboard on its behalf—see subrule 1.14(5).\n\n(2) The CDR representative principal must, as soon as practicable, make those changes.\nNote 1: This subrule is a civil penalty provision (see rule 9.8).\nNote 2: The CDR representative principal could arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf: see subrule 4.19(2).","CDR Rule 4.20T","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.12","CDR Rule","Data Recipient","MUST","(2) Where a CDR representative provides the consumer dashboard on behalf of a CDR representative principal (see subrule 1.14(5)), the CDR representative principal may arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf.","CDR Rule 4.19(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active"]
["4CM1. DR Dashboard","03c. CDR representative arrangement ","4CM1.03c.13","CX Guideline","Data Recipient","MAY","CDR Representatives should refer to Division 4.3A of the CDR Rules for further information on their obligations when providing dashboards and consent management.","CDR Rules, Division 4.3A","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.29.1","2024-03-06","Active","2025-03-07"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.01","CDR Rule","Data Recipient","MUST","(3A) For paragraph (1)(b), the other information is:\n(a) a statement that the CDR consumer is entitled to request further records in accordance with rule 9.5; and\n(b) information about how to make such a request.","CDR Rule 1.14(3A)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.02","CDR Rule","Data Recipient","MUST","(2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:\n(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and\n(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);\nthat relates to the CDR consumer.","CDR Rule 9.5(2)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active","2024-03-06"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.03","CDR Rule","Data Recipient","MUST","(3) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to a trusted adviser must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:\n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the trusted adviser.","CDR Rule 7.9(3) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.04","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.05","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure Notifications: Notification Record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.06","CX Guideline","Data Recipient","MAY","Data recipients should organise consents by referring to the use case/purpose to aid consent management.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.07","CX Guideline","Data Recipient","MAY","In addition to the CX standards requirements, data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the Trusted Adviser for more information.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.08","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.09","CX Guideline","Data Recipient","MAY","The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.10","CX Guideline","Data Recipient","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure). \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure). \n\nIf a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.","CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.11","CX Guideline","Data Recipient","MAY","Privacy Safeguard 5\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection. \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection). \n\nNote: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance.","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","04. Trusted Adviser disclosure consent","4CM1.04.12","CX Guideline","Data Recipient","MAY","Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.16.1","2022-04-11","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.01","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(f) if the consent is current—when it is scheduled to expire;\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.02","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent:\n(eb) if a business consumer statement has been given in relation to the consent—that fact;","CDR Rule 1.14(3)(eb)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.03","CDR Rule","Data Recipient","MUST","(3A) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to a person in accordance with a business consumer disclosure consent must, as soon as practicable, update each consumer dashboard that relates to the request to indicate: \n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the person to whom it was disclosed.","CDR Rule 7.9(3A) | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.04","CX Standard","Data Recipient","MUST","In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:\n1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from.\n2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.\n\nNote:\n• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s).\n• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data.\n• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified.","Consent Standards, Disclosure consent: Collection source [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.05","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure Notifications: Notification Record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.06","CX Guideline","Data Recipient","MAY","In addition to the CX standards requirements, data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the non-AP for more information.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.07","CX Guideline","Data Recipient","MAY","If a business consumer statement has been given, it should be clearly visible in the related consent arrangement on the consumer dashboard.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.08","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.09","CX Guideline","Data Recipient","MAY","Accredited persons should have processes in place to ensure that a CDR consumer continues to meet the business consumer criteria for the full period in which they are treated as a CDR business consumer. This may include monitoring the CDR business consumer’s ABN to ensure it remains active at regular intervals.","ACCC CDR business consumers - Fact sheet [https://www.cdr.gov.au/resources/fact-sheets-providers#goto-cdr-business-consumers]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.10","CX Guideline","Data Recipient","MAY","The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.11","CX Guideline","Data Recipient","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure). \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure). \n\nIf a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.","CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.12","CX Guideline","Data Recipient","MAY","Privacy Safeguard 5\n\nFor ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection. \n\nFor single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection). \n\nNote: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance.","CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-5-privacy-safeguard-5-notifying-of-the-collection-of-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","05. Business consumer disclosure consent","4CM1.05.13","CX Guideline","Data Recipient","MAY","Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.30.0","2024-05-01","Active"]
["4CM1. DR Dashboard","06a. Collection consent management - AP holding collected data as a data holder","4CM1.06a.01","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices on the consumer's data recipient consumer dashboard.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06a. Collection consent management - AP holding collected data as a data holder","4CM1.06a.02","CX Guideline","Data Recipient","MAY","Privacy Safeguard 12 and the requirements related to redundant data handling do not apply to the consumer dashboard, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.01","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices on the consumer's data recipient consumer dashboard.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.02","CX Guideline","Data Recipient","MAY","Privacy safeguard 12 and the requirements related to redundant data handling do not apply to the consumer dashboard, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.03","CX Guideline","Data Recipient","MAY","Clause 7.2(2A) of Schedule 3 does not constitute a type of consent as defined in rule 1.10A, but rather is an additional permission for the data recipient to hold the collected data as a data holder. \n\nThis permission cannot be withdrawn under the CDR, nor is a CDR receipt required.","CDR Rule 1.10A, 4.18","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.04","CX Guideline","Data Recipient","MAY","Note 3 under rule 1.14(3) allows data recipients to include additional information on the consumer dashboard beyond the rule requirements. \n\nFor transparency, data recipients should provide a record of the permission outlined in Clause 7.2(2A) of Schedule 3 given for them to become a data holder of the collected CDR data.","CDR Rule 1.14(3), (Note 3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM1. DR Dashboard","06b. CDR consent management - Permission to hold collected data as a data holder","4CM1.06b.05","CX Guideline","Data Recipient","MAY","When a consumer consents to a data recipient becoming a data holder of collected CDR data, that data is no longer subject to CDR protections. \n\nAlthough this data is no longer under CDR protections, data recipients must follow their regular obligations for data use and disclosure (e.g. Privacy Act and Australian Privacy Principle 6).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.01","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.02","CDR Rule","Data Recipient","MUST","(3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant.","CDR Rule 4.13(3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.04","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: \n(c) withdraws such a consent in accordance with rule 4.13","CDR Rule 4.18(c) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.08","CDR Rule","Data Recipient","MUST","(1) A consent given under this Division expires at the earliest of the following:\n(a) if the consent is withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following:\n(i) when the accredited person gave effect to the withdrawal;\n(ii) 2 business days after the accredited person received the communication;\n(b) if the consent is withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn;","CDR Rule 4.14(1)(a)–(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.09","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.\n\n(2) Where a CDR representative provides the consumer dashboard on behalf of a CDR representative principal (see subrule 1.14(5)), the CDR representative principal may arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf.","CDR Rule 4.19","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.10","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(f)  if the consent is current—when it is scheduled to expire; \n(g)  if the consent is not current—when it expired; \n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f)–(g), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.11","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.12","CX Guideline","Data Recipient","MAY","Data recipients should surface information on consequences of withdrawal. This may include details from their CDR policy, as stated in CDR Rule 7.2(4)(a).","CDR Rule 7.2(4)(a) | CX Research 32 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.13","CX Guideline","Data Recipient","MAY","Data recipients should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.14","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.15","CX Guideline","Data Recipient","MAY","When a consent is withdrawn, data recipients should notify the consumer: \n• Of the status of their consent, including the updated duration and withdrawal date; \n• That the data recipient is no longer collecting, using, and/or disclosing their data (depending on the type of consent withdrawn); \n• Of how their redundant data will be handled, and when this will come into effect if it will not be immediate (such as when the data will need to be held for legal reasons).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.16","CX Guideline","Data Recipient","MAY","Data recipients can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include any known information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.16.0","2022-03-16","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.17","CDR Rule","Data Recipient","MUST","(2) An accredited data recipient must keep and maintain records that record and explain the following:\n(b) amendments to or withdrawals of consents by CDR consumers","CDR Rule 9.3(2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.17.0","2022-06-21","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.18","CX Guideline","Data Recipient","MAY","Data recipients are expected to record how the withdrawal was requested by the consumer in relation to CDR Rule 9.3(2)(b), but the rules do not require the method of withdrawal to be shown on the dashboard.\n\nHowever, data recipients may wish to do this on the dashboard and/or in any CDR Receipt they choose to provide.","CDR Rule 9.3(2)(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.17.0","2022-06-21","Active","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.19","CDR Rule","Data Recipient","MUST","(1) This rule applies if:\n(a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and \n(b) the request has not been completely resolved; and \n(c) the consent expires for any reason. \n\n(2) The accredited person must notify: \n(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and \n(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired.","CDR Rule 4.18AA","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.29.1","2024-03-06","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.20","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that: \n(d) as part of the process of withdrawing a consent, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a consent;","CDR Rule 1.14(1)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.33.1","2025-03-07","Active"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.21","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.33.1","2025-03-07","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.01","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.02","CDR Rule","Data Recipient","MUST","(3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant.","CDR Rule 4.13(3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.04","CDR Rule","Data Recipient","MUST","(4) If: \n(a) an accredited person has a collection consent given under this Division to collect particular CDR data from a particular accredited data recipient; and \n(b) the accredited data recipient has an AP disclosure consent to disclose that CDR data to that accredited person; \nthen if one of those consents expires, the other expires when the accredited person or accredited data recipient is notified of the first‑mentioned expiry. \n\nNote: The notification is required by rule 4.18B.","CDR Rule 4.14(4)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.05","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer: \n(c) withdraws such a consent in accordance with rule 4.13","CDR Rule 4.18(c) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.09","CDR Rule","Data Recipient","MUST","(1) A consent given under this Division expires at the earliest of the following: \n(a) if the consent is withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following: \n(i) when the accredited person gave effect to the withdrawal; \n(ii) 2 business days after the accredited person received the communication; \n(b) if the consent is withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn;","CDR Rule 4.14(1)(a)–(b)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.10","CDR Rule","Data Recipient","MUST","(1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.19(1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.11","CDR Rule","Data Recipient","MUST","(3) For paragraph (1)(b), the information is the following for each consent: \n(f)  if the consent is current—when it is scheduled to expire; \n(g)  if the consent is not current—when it expired; \n\nNote 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c).","CDR Rule 1.14(3)(f)–(g), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.12","CX Standard","Data Recipient","MUST","As part of the disclosure consent withdrawal process, Data Recipients MUST advise the consumer to review, with the recipient that the data was disclosed to:\n1. How their data will be handled; and\n2. The consequences of withdrawing the disclosure consent.\n\nNote: The precise wording of the withdrawal message is at the discretion of the ADR","Withdrawal Standards, Withdrawal: Disclosure consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.13","CX Guideline","Data Recipient","MAY","Consumers may be allowing a data recipient to collect, use, and disclose their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.\n\nData recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.\n\nIf a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.14","CX Guideline","Data Recipient","MAY","Data recipients should include information on consequences of withdrawal during the consent withdrawal process. Refer to CDR Rule 7.2(4) and 4.11(3)(g)(iii).","CX Research 32 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.15","CX Guideline","Data Recipient","MAY","Data recipients should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.16","CX Guideline","Data Recipient","MAY","Data recipients should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.17","CX Guideline","Data Recipient","MAY","When a consent is withdrawn, data recipients should notify the consumer: \n• Of the status of their consent, including the updated duration and withdrawal date; \n• That the data recipient is no longer collecting, using, and/or disclosing their data (depending on the type of consent withdrawn); \n• Of how their redundant data will be handled, and when this will come into effect if it will not be immediate (such as when the data will need to be held for legal reasons).",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.18","CDR Rule","Data Recipient","MUST","(1) This rule applies if:\n(a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and \n(b) the request has not been completely resolved; and \n(c) the consent expires for any reason. \n\n(2) The accredited person must notify: \n(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and \n(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired.","CDR Rule 4.18AA","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.29.1","2024-03-06","Active"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.19","CDR Rule","Data Recipient","MUST","(1) This rule applies if: \n(a) an accredited person has made a consumer data request to an accredited data recipient on behalf of a CDR representative, based on a collection consent given under this Division relating to particular CDR data and that accredited data recipient; and \n(b) the accredited data recipient has an AP disclosure consent relating to that CDR data; and \n(c) the request has not been completely resolved. \n\n(3) If the AP disclosure consent expires in accordance with these rules, the accredited data recipient must notify the accredited person as soon as practicable of the expiry. \nNote 1: This subrule is a civil penalty provision (see rule 9.8). \nNote 2: The collection consent that the accredited person has expires when the notification is received—see subrule 4.14(4).","CDR Rule 4.18B(1), (3)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.29.1","2024-03-06","Active","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.20","CDR Rule","Data Recipient","MUST","(1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:\n(d) as part of the process of withdrawing a consent, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a consent; ","CDR Rule 1.14(1)(d)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.33.1","2025-03-07","Active"]
