Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025

I, Stephen Jones, Assistant Treasurer and Minister for Financial Services, make the following rules.

Dated   28 February 2025

Stephen Jones

Assistant Treasurer
Minister for Financial Services

Contents

1  Name 

2  Commencement

3  Authority

4  Schedules

Schedule 1—Amendments

Part 1—General amendments

Competition and Consumer (Consumer Data Right) Rules 2020

Part 2—Extension of the consumer data right to the non-bank lenders sector

Competition and Consumer (Consumer Data Right) Rules 2020

Part 3—General amendments of listed provisions

Competition and Consumer (Consumer Data Right) Rules 2020

1  Name

  This instrument is the Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025.

2  Commencement

 (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.

 (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.

3  Authority

  This instrument is made under the Competition and Consumer Act 2010.

Note: Section 56BA of the Competition and Consumer Act 2010 provides that the Minister may, by legislative instrument, make rules for designated sectors, or types of CDR actions, in accordance with Division 2 of Part IVD of the Act.

4  Schedules

  Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

Schedule 1—Amendments

Part 1—General amendments

Competition and Consumer (Consumer Data Right) Rules 2020

1  Rule 1.4 (paragraphs beginning “Schedule 3” and “Schedule 4”)

Repeal the paragraphs.

2  Subrules 1.6(12) and (13)

Repeal the subrules, substitute:

 (12) Schedule 3 to these rules deals with the banking and non-bank lenders sectors. Schedule 3 sets out:

 (a) particular classes of data holder in those sectors to which these rules do not apply; and

 (b) the specific types of CDR data in respect of which requests under these rules may be made; and

 (c) the circumstances in which CDR consumers are eligible in relation to data holders in those sectors; and

 (d) the progressive application of these rules to those sectors.

 (13) Schedule 4 to these rules deals with the energy sector. Schedule 4 sets out:

 (a) the specific types of CDR data in respect of which requests under these rules may be made; and

 (b) the circumstances in which CDR consumers are eligible in relation to data holders in the energy sector; and

 (c) some modifications of the general rules that apply in the energy sector because certain types of data are collected or held by agencies specified in the energy sector designation instrument rather than the retailers with which the CDR consumers have accounts; and

 (d) the progressive application of these rules to the energy sector.

3  After rule 1.6

Insert:

1.6A  Sector Schedules

  A sector Schedule may modify the operation of Parts 1 to 9 of these rules in relation to a particular designated sector or sectors and a particular matter (whether or not a provision in any of those Parts provides for the Schedule to deal with the matter).

Example: A sector Schedule may provide that these rules do not apply in relation to a particular class of data holders in the designated sector or sectors.

4  Rule 1.7 (notes 1 and 