["4CM2. DR Withdrawal","02a. Collection consent withdrawal - AP holding collected data as a data holder","4CM2.02a.01","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices during consent withdrawal. ",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02a. Collection consent withdrawal - AP holding collected data as a data holder","4CM2.02a.02","CX Guideline","Data Recipient","MAY","Requirements relating to redundant data handling do not apply during the withdrawal flow. This is because Privacy Safeguard 12 do not apply, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02b. CDR consent withdrawal - Permission to hold collected data as a data holder","4CM2.02b.01","CX Guideline","Data Recipient","MAY","Data recipients should inform consumers that after consent expiration, their data may continue to be used according to their usual data handling practices.",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02b. CDR consent withdrawal - Permission to hold collected data as a data holder","4CM2.02b.02","CX Guideline","Data Recipient","MAY","Data recipients who become a data holder should include details of how the collected data is handled under their usual data holding practices during consent withdrawal. ",null,"Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM2. DR Withdrawal","02b. CDR consent withdrawal - Permission to hold collected data as a data holder","4CM2.02b.03","CX Guideline","Data Recipient","MAY","Requirements relating to redundant data handling do not apply during the withdrawal flow. This is because Privacy Safeguard 12 do not apply, as the data recipient would would be handling the collected data in their capacity as a data holder.","CDR Rule 1.14(1)(e), 4.16, 7.12 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 12 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-12-privacy-safeguard-12-security-of-cdr-data-and-destruction-or-de-identification-of-redundant-cdr-data] | Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.35.0","2025-09-17","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.01","CDR Rule","Data Recipient","MUST","An accredited person must give the CDR consumer a notice that complies with the data standards as soon as practicable after the CDR consumer:\n(a) gives the accredited person a collection consent, use consent or disclosure consent; or\n(b) amends a collection consent, use consent or disclosure consent given to an accredited person in accordance with this Division; or\n(c) withdraws a collection consent, use consent or disclosure consent given to an accredited person in accordance with rule 4.13.","CDR Rule 4.18","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.02","CDR Rule","Data Recipient","MUST","Rule 4.18 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fa) of the principal rules in relation to rule 4.18.","CDR Rule 503","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.03","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST set out: \n• The name of the person the CDR consumer gave consent to; and \n• The purpose of the consent(s); and \n• In the case of a collection consent, the name of each CDR participant the CDR consumer consented to the collection of CDR data from; and \n• In the case of a disclosure consent, the name of each person the CDR consumer consented to the disclosure of CDR data to; and \n• A description of the data for which the consent was given; and \n• In the case of an insight disclosure consent, a description of the CDR insight(s); and \n• The duration or expiry date(s) of the relevant consent; and \n• Instructions for how the consent can be reviewed and, for an active consent, withdrawn, including by using a simple alternative method of communication to be made available by the accredited person for the purposes of withdrawal. ","Notification Standards, CDR Receipts: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.04","CX Standard","Data Recipient","MUST","Effective from 14 July 2025:\n\nA CDR receipt provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.","Notification Standards, CDR Receipts: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.05","CX Standard","Data Recipient","MUST","Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. \n\nNote 1: The information to be included is limited to the following standards: CDR Protections; Review; Data Handling; Complaints; and Insight Records. The scope of information to include will depend on the accredited person’s specific implementation. \n\nNote 2: This standard does not alter any existing rules obligations for CDR receipts or dashboards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Notification record [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_consent-standards_disclosure-consent-non-accredited-person-disclosure-notification]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.06","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.07","CX Guideline","Data Recipient","MAY","CDR Representatives should refer to CDR Rule 4.20O for information on their obligations when providing CDR receipts.","CDR Rule 4.20O","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.08","CX Guideline","Data Recipient","MAY","Data recipients should send CDR receipts via the consumer's preferred delivery channels, other than through the consumer dashboard.",null,"Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active","2025-09-23"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.09","CX Guideline","Data Recipient","MAY","Data recipients should include their CDR policy in their CDR receipts.",null,"Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM3. CDR Receipts","00. CDR Receipts","4CM3.00.10","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts. \n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent. \n\nThe CX Guidelines demonstrate two examples of intuitive groupings for CDR receipts: \n1. collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt; \n2. consolidated receipt for collection, use and disclosure.\n\nData recipients should use their discretion when grouping CDR receipts. Data recipients may consider aligning to how the consents were granted to match the consumers' mental model.","CDR Rule 4.18","Notifications: https://cx.dsb.gov.au/notifications/cdr-receipts","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.01","CDR Rule","Data Recipient","MUST","(1) This rule applies in relation to a collection consent, use consent or disclosure consent given under this Division if:\n(a) the consent is current; and\n(b) 90 days have elapsed since the latest of the following:\n(i) the CDR consumer gave the consent;\n(ia) the CDR consumer last amended the consent;\n(ii) the CDR consumer last used their consumer dashboard;\n(iii) the accredited person last notified the CDR consumer that the consent is still current. \n\n(2) The accredited person must notify the CDR consumer, in relation to each consent given by the CDR consumer that is still current, that the consent is still current. \nNote: This subrule is a civil penalty provision (see rule 9.8).\n\n(3) The notification must be given in accordance with the data standards.\nNote: This subrule is a civil penalty provision (see rule 9.8).","CDR Rule 4.20","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.02","CDR Rule","Data Recipient","MUST","Rule 4.20 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fb) of the principal rules in relation to rule 4.20.","CDR Rule 504","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.03","CX Standard","Data Recipient","MUST","A 90-day notification provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard. ","Notification Standards, 90-day notifications: Delivery [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.04","CX Standard","Data Recipient","MUST","A 90-day notification provided by a data recipient: \n• MUST include the following information:  \n    ◦ The name of the person the CDR consumer gave consent to; and\n    ◦ The purpose of the consent(s); and\n    ◦ Instructions for how the consent(s) can be reviewed, which MAY include details, links, or interactive components that direct the consumer to their consumer dashboard \n• SHOULD include the following information: \n    ◦ In the case of a collection consent, the name of each CDR participant, or number of participants, the CDR consumer consented to the collection of CDR data from; and\n    ◦ In the case of a disclosure consent, the name of each person, or number of persons, the CDR consumer consented to the disclosure of CDR data to; and\n    ◦ The expiry date(s) of the relevant consent. ","Notification Standards, 90-day notifications: Content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.05","CX Guideline","Data Recipient","MAY","The CX Standards for 90-day notifications take effect on 14 July 2025.\n\nThe existing requirements regarding notification of current consents will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 504 (and 507 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to notification of current consents until this date.","CDR Rules 4.20 and 504; 4.20U and 507 | Notification Standards, 90-day Notifications [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.06","CX Guideline","Data Recipient","MAY","CDR Representatives should refer to CDR Rule 4.20U for further information on their obligations when providing ongoing notifications.","CDR Rule 4.20U","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.07","CX Guideline","Data Recipient","MAY","Where a 90-day notification is sent for a single consent, links or interactive components should direct the consumer directly to that consent on the dashboard.",null,"Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.08","CX Guideline","Data Recipient","MAY","Data recipients should provide a consolidated notification when multiple consents align with CDR Rule 4.20(1). Being mindful of the rules and standards, the timing and delivery method of the 90 days reminder should also be considered to manage notification fatigue.","CDR Rule 4.20(1) | Notification Standards, 90-day notifications [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards] | CX Research: 2019 Phase 2, Stream 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e995e5e07e3bdc3ecc]","Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["4CM4. 90-day Notifications","00. 90-day Notifications","4CM4.00.09","CX Guideline","Data Recipient","MAY","Where a consolidated 90-day notification is sent for multiple consents, links or interactive components should direct the consumer to a view of consents that were included in the notification.",null,"Notifications: https://cx.dsb.gov.au/notifications/90-day-notifications","1.33.0","2025-02-27","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.01","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n\n(a) can be used by the CDR consumer to manage authorisations to disclose CDR data in response to the request; and\n(b) contains the details of each authorisation to disclose CDR data specified in subrule (3); and\n(ba) contains any information in the data standards that is specified as information for the purposes of this rule; and\n(bb) contains any information on the Register of Accredited Persons that is specified as information for the purposes of this rule;\n\n(2) Such a service is the data holder’s consumer dashboard for that consumer.\n\nNote: If the consumer data request relates to a joint account, there may be an obligation to provide all joint account holders with consumer dashboards: see rule 4A.13.","CDR Rule 1.15(1)(a),(b),(ba),(bb), (2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.02","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.03","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);\n\n(g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact.","CDR Rule 1.15(3)(f),(g)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.04","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that: \n\n(c) allows the CDR consumer, at any time, to withdraw a current authorisation;","CDR Rule 1.15(1)(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.05","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(a) details of the CDR data that has been authorised to be disclosed","CDR Rule 1.15(3)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.06","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(b) when the CDR consumer gave the authorisation;\n(c) the period for which the CDR consumer gave the authorisation;\n(d) if the authorisation is current—when it is scheduled to expire;\n(e) if the authorisation is not current—when it expired;","CDR Rule 1.15(3)(b)–(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.07","CDR Rule","Data Holder","MUST","(1) For subsection 56EM(1) of the Act, a data holder that discloses CDR data to an accredited person as a result of a consumer data request must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:\n(a) what CDR data was disclosed; and\n(b) when the CDR data was disclosed; and\n(c) the accredited data recipient, identified in accordance with any entry on the Register of Accredited Persons specified as being for that purpose.\n\nNote 1: For correction requests, see section 56EP of the Act (privacy safeguard 13) and Subdivision 7.2.5 of these rules.\n\nNote 2: If a consumer data request is made that relates to a joint account, the other joint account holder’s consumer dashboard may not be required to be similarly updated. See rule 4A.13.\n\nNote 3:  See paragraph 1.15(3)(f).\n\nNote 4: See subrule 1.16(5) for how this rule applies where the CDR data is collected by an accredited person acting as a direct or indirect OSP to the accredited data recipient.","CDR Rule 7.9(1) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.08","CX Guideline","Data Holder","MAY","Data holders should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, archived), or presenting key details up front, such as when consent was granted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.09","CX Guideline","Data Holder","MAY","Data holders should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.  \n\nExample: A consumer may want to sort by data recipient, data cluster, or by a user-defined tag. ","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.10","CX Guideline","Data Holder","MAY","If scrolling is required to view the total number of CDR participants, data holders should provide search functionality.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.11","CX Guideline","Data Holder","MAY","Data holders should organise authorisations using the brand and software product name of the ADR. The logo held at the brand level should also be presented in relation to the authorisation to aid recognition and management.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.12","CX Guideline","Data Holder","MAY","Data holders should use the phrase 'Stop access', 'Stop sharing' or 'Stop data sharing' to refer to how a consumer can withdraw authorisation.\n\nA generic term like ‘stop access’ can refer to withdrawing authorisations or actions. If data holders use this wording, they should clarify its meaning with context-specific explanations. CX research found this wording easy to understand.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.13","CX Guideline","Data Holder","MAY","Data holders should provide CDR Receipts reflecting the details of the authorisation shown on a consumer's dashboard.\n\nCDR Receipts should be provided in writing, such as in an email, when:\n1. Authorisations are successfully established\n2. Authorisations are withdrawn\n3. Authorisations expire\n4. Authorisations are amended\n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.14","CX Guideline","Data Holder","MAY","Data holders should show the status of the consent, which may refer to it being 'active', 'cancelled' or 'expired'.\n\nData holders should also indicate the status of data sharing to consumers, which may include that data sharing has been paused or interrupted.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.15","CX Guideline","Data Holder","MAY","Data holder consumer dashboards should show details of any historical CDR data that was disclosed to reflect the equivalent requirement in rule 4.23(1)(b) for the authorisation flow, see https://cx.cds.gov.au/55de309705a34c7bb34cd6fccdafc9b6.","CDR Rule 4.23(1)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.16","CX Guideline","Data Holder","MAY","Data holders should nudge consumers to be more privacy conscious and should use appropriate interventions to facilitate comprehension and consumer control.\n\nThis can be done in a variety of ways, including through the use of design patterns like progressive disclosure, micro and/or descriptive copy, and with the use of micro-interactions.","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.17","CX Guideline","Data Holder","MAY","This artefact demonstrates how data holders can comply with Privacy Safeguard 10 for the purposes of CDR Rule 7.9(1).\n\nThe data holder can use the authorisation expiry date where they do not know the final disclosure date. The date of final disclosure should be updated as soon as practicable when this date is known.\n\nThis artefact does not demonstrate the requirements for other privacy safeguards referred to in CDR Rule 7.9.","CDR Rule 7.9(1) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2024-04-09"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.18","CX Guideline","Data Holder","MAY","Data holders should use the phrases ‘Granted’, 'Expired', ‘Access period’ and ‘When we've shared your data’ to refer to the time-based qualities of the data sharing arrangement.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.19","CX Guideline","Data Holder","MAY","Data holders should show the account(s) shared as part of the data sharing arrangement. It is at the discretion of data holders to provide functionality to add/remove additional accounts from the data sharing arrangement.","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.20","CX Guideline","Data Holder","MAY","Data holders should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.\n\nThis may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent).","CX Research 8, 19 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.21","CX Guideline","Data Holder","MAY","Data holders should provide a link for consumers to verify a data recipient’s accreditation via the CDR website (https://www.cdr.gov.au/find-a-provider).","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.23","CX Guideline","Data Holder","MAY","Data holders should surface the legal entity name of the data recipient associated with the authorisation","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.11.0","2021-08-05","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.24","CX Guideline","Data Holder","MAY","Privacy Safeguard 10\n\nFor ongoing data sharing: Data holders may include the date range between which CDR data will be disclosed (dates of initial and final disclosure).\n\nFor single or ‘once-off’ disclosure: Data holders may include the date on which the CDR data was disclosed (date of initial disclosure).\n\nNote 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance.\n\nNote 2: Refer to the CDR Rules for exceptions to CDR Rule 7.9 for joint accounts","CDR Rule 7.9 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-10-privacy-safeguard-10-notifying-of-the-disclosure-of-cdr-data]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.11.0","2021-08-05","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.25","CDR Rule","Data Holder","MUST","For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.\n\n(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy:\n(a) electronically; or\n(b) in hard copy;\nas directed by the consumer.","CDR Rule 7.2(8), (9)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.26","CX Guideline","Data Holder","MAY","As per CDR Rule 7.2(8), the CDR policy is required to be made available on each online service ordinarily used to deal with consumers, such as their website and mobile applications, including consumer dashboards.","CDR Rule 7.2(8) | OAIC guidance on Privacy Safeguard 1 [https://www.oaic.gov.au/consumer-data-right/cdr-privacy-safeguard-guidelines/chapter-1-privacy-safeguard-1-open-and-transparent-management-of-cdr-data] | OAIC Guide to developing a CDR policy (Step 5) [https://www.oaic.gov.au/consumer-data-right/guidance-and-advice/guide-to-developing-a-cdr-policy]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.27","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.28","CX Standard","Data Holder","MUST","Data holders MUST advise consumers to check with the relevant data recipient for information about how their data may be handled.\n\nThe precise wording of this message is at the discretion of the data holder. The data holder MAY consider using or paraphrasing the following message:\n\n• ‘You should check with [ADR brand/the data recipient] for more information on how they are handling your data, and for any other permissions you may have given them. See [ADR]’s CDR policy or their Dashboard for more information.’","Dashboard Standards, Data Holder Dashboards, Data Holder Dashboard: Data recipient handling details [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.29","CX Guideline","Data Holder","MAY","Data holders should use the Brand Name of the data recipient wherever the data recipient is referenced in consumer-facing processes, on the consumer dashboard and in relation to the requirement https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.30","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that: \n\n(e) is simple and straightforward to use, and is no more complicated to use than the process for giving the authorisation to disclose CDR data; and\n(f) is prominently displayed and readily accessible to the CDR consumer;","CDR Rule 1.15(1)(e), (f)",null,"1.33.0","2025-02-25","Active"]
["5CM1. DH Dashboard","01. Single occasion disclosure","5CM1.01.01","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n(b) when the CDR consumer gave the authorisation;\n(c) the period for which the CDR consumer gave the authorisation;\n(d) if the authorisation is current—when it is scheduled to expire;\n(e) if the authorisation is not current—when it expired;","CDR Rule 1.15(3)(b),(c),(d),(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active","2022-05-09"]
["5CM1. DH Dashboard","01. Single occasion disclosure","5CM1.01.02","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is absent or 0, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nFor the purposes of dashboards, data holders may consider communicating the sharing period as a single disclosure instance, where the start and end dates are the same.","CDR Rule 4.23(1)(d) | Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active","2025-02-26"]
["5CM1. DH Dashboard","01. Single occasion disclosure","5CM1.01.03","CX Guideline","Data Holder","MAY","If the duration of an authorisation request is greater than 0 but less than 24 hours, data holders are to assume that the ADR is collecting the data on a 'single occasion' as per CDR Rule 4.23(1)(d).\n\nFor the purposes of dashboards, data holders may consider communicating the sharing period as a single disclosure instance within a specific timeframe, where the start and end dates may be on different days.","CDR Rule 4.23(1)(d) | Technical Standards: Request Object [https://consumerdatastandardsaustralia.github.io/standards/#request-object]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.7.0","2021-04-01","Active","2025-02-26"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.01","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.03","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:\n\n(h) details of each amendment (if any) that has been made to the authorisation\n\n(3A) Paragraph (3)(h) applies on and after 1 July 2024.","CDR Rules 1.15(3)(h), (3A)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.04","CX Standard","Data Holder","MUST","When a consumer amends an authorisation in accordance with rule 4.22A, which is linked to a cdr_arrangement_id supplied by the data recipient as per the https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards, data holders MUST display the details of each authorisation’s amendment on the consumer’s dashboard.\n\nNote: This requirement gives effect to CDR Rule 1.15(3)(h)","Dashboard Standards, Data Holder Dashboards, Data Holder Dashboard: Amending authorisation details [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.06","CX Guideline","Data Holder","MAY","As per CDR Rule 1.15(3)(h), data holders are required to display the details of each amendment (if any) that has been made to the authorisation.\n\nThese artefacts demonstrate 2 examples of how these details could be displayed:\n• The summary shown on the Authorisation history summary screen; and\n• The 'amended' labels in relation to specific attributes that have been amended on the Authorisation history details screens.","CDR Rule 1.15(3)(h)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2024-06-12"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.07","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data. Receipts should be given in writing otherwise than through the consumer dashboard, such as via email or SMS, and should be made available on the consumer dashboard. \n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nCDR Receipts should be provided in writing, such as in an email, when: \n1. Authorisations are successfully established\n2. Authorisations are withdrawn \n3. Authorisations expire \n4. Authorisations are amended \n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2024-06-12"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.08","CX Guideline","Data Holder","MAY","Data holders should provide signposting and clear explanatory text to help consumers understand the relationship between previous and more recent authorisations.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.09","CX Guideline","Data Holder","MAY","As per CDR Rules 4.11(1)(a)–(b), 4.12C(1) and 4.23(b)–(c), a collection consent and the corresponding authorisation can be amended to reflect new datasets and/or a new duration.\n\nWhile not required by the rules or standards, the CX Guidelines recommend accounts amended at the time of authorisation also be displayed to facilitate consumer comprehension.","CDR Rules 4.11(1)(a)–(b), 4.12C(1) and 4.23(b)–(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.30.0","2024-06-12","Active","2025-02-26"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.10","CX Guideline","Data Holder","MAY","As per CDR Rule 1.15(3A), data holders must display details of amendments to authorisations that occur on or after 1 July 2024.\n\nWhile not required by the rules or standards, the CX Guidelines recommend displaying details of amendments made to an authorisation before this date. The inclusion of details of all amendments would most align with consumers' mental model and understanding of their authorisations.","CDR Rule 1.15(3A)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.30.0","2024-06-12","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.01","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data. \n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nThe CDR receipt should be given in writing and available through the data holder consumer dashboard.\n\nCDR Receipts should be provided in writing, such as in an email, when: \n1. Authorisations are successfully established\n2. Authorisations are withdrawn \n3. Authorisations expire \n4. Authorisations are amended\n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.02","CX Guideline","Data Holder","MAY","As per Schedule 4, Rule 2.3(1), data holders are required to provide consumer dashboards to CDR consumers who have online access to the relevant account(s).\n\nWhere a consumer does not have online access to the relevant account(s), Schedule 4, Rule 2.3(2) requires data holders to offer a consumer dashboard and provide one if the CDR consumer accepts.","CDR Rule 2.3(1) and 2.3(2) (Schedule 4) | CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.03","CX Guideline","Data Holder","MAY","For the purposes of Schedule 4, Rule 2.3(2), data holders could provide an (optional) CDR Receipt that contains the details of the dashboard offer. While authorisation withdrawal instructions must be provided in the authorisation flow itself, dashboards are expected to be offered to offline customers external to the authorisation flow after authorisation has been granted.","CDR Rule 2.3(2) (Schedule 4) | CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","03. Offline customers","5CM1.03.04","CX Guideline","Data Holder","MAY","It is at the data holder's discretion to determine the actual process of providing a dashboard to an offline customer for the purposes per Schedule 4, Rule 2.3(2). These guidelines demonstrate one possible approach, where the data holder relies on existing authentication credentials and channels successfully used by the offline customer, along with an access code that is unique to the consumer for greater security.\n\nIn this example, the offline consumer could be provided with a standalone dashboard without needing to register for an online account. A data holder could offer or activate online account registration as part of this process.\n\nA data holder could also require registration for an online account for dashboard access where, for example, the dashboard is only available through an existing online portal or mobile app.\n\nA data holder may choose to make the dashboard accessible via an online account or another mechanism. The actual implementation of dashboards for offline customers is at the data holder's discretion and may be contingent on a number of factors, including the data holder's security posture.","CDR Rule 2.3(2) (Schedule 4) | CDR Support Portal: Offline Customer Guidance [https://cdr-support.zendesk.com/hc/en-us/articles/4627046759823-Offline-Customer-Guidance]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.01","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n\n(c) allows the CDR consumer, at any time, to withdraw a current authorisation;\n(d) as part of the process of withdrawing an authorisation, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing an authorisation; ","CDR Rule 1.15(1)(c), (d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.02","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes. ","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.03","CDR Rule","Data Holder","MUST","(1) Where:\n\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co‑approval option or the pre‑approval option applies, or has applied, to the joint account;\n\nthe data holder must provide each relevant account holder with an online service that:\n\n(d) can be used by the relevant account holder to manage approvals in relation to each authorisation to disclose joint account data made by a requester; and\n(e) allows for the withdrawal, at any time, of an approval in relation to each authorisation to disclose joint account data made by a requester; and\n(f) as part of the process for withdrawing an approval in relation to an authorisation, displays a message, in accordance with the data standards, about the consequences of withdrawing an approval in relation to an authorisation;","CDR Rule 4A.13(1)(a)–(b), (d)–(f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.04","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co‑approval option or the pre‑approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(c) contains the details referred to in paragraph 1.15(1)(b) that relate to the joint account data;","CDR Rule 4A.13(1)(a)–(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.05","CDR Rule","Data Holder","MUST","(3) For paragraph (1)(b) and paragraph (5)(a), the information is the following for each authorisation:(a) details of the CDR data that has been authorised to be disclosed;\n(b) when the CDR consumer gave the authorisation;\n(c) the period for which the CDR consumer gave the authorisation;\n(d) if the authorisation is current—when it is scheduled to expire;\n(e) if the authorisation is not current—when it expired;\n(f) information relating to CDR data that was disclosed pursuant to the authorisation (see rule 7.9);\n(g) for a disclosure of CDR data that relates to the authorisation but that was pursuant to a request under subsection 56EN(4) of the Act—that fact;\n(h) details of each amendment (if any) that has been made to the authorisation.","CDR Rule 1.15(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.06","CDR Rule","Data Holder","MUST","(5) For paragraph 1.15(1)(d), if a relevant account holder’s consumer dashboard contains details of approvals under this Division, the dashboards of the other joint account holders must contain those details.","CDR Rule 4A.13(5)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.07","CDR Rule","Data Holder","MUST","(2) Any relevant account holder may withdraw an approval given under this Division at any time, using their consumer dashboard.","CDR Rule 4A.12(2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.08","CDR Rule","Data Holder","MUST","(3) The data holder must, in accordance with any relevant data standards:\n(a) provide for alternative notification schedules (including reducing the frequency of notifications or not receiving notifications); and\n(b) give each joint account holder a means of selecting such an alternative, and of changing a selection.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.09","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to: \n(a) change the disclosure option that applies to the account in accordance with rule 4A.7; and \n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8; and \n(c) respond to a proposal by another joint account holder to change the disclosure option. \n\n(2) Such a service is a disclosure option management service.","CDR Rule 4A.6(1),(2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.10","CX Guideline","Data Holder","MAY","Data holders must show the account(s) shared as part of the authorisation. Whereby:\n• The initiating account holder has visibility of all accounts shared within the authorisation.\n• Non-initiating account holders only have visibility of their shared accounts within the authorisation.","Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.11","CX Guideline","Data Holder","MAY","Inline with CDR Rule 1.15(1)(c), the initiating account holder can withdraw the authorisation, including all accounts. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal#7a89c2da2e5f45468f8b8112ff80159d.","CDR Rule 1.15(1)(c) | CX Guidelines: Withdrawal: Default example [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal#7a89c2da2e5f45468f8b8112ff80159d]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.12","CX Guideline","Data Holder","MAY","As per CDR Rule 4A.13(1)(d)–(h), data holders are required to allow account holders to withdraw one approval at a time. \n\nIn addition to this functionality, data holders may allow the relevant account holder(s) to withdraw approvals in bulk using the equivalent withdrawal mechanism the requester would use to withdraw an authorisation. This would allow the flow to be more intuitive and streamlined for the relevant account holder(s), rather than withdrawing approvals one by one. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7.","CDR Rule 4A.13(1)(d)–(h) | CX Guidelines: Withdrawal: Withdrawing approvals, Pathway 2: Ability to withdraw approvals in bulk [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.13","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.13(1)(d) and CDR Rule 4A.12(2), non-initiating account holders can withdraw approvals for their joint accounts within an authorisation, but cannot withdraw the other accounts shared by the initiating account holder.","CDR Rule 4A.13(1)(d), 4A.12(2) | Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.14","CX Guideline","Data Holder","MAY","Accounts that are no longer shared as part of an authorisation should be displayed as inactive. The precise wording is at the data holder’s discretion.","Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.15","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.14(3) and https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts, data holders may offer an alternative notification schedule to apply at the account level and the customer level. Any account holder(s) may control the frequency and channel of their joint account notifications. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings.","CDR Rule 4A.14(3) | CX Guidelines: CX Notification Standards [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings], Joint account notification settings [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.16","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.6, the data holder must provide joint account holders with a disclosure option management service (DOMS). Any joint account holder can manage account sharing permissions, such as to stop all sharing from an account, through DOMS. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service.","CDR Rule 4A.6 | CX Guidelines: Account permissions, Joint account disclosure option management service [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.17","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.12 and 4A.13, non-initiating account holders can withdraw approval for an account using their consumer dashboard. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7.","CDR Rule 4A.12, 4A.13 | CX Guidelines: Withdrawal: Withdraw an approval, Pathway 1: Withdrawing one approval at a time [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/withdrawal#0ce080bd75bb4563ae7bc3870dabeaf7]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.18","CX Guideline","Data Holder","MAY","Sharing arrangements where no joint accounts are being shared should be displayed as inactive on the non-initiating account holder’s dashboard. The precise wording is at the data holder’s discretion.","Change Request 557: Withdrawal of a SUI by an Account Holder leaving an \"Empty\" Authorisation [https://github.com/ConsumerDataStandardsAustralia/standards-maintenance/issues/557]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.19","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n\n(e) is simple and straightforward to use, and is no more complicated to use than the process for giving the authorisation to disclose CDR data;\n(f) is prominently displayed and readily accessible to the CDR consumer;","CDR Rule 1.15(1)(e), (f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.33.0","2025-02-25","Active"]
["5CM1. DH Dashboard","04. Joint accounts","5CM1.04.20","CDR Rule","Data Holder","MUST","(1) Where: \n(a) this Division applies in relation to a consumer data request; and \n(b) either the co‑approval option or the pre‑approval option applies, or has applied, to the joint account; \n\nthe data holder must provide each relevant account holder with an online service that: \n\n(g) is simple and straightforward to use; and \n(h) is prominently displayed and readily accessible by a relevant account holder.","CDR Rule 4A.13(1)(a)–(b), (g)–(h)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.33.0","2025-02-25","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.01","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.02","CX Standard","Data Holder","MUST","As part of the withdrawal process, the data holder MUST advise the consumer to review the consequences of withdrawal with the Data Recipient before they stop sharing their data.\nThe data holder MAY consider using or paraphrasing the following message(s):\n• ‘You should check with [Data Recipient] before you stop sharing to understand the consequences.’\n• ‘You should check with [Data Recipient] to see if your service will be impacted before you stop sharing.’","Withdrawal Standards, Withdrawing authorisation:\nConsequences [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-19"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.03","CX Standard","Data Holder","MUST","As part of the withdrawal process, the data holder MUST inform the consumer about the handling of redundant data and the right to delete. \nThe data holder MAY consider using or paraphrasing the following message(s):\n• ‘CDR data is either deleted or de-identified when it is no longer required.’\n• ‘[Data Recipient] will have specific policies on how to handle your data once it’s no longer required.’","Withdrawal Standards, Withdrawing authorisation: Redundant data [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2022-05-19"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.04","CX Guideline","Data Holder","MAY","Data holders should use the phrase 'Stop access', 'Stop sharing' or 'Stop data sharing' to refer to how a consumer can withdraw authorisation. \n\nA generic term like ‘stop access’ can refer to withdrawing authorisations or actions. If data holders use this wording, they should clarify its meaning with context-specific explanations. CX research found this wording easy to understand.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active","2025-02-26"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.05","CX Guideline","Data Holder","MAY","Data holders should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences.\n\nData holders may choose to do this via a 2-step authorisation withdrawal process.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.06","CX Guideline","Data Holder","MAY","Data holders should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.07","CX Guideline","Data Holder","MAY","Data holders should provide CDR Receipts reflecting the details of the authorisation shown on a consumer's dashboard.\n\nCDR Receipts should be provided in writing, such as in an email, when:\n1. Authorisations are successfully established\n2. Authorisations are withdrawn\n3. Authorisations expire\n4. Authorisations are amended\n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.08","CDR Rule","Data Holder","MUST","(1) If a data holder receives a consumer data request from an accredited person on behalf of a CDR consumer, the data holder must, in the circumstances specified in a sector Schedule, ensure that it provides the CDR consumer with an online service that:\n(d) as part of the process of withdrawing an authorisation, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing an authorisation;","CDR Rule 1.15(1)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active","2025-02-26"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.09","CDR Rule","Data Holder","MUST","(1) A data holder must keep and maintain records that record and explain the following:\n(b) amendments to or withdrawals of authorisations to disclose CDR data;","CDR Rule 9.3(1)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.10","CX Guideline","Data Holder","MAY","Data holders are expected to record how the withdrawal was requested by the consumer in relation to CDR Rule 9.3(1)(b), but the rules do not require the method of withdrawal to be shown on the dashboard.\n\nHowever, data holders may wish to do this on the dashboard and/or in any CDR Receipt they choose to provide.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.11","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type.\n\nThey can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.12","CX Standard","Data Holder","MUST","Data holders MUST advise consumers to check with the relevant data recipient for information about how their data may be handled.\n\nThe precise wording of this message is at the discretion of the data holder. The data holder MAY consider using or paraphrasing the following message:\n\n• ‘You should check with [ADR brand/the data recipient] for more information on how they are handling your data, and for any other permissions you may have given them. See [ADR]’s CDR policy or their Dashboard for more information.’","Dashboard Standards, Data Holder Dashboards, Data Holder Dashboard: Data recipient handling details [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_dashboard-standards_data-holder-dashboards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.01","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(c) contains the details referred to in paragraph 1.15(1)(b) that relate to the joint account data;","CDR Rule 4A.13(1)(a), (b), (c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.02","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(d) can be used by the relevant account holder to manage approvals in relation to each authorisation to disclose joint account data made by a requester;","CDR Rule 4A.13(1)(a), (b), (d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.03","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(g) is simple and straightforward to use; and\n(h) is prominently displayed and readily accessible by a relevant account holder.\n——————\n(4) A data holder does not contravene subrule (1) in relation to subparagraphs (1)(d)(iii) and (iv) so long as it takes reasonable steps to ensure that the functionality complies with those subparagraphs.","CDR Rule 4A.13(1)(a), (b), (g), (h) and (4)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.04","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(e) allows for the withdrawal, at any time, of an approval in relation to each authorisation to disclose joint account data made by a requester;","CDR Rule 4A.13(1)(a), (b), (e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.05","CDR Rule","Data Holder","MUST","(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(f) as part of the process for withdrawing an approval in relation to an authorisation, displays a message, in accordance with the data standards, about the consequences of withdrawing an approval in relation to an authorisation;","CDR Rule 4A.13(1)(a), (b), (f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.06","CDR Rule","Data Holder","MUST","(2) Where the data holder already provides a consumer dashboard for the relevant account holder under rule 1.15, the service under subrule (1) must be included in the consumer dashboard.\n\n(3) Where the data holder does not already provide a consumer dashboard for that relevant account holder under rule 1.15, the service under subrule (1) is the data holder’s consumer dashboard for the relevant account holder.","CDR Rule 4A.13(2), (3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.07","CDR Rule","Data Holder","MUST","(5) For paragraph 1.15(1)(d), if a relevant account holder’s consumer dashboard contains details of approvals under this Division, the dashboards of the other joint account holders must contain those details. ","CDR Rule 4A.13(5)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.08","CDR Rule","Data Holder","MUST","(1) If a relevant account holder:\n(a) approves of the disclosure of joint account data in accordance with this Division; or\n(b) is taken to have approved of the disclosure under the pre-approval option;\nthe approval is taken to apply while the authorisation referred to in paragraph 4A.10(4)(b) is current, unless withdrawn sooner in accordance with this Division.\n(2) Any relevant account holder may withdraw an approval given under this Division at any time, using their consumer dashboard.","CDR Rule 4A.12","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.09","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(b) to the requester, to inform them that:\n(ii) a relevant account holder has withdrawn an approval previously given;\nin accordance with the data standards.","CDR Rule 4A.14 (1)(b)(ii)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.10","CDR Rule","Data Holder","MUST","(2) The data holder must make the appropriate approval notification to a joint account holder in relation to an event mentioned in subrule (1):\n(a) as soon as practicable after the event occurs, unless the joint account holder has selected an alternative schedule of notifications; and\n(b) through its ordinary means of contacting the joint account holders.","CDR Rule 4A.14(2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.11","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.12","CDR Rule","Data Holder","MUST","A data holder must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.","CDR Rule 4.27","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.13","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2022-05-19"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.14","CX Standard","Data Holder","MUST","As part of the process of removing a joint account approval or changing to a more restrictive disclosure option, the data holder MUST advise the consumer:\n\n1. that doing this may impact existing services, including arrangements initiated by the other account holder(s)\n2. when removing an approval:\n◦ that even though sharing for this service has now stopped, the other account holder(s) can still create new data sharing arrangements for the joint account\n◦ how to change their disclosure option\n\nNote: The exact phrasing of the withdrawal message is at the discretion of the data holder. This standard does not affect data holders’ other notification obligations, including under rule 4A.7(3).","Withdrawal Standards, Withdrawal: Joint accounts [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2022-05-19"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.15","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2022-05-19"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.16","CX Guideline","Data Holder","MAY","As per CDR Rule 4A.13(1)(d)–(h), data holders are required to allow account holders to remove one approval at a time.\n\nIn addition to this functionality, data holders may allow the relevant account holder(s) to remove approvals in bulk using the equivalent withdrawal mechanism the requester would use to withdraw an authorisation. This would allow the flow to be more intuitive and streamlined for the relevant account holder(s) when compared to Pathway 1.","CDR Rule 4A.13(1)(d)–(h)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.17","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.14(3) and CX Notification Standards, data holders may offer an alternative notification schedule to apply at the account level and the customer level. Any account holders may control the frequency and channel of their joint account notifications. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings.","CDR Rule 4A.14(3) | CX Notification Standards [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.18","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.19","CX Guideline","Data Holder","MAY","Data holders should use plain language to describe the call to action for removing an approval. These artefacts use 'stop sharing from this account' and 'stop sharing' to represent this action.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.20","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.14(2) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.14(2), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.21","CX Guideline","Data Holder","MAY","Where an alternative notification schedule is provided as per CDR Rule 4A.14(3), this notification may be omitted at the consumer's request.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.15.0","2021-12-17","Active","2025-02-26"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.22","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type.\n\nThey can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.16.1","2022-05-20","Active"]
["5CM2. DH Withdrawal","01. Withdrawing approvals","5CM2.01.23","CX Guideline","Data Holder","MAY","Inline with CDR Rule 4A.6, the data holder must provide joint account holders with a disclosure option management service (DOMS). Any joint account holder can manage account sharing permissions, such as to stop all sharing from an account, through DOMS. An example of this, on the CX Guidelines website, is https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service.","CDR Rule 4A.6 | CX Guidelines: Account permissions, Joint account disclosure option management service [https://cx.dsb.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/withdrawal","1.29.1","2024-04-09","Active","2025-02-26"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.01","CDR Rule","Data Holder","MUST","(1) For each joint account to which this Part applies, the data holder must provide a service to each joint account holder that allows the joint account holder to:\n(a) change the disclosure option that applies to the account in accordance with rule 4A.7;\n(b) propose a change in the disclosure option to the other joint account holders in accordance with rule 4A.8; and\n(c) respond to a proposal by another joint account holder to change the disclosure option.\n\n(2) Such a service is a disclosure option management service.","CDR Rule 4A.6(1), (2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.02","CDR Rule","Data Holder","MUST","(3) The service must be provided online and, if there is a data holder’s consumer dashboard for a joint account holder, may be included in the dashboard.\n\n(4) The service may, but need not, also be provided other than online.","CDR Rule 4A.6(3), (4)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.03","CDR Rule","Data Holder","MUST","(5) The service must give effect to a change in the disclosure option as soon as practicable.","CDR Rule 4A.6(5)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.04","CDR Rule","Data Holder","MUST NOT","(6) The service must not do any of the following in relation to the processes that it provides for changing or proposing to change the disclosure option that applies to the joint account, or responding to such a proposal (the processes):\n(a) add any requirements to the processes beyond those specified in the data standards and these rules;\n(b) offer additional or alternative services as part of the processes;\n(c) include or refer to other documents, or provide any other information, so as to reduce comprehensibility;\n(d) offer any pre-selected options.","CDR Rule 4A.6(6)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.05","CDR Rule","Data Holder","MUST","(7) The service must indicate to the joint account holder which disclosure option currently applies.","CDR Rule 4A.6(7)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.06","CDR Rule","Data Holder","MUST","(8) The service must be in accordance with the data standards.","CDR Rule 4A.6(8)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","00. DOMS - general","5CM3.00.07","CDR Rule","Data Holder","MUST","(1) Disclosure of joint account data may be authorised only as permitted by the disclosure option that applies to the joint account. This may be any of the following:\n(a) the pre-approval option, under which joint account data may be disclosed in response to a valid consumer data request on the authorisation of the requester without the approval of the relevant account holders;\n(c) the non-disclosure option, under which joint account data may not be disclosed even in response to a valid consumer data request.\n\n(2) The data holder must provide for the pre-approval and non-disclosure options to be available for a joint account.","CDR Rule 4A.5(1)(a), (c) and (2)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.08","CDR Rule","Data Holder","MUST","(1) A joint account holder may at any time choose that the non-disclosure option will apply to the joint account, using the disclosure option management service.","CDR Rule 4A.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.09","CDR Rule","Data Holder","MUST","(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(a) explain to each of them what the consumer data right is;","CDR Rule 4A.7(3)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.10","CDR Rule","Data Holder","MUST","(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(b) inform them which disclosure option previously applied to the account; and\n(c) inform them that account holder A has changed the disclosure option, and of the disclosure option that now applies;","CDR Rule 4A.7(3)(b), (c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.11","CDR Rule","Data Holder","MUST","(3) If a joint account holder (account holder A) changes the disclosure option that applies to the account in accordance with this rule, the data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(d) explain to them the mechanisms for changing the disclosure option again.","CDR Rule 4A.7(3)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.12","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.13","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.14","CX Standard","Data Holder","MUST","As part of the process of removing a joint account approval or changing to a more restrictive disclosure option, the data holder MUST advise the consumer:\n\n1. that doing this may impact existing services, including arrangements initiated by the other account holder(s)\n2. when removing an approval:\n   ◦ that even though sharing for this service has now stopped, the other account holder(s) can still create new data sharing arrangements for the joint account\n   ◦ how to change their disclosure option\n\nNote: The exact phrasing of the withdrawal message is at the discretion of the data holder. This standard does not affect data holders’ other notification obligations, including under rule 4A.7(3).","Withdrawal Standards, Withdrawal: Joint accounts [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.15","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.16","CX Guideline","Data Holder","MAY","Data holders may consider providing a centralised location for managing various CDR account permissions, which could, for example, allow a consumer to access and manage their joint accounts, secondary user instructions, and any appropriate partnership and non-individual permissions. The disclosure option management service (DOMS) could be accessible from this location and in relation to the consumer dashboard.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.17","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.18","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.19","CX Guideline","Data Holder","MAY","Data holders may provide a mechanism for consumers to see a list of authorisations currently sharing data from that joint account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.20","CX Guideline","Data Holder","MAY","Data holders may offer an alternative notification schedule to apply at the account level and the customer level.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.21","CX Guideline","Data Holder","MAY","To aid intuitive disclosure option management, data holders may choose to semantically distinguish pre-approval and co-approval changes from changing to a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.22","CX Guideline","Data Holder","MAY","Existing approvals for specific authorisations are not automatically removed when a non-disclosure option is applied, but the joint account data cannot be shared due to the application of the non-disclosure option. If a joint account is changed from a non-disclosure to enable sharing again, joint account data sharing will recommence for any active authorisations that are associated with that joint account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.23","CX Guideline","Data Holder","MAY","Email is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.7(3) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.7(3), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","01. Change to non-disclosure option","5CM3.01.24","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.17.0","2022-06-08","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.08","CDR Rule","Data Holder","MUST","(1) This rule applies in relation to a particular joint account if:\n(a) the non-disclosure option applies to the account, and a joint account holder (account holder A) proposes, using the disclosure option management service, to change to the co-approval or pre-approval disclosure option;","CDR Rule 4A.8(1)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.09","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(a) explain to each of them what the consumer data right is;","CDR Rule 4A.8(2)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.10","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(b) inform them which disclosure option currently applies to the account;","CDR Rule 4A.8(2)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.11","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(c) inform them that account holder A has proposed that the co-approval or pre-approval option apply to the account, as the case may be;","CDR Rule 4A.8(2)(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.12","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(d) explain to them that this change requires the agreement of all account holders;","CDR Rule 4A.8(2)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.13","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(e) explain to them any alternative options for change that are available and how they can be made;","CDR Rule 4A.8(2)(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.14","CDR Rule","Data Holder","MUST","(2) The data holder must, as soon as practicable through its ordinary means of contacting the other joint account holders:\n(f) invite them to either agree to or reject the proposal within a specified period.","CDR Rule 4A.8(2)(f)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.15","CDR Rule","Data Holder","MUST","(3) At the end of the specified period, the data holder must, as soon as practicable through its ordinary means of contacting the joint account holders, inform them whether:\n(a) all the joint account holders have approved the change, and as a result the new disclosure option applies to the joint account; or\n(b) not all the joint account holders have approved the change, and as a result the disclosure option is unchanged.","CDR Rule 4A.8(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.16","CDR Rule","Data Holder","MUST","ordinary means of contacting an account holder by a data holder means:\n(a) if the data holder has agreed with the account holder on a particular means of contacting the account holder for the purposes of the relevant provision—that means; and\n(b) otherwise—the default means by which the data holder contacts the account holder in relation to the account.","CDR Rule 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.17","CX Standard","Data Holder","MUST","Data holders MUST alert a joint account holder where an action they are about to perform may result in the other joint account holder(s) being notified.\n\nThis standard applies to the authorisation flow, consumer dashboards, and the disclosure option management service where notifications to the other joint account holder(s) may be triggered.\n\nThe precise wording of this notification is at the discretion of the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Contextual alert [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.18","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.19","CX Guideline","Data Holder","MAY","Data holders may consider providing a centralised location for managing various CDR account permissions, which could, for example, allow a consumer to access and manage their joint accounts, secondary user instructions, and any appropriate partnership and non-individual permissions. The disclosure option management service (DOMS) could be accessible from this location and in relation to the consumer dashboard.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.20","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.21","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant CDR Rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.22","CX Guideline","Data Holder","MAY","Data holders may provide a mechanism for consumers to see a list of authorisations currently sharing data from that joint account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.23","CX Guideline","Data Holder","MAY","Data holders may offer an alternative notification schedule to apply at the account level and the customer level.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.24","CX Guideline","Data Holder","MAY","Existing approvals for specific authorisations are not automatically removed when a non-disclosure option is applied, but the joint account data cannot be shared due to the application of the non-disclosure option. If a joint account is changed from a non-disclosure to enable sharing again, joint account data sharing will recommence for any active authorisations that are associated with that joint account.\n\nData holders should inform joint account holders of this fact when changing from a non-disclosure option to pre-approval or co-approval. Data holders may want to provide a way for the joint account holder to see who will access that data when sharing is enabled again, and may want to provide a simple mechanism for removing the approvals for the relevant sharing arrangements.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.25","CX Guideline","Data Holder","MAY","Data holders should indicate to the requester visually that an account requires further actions or approvals before a less restrictive disclosure option is applied.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.26","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.8(2) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.8(2), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.27","CX Guideline","Data Holder","MAY","A push notification is shown as an example notification only. Data holders must use ordinary means of contacting the relevant account holder(s) as outlined in CDR Rules 4A.8(3) and 1.7(1).\n\nA data holder may agree with the account holder on a “particular means of contacting the account holder for the purposes of the relevant provision”.\n\nData holders are required to provide an online disclosure option management service, and may negotiate to provide joint account notifications online in line with this provision even where the consumer otherwise receives notifications via non-digital channels.","CDR Rule 4A.8(3), 1.7(1)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.15.0","2021-12-17","Active"]
["5CM3. DOMS","02. Change disclosure option (less restrictive)","5CM3.02.28","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/joint-account-disclosure-option-management-service","1.17.0","2022-06-08","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.01","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:\n(d) is simple and straightforward to use, and is no more complicated to use than the processes for giving the authorisation or instruction;","CDR Rule 1.15(5)(d)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.02","CDR Rule","Data Holder","MUST","(1) A data holder must provide:\n(e) in relation to each account in relation to which a person has account privileges―a service that can be used by the account holder to: \n(ii) withdraw the instruction.\n\nNote 4: To avoid doubt, a service may be offered in an online form even if this subrule does not require it to be an online service.","CDR Rule 1.13(1)(e)(ii), (Note 4)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.03","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:\n(b) allows the account holder, at any time, to withdraw the secondary user instruction;","CDR Rule 1.15(5)(b)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.04","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that:\n(c) as part of the process of withdrawing a secondary user instruction, displays a message, in accordance with the data standards, about the consequences of proceeding with withdrawing a secondary user instruction;","CDR Rule 1.15(5)(c)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.05","CX Standard","Data Holder","MUST","As part of the secondary user instruction withdrawal process, data holders MUST advise the consumer:\n1. That removing a secondary user instruction will stop all current and future data sharing for the secondary user(s)\n2. To review the consequences of withdrawal with the secondary user(s) before removing the secondary user instruction\n\nNote: The exact phrasing of this message is at the discretion of the data holder.","Withdrawal Standards, Withdrawal: Secondary User Instruction [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.06","CX Guideline","Data Holder","MAY","Consumers may have various account permissions to manage, such as joint account disclosure option management, nominated representative services, and secondary user instructions. To facilitate consumer control and consent management, data holders should provide these services in intuitive and centralised locations in relation to their consumer dashboard.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.07","CX Guideline","Data Holder","MAY","If scrolling is required to view the total number of accounts, data holders should also allow consumers to search and filter their accounts.\n\nFor example: A consumer may want to filter account types or data sharing preferences.","10 Usability Heuristics for User Interface Design: Flexibility and efficiency of use (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active","2025-02-26"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.08","CX Guideline","Data Holder","MAY","Data holders may provide optional functionality that allows a consumer to see which authorisations are associated with the account.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.09","CX Guideline","Data Holder","MAY","Data holders should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences. Data holders may choose to do this via a 2-step authorisation withdrawal process.","CX Research 32 [https://cx.dsb.gov.au/overview/references] | 10 Usability Heuristics for User Interface Design: Error prevention (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.10","CX Guideline","Data Holder","MAY","Data holders should notify the impacted secondary user(s) when their secondary user instruction is withdrawn. If a data holder does implement this functionality, the account owner withdrawing the instruction should be alerted to the fact that the secondary user(s) will be notified when the instruction is withdrawn.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.11","CX Guideline","Data Holder","MAY","Data holders should provide instructions on how to review and manage account permissions as part of the withdrawal process",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.12","CX Guideline","Data Holder","MAY","Data holders should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place.","10 Usability Heuristics for User Interface Design: Visibility of system status (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.13","CX Guideline","Data Holder","MAY","Data holders should provide support pathways at appropriate points throughout the consent model. These may include before and after key decision points, such as confirming or withdrawing a sharing arrangement or permission.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.11.0","2021-08-17","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.14","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.17.0","2022-06-08","Active"]
["5CM4. Secondary Users","01. Remove secondary user instruction","5CM4.01.15","CDR Rule","Data Holder","MUST","(5) If the CDR consumer is a secondary user for an account, the data holder must also provide the account holder with an online service that: \n(e) is prominently displayed and readily accessible to the account holder.","CDR Rule 1.15(5)(e)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/account-permissions/secondary-users","1.33.0","2025-02-26","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.01","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(a) to a relevant account holder, to inform them that the requester has given, amended or withdrawn an authorisation, or that the authorisation has expired;\nin accordance with the data standards.","CDR Rule 4A.14(1)(a)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.02","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(b) to the requester, to inform them that:\n(ii) a relevant account holder has withdrawn an approval previously given;\nin accordance with the data standards.","CDR Rule 4A.14(1)(b)(ii)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.03","CDR Rule","Data Holder","MUST","(1) For this rule, an approval notification is a notice given by the data holder:\n(b) to the requester, to inform them that:\n(i) one or more of the relevant account holders has not given their approval for disclosure within the time frame referred to in paragraph 4A.11(e);\nin accordance with the data standards.","CDR Rule 4A.14(1)(b)(i)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.04","CDR Rule","Data Holder","MUST","(3) The data holder must, in accordance with any relevant data standards:\n(a) provide for alternative notification schedules (including reducing the frequency of notifications or not receiving notifications); and\n(b) give each joint account holder a means of selecting such an alternative, and of changing a selection.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.05","CX Standard","Data Holder","MAY","Data holders MAY allow a consumer to amend their notification schedule in line with existing notification management channels and experiences.\n\nThis MAY, for example, allow the joint account notification schedule to be amended in the same location as other notifications.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Amendment channels [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.06","CX Standard","Data Holder","MAY","For the content of the approval notification, data holders MAY provide the consumer with instructions for how any relevant authorisation(s) or approval(s) can be reviewed.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Notification content [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.07","CX Standard","Data Holder","MAY","Data holders MAY provide a mechanism or entry point for a notification schedule to be amended from or in relation to the notification itself.\n\nThis MAY, for example, allow a consumer to stop receiving the type of notification(s) from the notification itself.\n\nThe notification MAY also, for example, include a link to amend the notification schedule or instructions to direct the consumer to the appropriate place.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Contextual amendment [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.08","CX Standard","Data Holder","MAY","In relation to the joint account alert standards in this section, data holders MAY provide further information about any services or processes in place for supporting vulnerable consumers or reporting risks of physical, psychological, or financial harm or abuse to the data holder.","Notification Standards, Notifications: Joint Account Alerts, Joint account notifications: Further information [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_notifications-joint-account-alerts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.09","CX Standard","Data Holder","MAY","Data holders MAY offer consumers the ability to specify which joint account notifications they do and do not want to receive.\n\nThis MAY, for example, allow a relevant joint account holder to only receive notifications when the requester gives or amends an authorisation.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Granular control [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.10","CX Standard","Data Holder","MAY","Data holders MAY allow consumers to elect to no longer receive any joint account notifications.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Turn off notifications [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.11","CX Standard","Data Holder","MAY","Data holders MAY offer consumers the ability to receive their joint account notifications less frequently and as a periodic summary.\n\nThis MAY, for example, outline all joint account activity at a frequency determined by the data holder and consumer, such as the previous quarter, month, fortnight, and so on.\n\nThis MAY also, for example, be provided with or in relation to other CDR notifications such as a CDR Receipt, which is optional for data holders.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Reduced frequency [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.12","CX Standard","Data Holder","MAY","Data holders MAY inform the consumer of the consequences of amending their joint account notification schedule.\n\nThis notification MAY include instructions for how to amend this schedule or reverse the amendment.","Notification Standards, Alternative Notification Schedules for Joint Accounts, Joint account notifications: Consequences of amendment [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_alternative-notification-schedules-for-joint-accounts]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","2022-06-08"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.13","CX Guideline","Data Holder","MAY","CDR Rule 4A.14(3) requires data holders to:  \n(a) provide for alternative notification schedules (including reducing the frequency of notifications or not receiving notifications), and \n(b) give each joint account holder a means of selecting such an alternative, and of changing an election.\n\nAlternative settings under rule 4A.14(3) only apply to the following notifications in rule 4A.14(1):\n1. The requester has given, amended, or withdrawn an authorisation\n2. Expiration of an authorisation\n3. A relevant account holder hasn’t given approval within the relevant time frame\n4. A relevant account holder has withdrawn an approval\n\nThe standards in this section provide a non-exhaustive list of options that data holders may implement to support their compliance with these rules. The specific implementation of an alternative notification schedule and offering, which may or may not include options listed here, are at the data holder’s discretion. It is the data holder’s responsibility to ensure it is meeting its obligations under the CDR Rules. Compliance with the CDR Rules on alternative notification schedules would require, at a minimum, implementation of a combination of options (being a combination of options listed below, other measures, or both).","CDR Rule 4A.14(1), (3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.14","CX Guideline","Data Holder","MAY","Data holders may offer an alternative notification schedule to apply at the account level and the customer level.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.15","CX Guideline","Data Holder","MAY","Data holders should refer to disclosure options using plain language. A description of the disclosure option should be provided where possible.\n\nThese artefacts use 'single consent' to represent pre-approval disclosure option, 'joint consent' to represent co-approval disclosure option, and 'stop all sharing from this account' or 'data sharing disabled' to represent a non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.16","CX Guideline","Data Holder","MAY","Data holders should provide information about the ADR to relevant account holders. This should include the ADR's name, accreditation number and a link to the their specific page on http://www.cdr.gov.au/find-a-provider for accreditation verification purposes.","CX Research: 2019 Phase 2, Stream 1 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-2-research-reports-2019#block-162f1af016ea80e39057cadc0142713b]; 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.17","CX Guideline","Data Holder","MAY","Where an alternative notification schedule is provided as per CDR Rule 4A.14(3), this notification may be omitted at the consumer's request.","CDR Rule 4A.14(3)","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.18","CX Guideline","Data Holder","MAY","Community consultation suggested that identifying the specific account holder may raise privacy concerns in some instances. Data holders may identify the specific account holder in relation to the relevant rules requirement, but may also deem it necessary to omit these details in certain scenarios in accordance with CDR Rule 4A.15.","CDR Rule 4A.15","Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.19","CX Guideline","Data Holder","MAY","Data recipients should educate consumers about data sharing with the CDR, which may include references to the CDR protections.\n\nCX research has found that including this information increases familiarity, trustworthiness, propensity to consent, and increase the chances of adoption and successful completion.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active","^"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.20","CX Guideline","Data Holder","MAY","Data holders should inform the consumer when a notification schedule change only applies for authorisation withdrawal/expiry and approval withdrawal, and not a change to the non-disclosure option.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.15.0","2021-12-17","Active"]
["5CM5. Joint Account Notification Settings","01. Joint account notifications","5CM5.01.21","CX Guideline","Data Holder","MAY","Data holders can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include information on other elements the account may refer to such as any related plans, services, properties, numbers, and products.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/joint-account-notification-settings","1.17.0","2022-06-08","Active"]

{"sheet":"Retired items","index":2,"n_rows":164,"n_cols":13,"rows_kept":164,"flags":["formulas_cached_only"]}
["Area","Focus area","Checklist ref","Type","Participant","Requirement level","Statement","Reference (file)","Example","Version introduced","Date introduced","Status","Date modified"]
["0AC. Accessibility","01. Manage consent - Dashboard landing page (1)","0AC.01.","CDR Rule","Data Recipient","MUST","(1) This rule applies in relation to a collection consent or a use consent given under this Division if:\n(a) the consent is current; and\n(b) 90 days have elapsed since the latest of the following:\n(i) the CDR consumer gave the consent;\n(ia) the CDR consumer last amended the consent;\n(ii) the CDR consumer last used their consumer dashboard;\n(iii) the accredited person last sent the CDR consumer a notification in accordance with this rule.\n(2) The accredited person must notify the CDR consumer in accordance with this rule that the consent is still current.\nNote: This subrule is a civil penalty provision (see rule 9.8).\n(3) The notification must be given in writing otherwise than through the CDR consumer’s consumer dashboard.\n(4) A copy of the notification may be included in the CDR consumer’s consumer dashboard.","CDR Rule 4.20","CX Guidelines v1.4.0 PDF, p. 92 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2024-02-29"]
["1CO. Consent","00. Consent - general","1CO.00.","CX Standard","Data Recipient","MUST","If a data recipient does not have a policy to delete redundant data, and the consumer has not already requested that their redundant data be deleted:\n\nData recipients MUST allow consumers to elect to have their redundant data deleted as part of the withdrawal process prior to the final withdrawal step.\n\nData recipients SHOULD consider prompting consumers to exercise this right at appropriate times (e.g. when inaction on the part of the consumer may cause them to lose the opportunity to exercise the right to delete their redundant data).","Withdrawal Standards, Withdrawing consent [https://consumerdatastandardsaustralia.github.io/standards/#withdrawal-standards]","CX Guidelines v1.4.0 PDF, p. 65 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CX Guideline","Data Recipient","MAY","Where data recipients are required to withdraw an existing consent prior to, or in the course of, replacing that consent with a new consent, they MAY choose to present the withdrawal process immediately before authentication.\n\nData recipients SHOULD determine the appropriate location, language, and presentation of the withdrawal process.\n\nRefer to the relevant CDR Rules, CX Standards, and CX Guidelines for withdrawal of consent to collection and use.",null,"CX Guidelines v1.4.0 PDF, p. 65 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CDR Rule","Data Recipient","MUST","Data recipients must allow consent to be withdrawn by the consumer at any time by communicating the withdrawal to the data recipient in writing or by using the data recipient’s consumer dashboard.\n\nWhere a consumer chooses to replace an existing consent with a new consent, data recipients must similarly enable consent to be withdrawn by the consumer prior to or in the course of providing a new consent.\n\nIf consent is withdrawn via communication in writing, the data recipient must do so as soon as possible or within 2 business days of receiving this request.","CDR Rule 4.13(1), 4.13(2)(a) | CX Research 15, 31, 32 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 65 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CDR Rule","Data Recipient","MUST","Data recipients must not infer consent or rely on an implied consent.","4.11(1)(e)(Note 1)","CX Guidelines v1.4.0 PDF, p. 52 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","00. Consent - general","1CO.00.","CDR Rule","Data Recipient","MUST NOT","Consent must not be inferred or implied.","CDR Rule 4.11(1)(e)(Note 1)","CX Guidelines v1.4.0 PDF, p. 51 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","01. Seeking consent","1CO.01.","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","01. DH selection","1CO.01.","CX Guideline","Data Recipient","MAY","Data recipients should consider the implications of allowing multiple data holders to be selected in this step as it may impact the quality of consent.\n\nExample: The data recipient allows the consumer to select several data holders at once, complete the authentication and authorisation process for one, and then allow the consumer to return at some point in the future to connect more data holders without reviewing the terms of consent again. This method of reducing friction would compromise the quality of consent if the time between data holder selection and authentication is too great.",null,"CX Guidelines v1.4.0 PDF, p. 68 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","01. DH selection","1CO.01.01","CDR Rule","Data Recipient","MUST","Note 1: An accredited person might need to make consumer data requests to several CDR participants in order to provide the goods or services requested by the CDR consumer, and might need to make regular consumer data requests over a period of time in order to provide those goods or services.\n\nNote 2: These rules will progressively permit consumer data requests to be made in relation to CDR data held by a broader range of data holders within the banking sector, and in relation to a broader range of CDR data, according to the timetable set out in Part 6 of Schedule 3.","CDR Rule 4.4(2)(Note 1), (Note 2)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","01. DH selection","1CO.01.32","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Retired","2025-09-17"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should use the phrase 'Stop Sharing' to refer to how a consumer can withdraw authorisation.","CX Research 29 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 64 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that: \n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’) \n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 57 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CDR Rule","Data Recipient","MUST NOT","Data recipients must not ask the consumer to give consent for the purpose of selling their CDR data unless it is de-identified in accordance with the CDR de-identification process.","CDR Rule 4.12(3)(a)","CX Guidelines v1.4.0 PDF, p. 57 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that:\n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’)\n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 53 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that: \n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’)\n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 51 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.14","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) the following information about withdrawal of consents:\n(ii) instructions for how the consent can be withdrawn;","CDR Rule 4.11(3)(g)(ii) | CX Research 7 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.16","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.17","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.","CDR Rule 4.13(1)(b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.20","CDR Rule","Data Recipient","MUST","For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:\n(a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;\n(b) make a record to evidence the deletion; and\n(c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.","CDR Rule 1.18","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.21","CDR Rule","Data Recipient","MUST","(4) In addition to the information referred to in subsection 56ED(5) of the Act, an accredited data recipient’s CDR policy must:\n(k) include the following information about deletion of redundant CDR data:\n(i) when it deletes redundant data;\n(ii) how a CDR consumer may elect for this to happen;\n(iii) how it deletes redundant data;","CDR Rule 7.2(4)(k)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.24","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.25","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (b), (c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.38","CX Guideline","Data Recipient","MAY","Data recipients should outline how often data is expected to be collected over that period.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.39","CX Guideline","Data Recipient","MAY","Most research participants expected their data to be deleted when sharing was withdrawn or expired. Data recipients can avoid the election step within the consent flow if they have general policy of deletion.\n\nIf data recipients need to include this in-flow election, they should allow the consumer to elect that they ‘remember’ their preference for subsequent requests.","CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.41","CX Guideline","Data Recipient","MAY","Data recipients that have a general policy of deleting consumer data should inform the consumer if they are required to keep data for legal reasons.","CX Research 33 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.11.0","2021-07-01","Retired"]
["1CO. Consent","02. Collection and use consent","1CO.02.42","CX Guideline","Data Recipient","MAY","Data recipient should include their CDR policy in their CDR receipts.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.43","CX Guideline","Data Recipient","MAY","In addition to providing withdrawal instructions, data recipients should provide instructions for how to review sharing arrangements.","CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.44","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","2022-03-08","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.45","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications. The use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","2022-03-08","Retired","2025-03-05"]
["1CO. Consent","02. Collection and use consent","1CO.02.46","CX Guideline","Data Recipient","MAY","Data recipients should surface information about the data deletion process:\n• when data will be deleted;\n• why data may need to be retained (e.g. business or legal reasons);\n• how the data will be deleted, this may include timeframes.","CDR Rule 7.2(4)(k) | CX Research: 2020 Phase 3, Round 3 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea801181fcc3bebca88884]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.16.0","2022-03-08","Retired","2025-03-05"]
["1CO. Consent","03a. ADR uses OSPs","1CO.03a.","CDR Rule","Data Recipient","MUST","If data becomes redundant, data recipients MUST direct any outsourced provider that has been provided with a copy of such data to either:\n• return the redundant data to the data recipient; or\n• delete the redundant data, as well as any CDR data that has been directly or indirectly derived from it, and notify the data recipient of the deletion\n\nIf the outsourced provider has provided any such data to another person, the data recipient MUST direct the outsourced provider to direct said person to:\n• take either of the above mentioned steps; and\n• cause similar directions to be made to any person to whom such data has been further disclosed","CDR Rule 7.12(2)(b)","CX Guidelines v1.4.0 PDF, p. 59, 63 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","03a. ADR uses OSPs","1CO.03a.","CDR Rule","Data Recipient","MUST","(1) If an accredited person is the principal in a CDR outsourcing arrangement, it must ensure that the provider complies with its requirements under the arrangement. ","CDR Rule 1.16(1)","CX Guidelines v1.4.0 PDF, p. 59 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO. Consent","03a. Using OSPs","1CO.03a.04","CX Guideline","Data Recipient","MAY","CDR participants may want to note where an OSP is accredited, which the research suggested would facilitate trustworthiness in the process.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03a. Using OSPs","1CO.03a.05","CX Guideline","Data Recipient","MAY","Data recipients should provide a high level of transparency, control, and certainty around all parties who may collect or access the data in any way.\n\nData recipients can do this by surfacing relevant information and obligations regarding such parties and providers that would otherwise be found in CDR policies.","CX Research: 2020 Phase 3, Round 4 and 5 report [https://cx.dsb.gov.au/overview/cx-reports/reports/phase-3-research-reports-2020#block-162f1af016ea800d9688dfc8e48f39af]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.05","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(h) replace paragraph 4.11(3)(i) with the following:\n“(i) the fact that the person is a CDR representative and that the CDR data will be collected by its CDR principal at its request;\n(j) if the CDR representative is not located in Australia—the country in which it is located;\n(k) the CDR principal’s name; and\n(l) the CDR principal’s accreditation number;\n(m) a link to the principal’s CDR policy; and\n(n) a statement that the CDR consumer can obtain further information about such collections or disclosures from the CDR principal’s CDR policy if desired.”;","CDR Rule 4.3(C)(1)(h)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.07","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(a) replace references to the accredited person with references to the CDR representative, except in the following (the exceptional provisions):\n(i) Subdivision 4.3.2B;\n(b) in the exceptional provisions, replace references to the accredited person with references to the CDR principal;","CDR Rule 4.3C(1)(a)(i), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.08","CDR Rule","Data Recipient","MUST","(5) Where a CDR representative principal makes a consumer data request at the request of a CDR representative, it may arrange for the CDR representative to provide the consumer dashboard on its behalf.","CDR Rule 1.14(5)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.09","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(c) replace references to the goods and services provided by the accredited person with references to the goods or services provided by the CDR representative;","CDR Rule 4.3C(1)(c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.10","CDR Rule","Data Recipient","MUST","(1) The CDR principal must ensure that, when the CDR representative asks for the CDR consumer’s consents, it does so in accordance with Division 4.3, applied with the following modifications:\n(a) replace references to the accredited person with references to the CDR representative, except in the following (the exceptional provisions):\n(ii) Subdivision 4.3.5, other than paragraph 4.18(2)(c); and\n(b) in the exceptional provisions, replace references to the accredited person with references to the CDR principal;","CDR Rule 4.3C(1)(a)(ii), (b)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.11","CDR Rule","Data Recipient","MUST","4.20B Application of Subdivision to CDR principal and CDR representative \nWhere an accredited person who is a CDR principal is required under this Subdivision to give a notice to a CDR consumer in relation to a consumer data request made at the request of a CDR representative, the notice may be given through the CDR representative.","CDR Rule 4.20B","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.14","CX Guideline","Data Recipient","MAY","As noted in CDR Rules 4.20J and 1.14(5), where a CDR principal makes consumer data requests at the request of a CDR representative, the CDR representative may provide the consumer dashboard on the CDR principal's behalf.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.17","CX Guideline","Data Recipient","MAY","Various rules require specific entities to provide certain items, such as dashboards and notifications, and may also require the principal to be referenced. These guidelines demonstrate how this information may generally be displayed so that, where appropriate, the consumer is primarily engaging with the known entity that they have a relationship with, and the principal is only noted as a background detail.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.18","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.3A(2), a CDR representative may ask the consumer to give a collection consent for the CDR principal to collect data; a use consent for the CDR principal to disclose the data to the representative; and another use consent for the representative to use that data to provide goods or services. \n\nIn practice, these use consents may be presented to the consumer as a single consent with two purposes, as demonstrated in these examples, rather than two separate use consents. The details on the use consent relating to the CDR principal's involvement can be surfaced in a separate component, such as the 'supporting parties' design contained in this flow.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2024-05-01"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.19","CX Guideline","Data Recipient","MAY","As per rule 4.20M, if a CDR participant does not have a general policy of deleting redundant data, then the consumer may elect that the collected data, and any data derived from it, be deleted when it becomes redundant data. They may do this when giving the consent as per rule or at any other time before the consent expires. The consumer may make this election using their consumer dashboard, or in writing to the CDR principal or CDR representative.",null,"Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.20","CX Guideline","Data Recipient","MAY","As per rule 4.20J, withdrawing consents using a simple alternative method of communication can be to the CDR representative principal or the CDR representative.\nWhen seeking to address the requirements of rule 4.20E(3)(m)(ii), recipients should include the method of communication for the party the consumer is most familiar with.\n\nCDR representative principals must include the details of the simple method of communication in their CDR policy.\n\nWhere a consumer contacts the CDR representative principal, rather than the CDR representative, the  principal may also choose to present contact details that align with the brand, name, or domain of the CDR representative to maintain consistency in the interaction.","CDR Rule 4.20J, 4.20E(3)(m)(ii) | 10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.15.0","2021-12-23","Retired","2025-03-05"]
["1CO. Consent","03c. CDR representative arrangement ","1CO.03c.28","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to a CDR representative for the purposes of this Division may withdraw the consent at any time:\n(a) by using the CDR representative principal’s consumer dashboard; or\n(b) by using:\n(i) a method mentioned in subrule (2) to notify the CDR representative principal; or\n(ii) a method mentioned in subrule (3) to notify the CDR representative.\nNote 1: The CDR representative principal may allow the CDR representative to provide the consumer dashboard on its behalf—see subrule 1.14(5).\nNote 2: If the withdrawal is made using the consumer dashboard, it has effect immediately (see rule 4.20K).\n(2) The CDR representative principal must make available a simple method of communication for the withdrawal of consent, as an alternative to using the CDR representative principal’s consumer dashboard.\nNote 1: The CDR representative principal may allow the CDR representative to provide the consumer dashboard on its behalf—see subrule 1.14(5).\nNote 2: This subrule is a civil penalty provision (see rule 9.8).\n(3) The CDR representative must make available a simple method of communication for the withdrawal of consent, as an alternative to using the CDR representative principal’s consumer dashboard.\nNote: A failure to do this could make the CDR representative principal liable for a civil penalty (see rule 1.16A).","CDR Rule 4.20J(1)–(3)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.13","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (b), (c)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO. Consent","04. Business consumer statement","1CO.04.14","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/collection-and-use-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO0. Pre-Consent","01. Product value proposition","1CO0.01.","CDR Rule","Data Recipient","MUST NOT","Data recipients MUST NOT bundle consent with unrelated purposes.\n\nData recipients MUST NOT infer consent or rely on an implied consent.","CDR Rule 4.10(b)(ii), 4.11(1)(Note 1) |  CX Research 36 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 37 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","01. Product value proposition","1CO0.01.","CX Guideline","Data Recipient","MAY","Data recipients should build trust and onboard the consumer to the service itself before presenting a data request.","CX Research 1, 25, 28, 31 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 37 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CX Guideline","Data Recipient","MAY","Consent should be a genuine choice. Data recipients should avoid making consent a precondition of service.","CX Research 26 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CX Guideline","Data Recipient","MAY","The data recipient should include CDR branding (for example, a CDR logo) as provided by the ACCC where appropriate.","CX Research 23 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CX Guideline","Data Recipient","MAY","Data recipients should clearly communicate the value of sharing data as part of the CDR.","CX Research 25 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","02. CDR value proposition - CDR information","1CO0.02.","CDR Rule","Data Recipient","MUST","Data recipients MUST conform with the CDR Rules on consent, including that consent must be voluntary; express; informed; specific as to purpose; time limited; and easily withdrawn.","CDR Rule 4.9","CX Guidelines v1.4.0 PDF, p. 39 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","03. CDR value proposition - Accreditation information","1CO0.03.","CX Guideline","Data Recipient","MAY","The ability to go backwards should be present and visible wherever possible throughout the consent flow to ensure user control and freedom.","10 Usability Heuristics for User Interface Design: User control and freedom (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","CX Guidelines v1.4.0 PDF, p. 40 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","03. CDR value proposition - Accreditation information","1CO0.03.","CX Guideline","Data Recipient","MAY","The data recipient should use CDR branding provided by the ACCC to facilitate consistency, familiarity, and trust in the CDR ecosystem.\n\nThe data recipient should provide instructions for how consumers can verify a data recipient’s accreditation via an ACCC-provided URL once the ACCC makes this functionality available.","CX Research 13, 23 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 40 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","03. CDR value proposition - Accreditation information","1CO0.03.","CDR Rule","Data Recipient","MUST","The data recipient must present their name and accreditation number to the consumer.","CDR Rule 4.11(3)(a),(b)","CX Guidelines v1.4.0 PDF, p. 40 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CX Guideline","Data Recipient","MAY","CDR information should have full translation functionality and be fully screen-reader accessible.","CX Research 16 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CX Guideline","Data Recipient","MAY","Data recipients should clearly state key things that are important to their customers. This should include how data will not be used, even if these uses are prohibited CDR. \n\nExamples may include:\n- We don’t share or use your data without your consent\n- We don’t sell your data to anyone \n- We don’t share your data for marketing purposes","CX Research 24 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CX Guideline","Data Recipient","MAY","Data recipients should provide information, where applicable, about measures taken in case of security breaches.","CX Research 14 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","04. CDR value proposition - Data sharing rules (1)","1CO0.04.","CDR Rule","Data Recipient","MUST","Data recipients MUST include clear and unambiguous information on how CDR data will be handled upon consent expiry/withdrawal. This SHOULD be presented up front, and wherever applicable throughout the consent model.","CDR Rules 4.9, 4.11(3)(h) | CX Research 33 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 41 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","05. CDR value proposition - Data sharing rules (2)","1CO0.05.","CX Guideline","Data Recipient","MAY","Consent should be a genuine choice. Data recipients should avoid making consent a precondition of service.","CX Research 26 [https://cx.dsb.gov.au/overview/references]","CX Guidelines v1.4.0 PDF, p. 42 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","05. CDR value proposition - Data sharing rules (2)","1CO0.05.","CDR Rule","Data Recipient","MUST","The CDR policy MUST be available through online services where the data recipient ordinarily deals with CDR consumers.\n\nIt MUST be in the form of a document that is separate from the data recipient’s private policy","CDR Rules 7.2(8), 7.2(2)","CX Guidelines v1.4.0 PDF, p. 42 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","07. CDR value proposition - CDR data sharing instructions","1CO0.07.","CX Guideline","Data Recipient","MAY","Data recipients should provide simple, upfront instructions on how to share data with the CDR, including the time it takes to complete the process. \n\nFor example: ‘This should only take a few minutes.’",null,"CX Guidelines v1.4.0 PDF, p. 46 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO0. Pre-Consent","07. CDR value proposition - CDR data sharing instructions","1CO0.07.","CX Guideline","Data Recipient","MAY","Data recipients should use the terms Consent, Connect, Confirm to represent each major stage of the consent flow. \n\nThese terms should be used throughout the flow to maintain consistency and to help users to become familiar with sharing steps.","10 Usability Heuristics for User Interface Design: Consistency and standards (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","CX Guidelines v1.4.0 PDF, p. 46 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-16"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.01","CDR Rule","Data Recipient","MUST NOT","(1A) An accredited person must not ask a CDR consumer to give a disclosure consent in relation to CDR data unless the consumer has already given the collection and use consents required to collect the CDR data to be disclosed.","CDR Rule 4.11(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.12","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) the following information about withdrawal of consents:\n(ii) instructions for how the consent can be withdrawn;","CDR Rule 4.11(3)(g)(ii) | CX Research 7 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.14","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.15","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time: \n(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.","CDR Rule 4.13(1)(b)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.18","CDR Rule","Data Recipient","MUST","For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:\n(a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;\n(b) make a record to evidence the deletion; and\n(c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.","CDR Rule 1.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.21","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.22","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.23","CX Standard","Data Recipient","MUST","If: \n1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient;\n\nand the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable.\n\nNB: This is a subset of the CX Standard referenced.","Consent Standards, Disclosure consent: Descriptions of Data to be Collected and Disclosed [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.27","CX Standard","Data Recipient","MUST","Data recipients MUST notify consumers of redirection prior to authentication.","Consent Standards, Consent: Redirection [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.33","CX Guideline","Data Recipient","MAY","Data recipient should include their CDR policy in their CDR receipts.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.11.0","2021-07-01","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","00. AP disclosure consent - general","1CO1.00.34","CDR Rule","Data Recipient","MUST","(1A) In the case of a consent given by a CDR business consumer that includes a business consumer statement, an accredited person must:\n(a) not specify a period of time that is more than 7 years; and\n(b) if specifying a period of time of more than 12 months, give the CDR business consumer the option of choosing a period for the consent of 12 months or less.","CDR Rule 4.12(1A)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.29.1","2024-03-06","Retired","2025-03-19"]
["1CO1. AP Disclosure Consent","03. AP disclosure consent - Bundled CDR consents","1CO1.03.30","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/accredited-person-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-15"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.05","CDR Rule","Data Recipient","MUST NOT","(5) The accredited person must not give such an invitation before 1 July 2021.","CDR Rule 4.12B(5)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2024-05-01"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.30","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.32","CDR Rule","Data Recipient","MUST","(2A) A CDR receipt given for the purposes of paragraph (1)(aa) must set out details of each amendment that has been made to the consent.","CDR Rule 4.18(2A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","00. Amending consent - general","1CO2.00.65","CX Guideline","Data Recipient","MAY","The CX Standards for CDR Receipts take effect on 14 July 2025.\n\nThe existing requirements regarding CDR receipts will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 503 (and 506 for CDR representatives).\n\nData recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to CDR receipts until this date.","CDR Rules 4.18 and 503; 4.20O and 506 | Notification Standards, CDR Receipts [https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience_notification-standards_cdr-receipts]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.33.0","2025-03-05","Retired","2025-08-04"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.18","CDR Rule","Data Recipient","MUST","(2) Despite subrule 4.11(2), in the case of an amendment to a consent, an accredited person may present, as pre-selected options, the following details of the current consent:\n(a) the selections or indications referred to in paragraphs 4.11(1)(a), (b) and (ba);\n(b) the election (if any) referred to in paragraph 4.11(1)(e).","4.12C(2)(a),(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.21","CDR Rule","Data Recipient","MUST","(3) When asking a CDR consumer to give consent, the accredited person must give the CDR consumer the following information:\n(g) the following information about withdrawal of consents:\n(ii) instructions for how the consent can be withdrawn;","CDR Rule 4.11(3)(g)(ii) | CX Research 7 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.23","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(a) by using the accredited person’s consumer dashboard;","CDR Rule 4.13(1)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.24","CDR Rule","Data Recipient","MUST","(1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:\n(b) by using a simple alternative method of communication to be made available by the accredited person for that purpose.","CDR Rule 4.13(1)(b)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.27","CDR Rule","Data Recipient","MUST","For these rules, the CDR data deletion process in relation to a person that holds CDR data that is to be deleted consists of the following steps:\n(a) delete, to the extent reasonably practicable, that CDR data and any copies of that CDR data;\n(b) make a record to evidence the deletion; and\n(c) where another person holds the CDR data on its behalf and will perform those steps—direct that person to notify it when those steps have been performed.","CDR Rule 1.18","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.28","CDR Rule","Data Recipient","MUST","(4) In addition to the information referred to in subsection 56ED(5) of the Act, an accredited data recipient’s CDR policy must:\n(f) include the following information about deletion of redundant CDR data:\n(i) when it deletes redundant data;\n(ii) how a CDR consumer may elect for this to happen;\n(iii) how it deletes redundant data;","CDR Rule 7.2(4)(k)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.41","CX Guideline","Data Recipient","MAY","Data recipients should provide the cdr_arrangement_id of the consent to the data holder as part of the amendment process. This will provide consumers with a streamlined authorisation experience as required in the amending authorisation standards.","Amending Authorisation Standards [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.47","CX Guideline","Data Recipient","MAY","Data recipients should outline how often data is expected to be collected over that period.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.48","CX Guideline","Data Recipient","MAY","Most research participants expected their data to be deleted when sharing was withdrawn or expired. Data recipients can avoid the election step within the consent flow if they have general policy of deletion.\n\nIf data recipients need to include this in-flow election, they should allow the consumer to elect that they ‘remember’ their preference for subsequent requests.","CX Research 18 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.50","CX Guideline","Data Recipient","MAY","Data recipients should surface information about data deletion found in their CDR policy along with a link to read this policy.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.51","CX Guideline","Data Recipient","MAY","Data recipients that have a general policy of deleting consumer data should inform the consumer if they are required to keep data for legal reasons.","CX Research 33 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.52","CX Guideline","Data Recipient","MAY","Data recipient should include their CDR policy in their CDR receipts.",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.11.0","2021-07-01","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.53","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient.","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Retired","2025-03-05"]
["1CO2. Amending Consent","01. Amending data and duration","1CO2.01.54","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications. The use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.16.1","2022-04-07","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.16","CDR Rule","Data Recipient","MUST","(2) Despite subrule 4.11(2), in the case of an amendment to a consent, an accredited person may present, as pre‑selected options, the following details of the current consent:\n(a) the selections or indications referred to in paragraphs 4.11(1)(a), (b) and (ba);","CDR Rule 4.12C(2)(a)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.17","CDR Rule","Data Recipient","MUST","(2A) A CDR receipt given for the purposes of paragraph (1)(aa) must set out details of each amendment that has been made to the consent.","CDR Rule 4.18(2A)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.19","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.33","CX Guideline","Data Recipient","MAY","ADRs should present attributes to be amended in a way that is clearly distinct to attributes that have already been consented to. This may require specific design patterns and/or the use of signifiers, such as 'new' labels, to denote the change being requested.","Amending Authorisation Standards, Authorisation: Changing Attributes [https://consumerdatastandardsaustralia.github.io/standards/#amending-authorisation-standards]","Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO2. Amending Consent","02. Amending business consumer disclosure consent - Detached flow","1CO2.02.34","CX Guideline","Data Recipient","MAY","Data recipients should include their CDR policy in their CDR receipts. ",null,"Consent: https://cx.cds.gov.au/consent/amending-consents","1.30.0","2024-05-01","Retired","2025-03-05"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.07","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.08","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.18","CX Guideline","Data Recipient","MAY","CX research suggested that, where a consumer does not have an existing relationship with a non-accredited person or trusted adviser, additional information from an independent source can increase confidence levels and informed consent. \n\nData recipients may provide this information during the pre-consent phase, outside of the CDR system.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-10-03"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.19","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.20","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.21","CX Guideline","Data Recipient","MAY","Data recipients may present a list of trusted advisers for the consumer to choose from.\n\nAlternatively, data recipients may specify a nominated trusted adviser where the sole purpose of the collection consent is to disclose the data to a specific trusted adviser.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","00. Trusted Adviser disclosure consent - general","1CO3.00.31","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.\n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.\n\nThe CX Guidelines demonstrate an intuitive grouping that presents collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt. This allows the receipts to be grouped according to relevant CDR Participant pairings.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.06","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.07","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.13","CX Standard","Data Recipient","MAY","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the Data Holder and Data Recipient.","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.14","CX Standard","Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications. The use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.18","CX Guideline","Data Recipient","MAY","CX research suggested that, where a consumer does not have an existing relationship with a non-accredited person or trusted adviser, additional information from an independent source can increase confidence levels and informed consent. \n\nData recipients may provide this information during the pre-consent phase, outside of the CDR system.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-10-03"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.19","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.20","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2025-03-19"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.21","CX Guideline","Data Recipient","MAY","Data recipients may specify a nominated trusted adviser where the sole purpose of the collection consent is to disclose the data to a specific trusted adviser.\n\nAlternatively, data recipients may present a list of trusted advisers for the consumer to choose from.",null,"Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.16.1","2022-04-01","Retired","2024-03-06"]
["1CO3. Trusted Adviser Disclosure Consent","01. Trusted Adviser disclosure consent - Bundled CDR consents","1CO3.01.53","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/trusted-adviser-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-15"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.08","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.09","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.24","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.25","CX Guideline","Data Recipient","MAY","CX research suggested that, where a consumer does not have an existing relationship with a non-accredited person or trusted adviser, additional information from an independent source can increase confidence levels and informed consent. \n\nData recipients may provide this information during the pre-consent phase, outside of the CDR system.","CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.26","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.42","CX Guideline","Data Recipient","MAY","As per CDR Rule 4.18, data recipients are required to provide CDR receipts.\n\nWhere separate consents are granted in a single flow, data recipients may provide a single CDR receipt that contains the details of each consent, or separate CDR receipts per consent.\n\nThe CX Guidelines demonstrate an intuitive grouping that presents collection and use consent details in one CDR receipt, and disclosure consent details in a separate CDR receipt. This allows the receipts to be grouped according to relevant CDR Participant pairings.","CDR Rule 4.18","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","00. Insights disclosure consent - general","1CO4.00.43","CX Guideline","Data Recipient","MAY","As per CDR Rules 4.11(3)(ca) and 4.18(2)(c), if data recipients show the actual insight(s) during the consent flow, they are also required to show the actual insight(s) in the CDR receipt.","CDR Rule 4.11(3)(ca), 4.18(2)(c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.16.1","2022-04-07","Retired","2025-03-19"]
["1CO4. Insights Disclosure Consent","01. Insights disclosure consent - Bundled CDR consents","1CO4.01.43","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/insight-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-12"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.16","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided","CDR Rule 4.18(2)(a), (ba), (c)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.17","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4)","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.30","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to non-accredited person data handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• during Consent, as required by the data standards in relation to data handling and disclosure notifications;\n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","00. Business consumer disclosure consent - general","1CO5.00.31","CX Guideline","Data Recipient","MAY","Data recipients may meet standards requirements in relation to complaint handling at appropriate points throughout the Consent Model, such as:\n• during Pre-consent;\n• within the Consent Flow, prior to disclosure to the non-accredited person, as required by the data standards; \n• within the CDR Receipt and/or Consumer Dashboards, as required by the disclosure notification standards.","Consent Standards, Disclosure Consent: Non-Accredited Person Disclosure Notification, Disclosure consent: Complaints [https://consumerdatastandardsaustralia.github.io/standards/#consent-standards] | CX Research: 2020 Phase 3, Round 8 summary [https://github.com/ConsumerDataStandardsAustralia/standards/files/7543243/2020.Disclosure.research.summary.pdf]; 2021 Disclosure Consent report [https://cx.dsb.gov.au/overview/cx-reports/reports/disclosure-consent-research-report-q4-2021-r1-2]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.30.0","2024-05-01","Retired","2025-03-19"]
["1CO5. Business Consumer Disclosure Consent","01. Business consumer disclosure consent - Bundled CDR consents","1CO5.01.50","CX Guideline","Data Recipient","MAY","Data recipients should refer to data holder brand names in the provider selection list.","10 Usability Heuristics for User Interface Design: Match Between the System and the Real World (Nielsen) [https://www.nngroup.com/articles/ten-usability-heuristics/]","Consent: https://cx.cds.gov.au/consent/disclosure-consents/business-consumer-disclosure-consents","1.34.0","2025-03-19","Retired","2025-09-12"]
["2AU. Redirect to Web with OTP","00. Authenticate - general","2AU.00.03","CX Standard","Data Holder, Data Recipient","MUST","Data holders and data recipients MUST state in consumer-facing interactions and communications that services utilising the CDR do not need access to consumer passwords for the purposes of sharing data. The exact phrasing of this is at the discretion of the data holder and data recipient.","Authentication Standards, Authentication: Passwords [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 21 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.04","CX Standard","Data Holder, Data Recipient","MUST","Data holders and data recipients MUST clearly refer to a “One Time Password” in consumer-facing interactions and communications.\n\nThe use of the term “One Time Password” MAY be presented alongside an existing term used by a data holder (e.g. Netcode, one time pin etc.).","Authentication Standards, Authentication: ‘One Time Password’ (OTP) [https://consumerdatastandardsaustralia.github.io/standards/#authentication-standards] | CX Research 10 [https://cx.dsb.gov.au/overview/references]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-22"]
["2AU. Redirect to Web with OTP","03. One Time Password","2AU.03.09","Technical Standard","Data Holder","MUST NOT","Data Holders MUST NOT request that the customer enter an existing password in the redirected page.","Security Profile: Authentication Flows [https://consumerdatastandardsaustralia.github.io/standards/#authentication-flows]","Authenticate: https://cx.cds.gov.au/authenticate/redirect-with-one-time-password","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-09-22"]
["3AU. Authorisation to disclose","01. Account selection","3AU.01.","CX Standard","Data Holder","MUST","Data holders MUST allow the consumer to select which of their accounts to share data from if the data request includes account-specific data and if there are multiple accounts available. The Data holder MAY omit this step if none of the data being requested is specific to an account (e.g. Saved Payees).\n\nData holders MAY add a ‘profile selection’ step or equivalent prior to the account selection step if a single identifier provides access to different customer accounts. For example, one customer ID may give access to business customer and individual customer accounts. The ‘profile selection’ step SHOULD only be considered if it is an existing customer experience, and SHOULD be as minimal as possible to avoid introducing unwarranted friction (having regard to CDR Rule 4.24).\n\nIf certain accounts are unavailable to share, data holders SHOULD show these unavailable accounts in the account-selection step.\n• Data holders SHOULD communicate why these accounts cannot be selected, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n• Data holders MAY provide instructions on how to make these accounts available to share, and this SHOULD be communicated as in-line help or as a modal to reduce on-screen content.\n• Note: Unavailable accounts are to be interpreted in accordance with the rules on eligible consumers and required consumer data.","Authorisation Standards, Authorisation & Account selection [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards] | CX Research 9 [https://cx.dsb.gov.au/overview/references]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["3AU. Authorisation to disclose","03. Unavailable accounts - All accounts can be shown","3AU.03.05","CX Standard","Data Holder","MAY","If a successfully authenticated user cannot proceed to establish an authorisation in accordance with the rules on eligible consumers and required consumer data, data holders MAY provide the option of concluding the authorisation process.","Authorisation Standards, Unavailable Accounts: Authorisation not permitted [https://consumerdatastandardsaustralia.github.io/standards/#authorisation-standards]","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.11.0","2021-08-17","Retired","2025-09-24"]
["3AU. Authorisation to disclose","04. Data related to one or no accounts","3AU.04.04","CX Guideline","Data Holder","MAY","Data holders should include a message indicating that some accounts may not be shown, and instructions on where the consumer can find more information.",null,"Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose","1.7.0","2021-04-01","Retired","2021-10-25"]
["3AU2. Joint Account Authorisation","03. Co-approval joint accounts","3AU2.03.18","CDR Rule","Data Holder","MUST","Obligation for data holder to provide relevant account holders with consumer dashboard\n(1) Where:\n(a) this Division applies in relation to a consumer data request; and\n(b) either the co-approval option or the pre-approval option applies, or has applied, to the joint account;\nthe data holder must provide each relevant account holder with an online service that:\n(c) contains the details referred to in paragraph 1.15(1)(b) that relate to the joint account data; and\n(d) has a functionality that:\n(i) can be used by the relevant account holder to manage approvals in relation to each authorisation to disclose joint account data made by a requester; and\n(ii) allows for withdrawal, at any time, of such an approval; and\n(iii) is simple and straightforward to use; and\n(iv) is prominently displayed; and\n(v) as part of the withdrawal process, displays a message relating to the consequences of the withdrawal in accordance with the data standards.","CDR Rule 4A.13","Authorise: https://cx.cds.gov.au/authorise/authorisation-to-disclose-joint-account-data","1.15.0","2021-12-17","Retired","2025-02-26"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Recipient","MAY","Data recipients should make a link to the CDR policy accessible on the dashboard.",null,"CX Guidelines v1.4.0 PDF, p. 100 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Recipient","MAY","Data recipients should structure the ‘purpose’ and ‘use’ statements in ways that:\n\n1. Are specific as to purpose (e.g. ‘Why we need it’ for each data cluster)\n2. Refer to the broader ‘use case’ or ‘uses’ (e.g. ‘to pre-populate your application’)\n3. Relate to the product/service being provided (e.g. ‘so BudgetGuide can help you manage your budget’)\n\nThis information should be framed in a way that communicates the benefit of data sharing to the consumer.",null,"CX Guidelines v1.4.0 PDF, p. 96 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Recipient","MAY","Data recipients should provide a link to the CDR policy in the consumer dashboard.",null,"CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.","CX Guideline","Data Holder, Data Recipient","MAY","Following an authorisation the consumer should be directed back to the data recipient and presented with a 'confirmation' screen.\n\nThis 'confirmation' screen may be presented in the data recipient dashboard.\n\nData recipients and data holders should provide the consumer with a contextual 'walkthrough’ or ‘tutorial' to introduce them to the concept of the dashboard if they are not familiar with it.",null,"CX Guidelines v1.4.0 PDF, p. 89 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.08","CDR Rule","Data Recipient","MUST","(5) A copy of the CDR receipt may be included in the CDR consumer’s consumer dashboard.","CDR Rule 4.18(5)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-07"]
["4CM1. DR Dashboard","00. DR Dashboard - general","4CM1.00.39","CX Guideline","Data Recipient","MAY","Data recipients are encouraged to surface information about data deletion found in their CDR policy along with a link to read this policy. This may include:\n• when and how redundant data is deleted;\n• how a CDR consumer may elect for this to happen.","CDR Rule 7.2(4)(k)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/collection-and-use-consents","1.16.0","2022-03-14","Retired","2025-03-07"]
["4CM1. DR Dashboard","01. AP disclosure consent","4CM1.01.07","CDR Rule","Data Recipient","MUST","(5) A copy of the CDR receipt may be included in the CDR consumer’s consumer dashboard.","CDR Rule 4.18(5)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/disclosure-consents","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM1. DR Dashboard","02. Right to delete","4CM1.02.","CDR Rule","Data Recipient","MUST","The consumer may choose to have redundant data deleted at any time before consent expires unless the data recipient has informed the consumer that they have a general policy of deleting redundant CDR data.","CDR Rule 4.11(1)(e), 4.16(2)","CX Guidelines v1.4.0 PDF, p. 100 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","03a. ADR uses OSPs","4CM1.03a.","CDR Rule","Data Recipient","MUST NOT","(2) For these rules, a CDR outsourcing arrangement is a written contract between a person (the principal) and another person (the provider) under which:\n\n(b) the provider is required to comply with the following requirements in relation to any service data:\n(ii) the provider must not use or disclose the service data other than in accordance with a contract with the principal.","CDR Rule 1.10(2)(b)(ii)","CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","03a. ADR uses OSPs","4CM1.03a.","CX Guideline","Data Recipient","MAY","If data is being shared with outsourced providers, data recipients should include this information on the dashboard.",null,"CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM1. DR Dashboard","03a. ADR uses OSPs","4CM1.03a.","CDR Rule","Data Recipient","MUST","(2) The steps are:\n(b) direct any outsourced service provider of the accredited data recipient that had been provided with a copy of the redundant data:\n(i) either to:\n(A) return the redundant data to the accredited data recipient; or\n(B) delete the redundant data, as well as any CDR data that has been directly or indirectly derived from it, and notify the accredited data recipient of the deletion; and\n(ii) if the outsourced service provider has provided any such data to another person―to:\n(A) direct the person to take either of the steps referred to in subparagraph (i) in relation to that data; and\n(B) cause similar directions to be made to any person to whom such data has been further disclosed.","CDR Rule 7.12(2)(b)","CX Guidelines v1.4.0 PDF, p. 93 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.03","CDR Rule","Data Recipient","MUST","(2) The accredited person must:\n(b) if a collection consent was withdrawn, in any case―notify the data holder of the withdrawal in accordance with the data standards.\nNote 1: When a data holder is notified of the withdrawal of a collection consent, an authorisation to disclose the CDR data expires: see paragraph 4.26(1)(d).","CDR Rule 4.13(2)(b), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2024-03-06"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.05","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.06","CDR Rule","Data Recipient","MUST","(3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired.","CDR Rule 4.18(3) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-07"]
["4CM2. DR Withdrawal","00. Withdrawal - general","4CM2.00.07","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.4.0 or earlier","12 August 2020 or earlier","Retired","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.03","CDR Rule","Data Recipient","MUST","(2) The accredited person must:\n(b) if a collection consent was withdrawn, in any case―notify the data holder of the withdrawal in accordance with the data standards.\nNote 1: When a data holder is notified of the withdrawal of a collection consent, an authorisation to disclose the CDR data expires: see paragraph 4.26(1)(d).","CDR Rule 4.13(2)(b), (Note 1)","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2024-03-06"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.06","CDR Rule","Data Recipient","MUST","(2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:\n(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and\n(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and\n(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and\n(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11).","CDR Rule 4.18(2) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.07","CDR Rule","Data Recipient","MUST","(3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired.","CDR Rule 4.18(3) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["4CM2. DR Withdrawal","01. AP Disclosure consent","4CM2.01.08","CDR Rule","Data Recipient","MUST","(4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard.","CDR Rule 4.18(4) | CX Research 20 [https://cx.dsb.gov.au/overview/references]","Consent Management (Data recipient): https://cx.cds.gov.au/consent-management/consent-management-data-recipient/withdrawal","1.11.0","2021-07-02","Retired","2025-03-07"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should allow consumers to create user-defined tags, and/or descriptions (e.g. home deposit) for each data sharing arrangement to facilitate management (e.g. in the absence of information about the purpose or use case).","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","CX Guidelines v1.4.0 PDF, p. 108 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should allow consumers to create user-defined tags, names, and/or descriptions (e.g. home deposit) for each data sharing arrangement (e.g. in the absence of information about the purpose or use case).","CX Workshop: Manage and withdraw [https://web.archive.org/web/20241101032623/https://consumerdatastandards.gov.au/index.php/2019/08/management-and-revocation-consent-cx-workshop-summary]","CX Guidelines v1.4.0 PDF, p. 106 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should use the term ‘consent’ instead of ‘authorisation’ to provide consistency and facilitate comprehension.",null,"CX Guidelines v1.4.0 PDF, p. 111 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.","CX Guideline","Data Holder","MAY","Data holders should use the term ‘consent’ instead of ‘authorisation’ to provide consistency and facilitate comprehension.",null,"CX Guidelines v1.4.0 PDF, p. 106 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]
["5CM1. DH Dashboard","00. DH Dashboard - general","5CM1.00.22","CX Guideline","Data Holder","MAY","Data holders should communicate that certain information may not be available on data holder dashboards and should advise consumers to check with the data recipient for additional information.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.4.0 or earlier","12 August 2020 or earlier","Retired","2024-04-09"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.02","CX Guideline","Data Holder","MAY","Where an authorisation has been 'amended' and linked to a past authorisation using the cdr_arrangement_id, a data holder may consider providing a 'Consent history' feature.\n\nWhile not required, this feature leverages the cdr_arrangement_id functionality to allow a consumer to see past versions of the authorisation, such as previously shared data, accounts, and dates or durations that may differ to the current authorisation.\n\nImportantly, while data recipients are required to show the details of consent amendments, data holders are not. While data holders are not required to display 'amendments', data holders who are also data recipients may want to consider this functionality to establish greater consistency between their data holder and data recipient dashboard views.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.16.1","2022-05-17","Retired","2024-04-09"]
["5CM1. DH Dashboard","02. Amended authorisations","5CM1.02.05","CX Guideline","Data Holder","MAY","Data holders should provide a CDR receipt to the consumer after they have authorised to share data. Receipts should be given in writing otherwise than through the consumer dashboard, such as via email or SMS, and should be made available on the consumer dashboard. \n\nThe receipt should provide the consumer with a record of their sharing arrangement, including details that relate to the authorisation.\n\nCDR Receipts should be provided in writing, such as in an email, when: \n1. Authorisations are successfully established\n2. Authorisations are withdrawn \n3. Authorisations expire \n4. Authorisations are amended \n\nCDR receipts should also outline details on complaint handling and resolution processes. Dashboards should provide a way for consumers to request a copy of their CDR receipts.",null,"Consent Management (Data holder): https://cx.cds.gov.au/consent-management/consent-management-data-holder/authorisations","1.29.1","2024-04-09","Retired","2024-06-12"]
["5CM2. DH Withdrawal","00. Withdrawal","5CM2.00.","CX Guideline","Data Holder","MAY","When updating the consumer dashboard, data holders should include:\n• An updated status of the consumer’s sharing arrangement.\n• A statement indicating to the consumer that the data recipient is no longer collecting and using their data\n• Updated information on sharing duration, including a consent withdrawal date",null,"CX Guidelines v1.4.0 PDF, p. 114 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]","1.4.0 or earlier","12 August 2020 or earlier","Retired"]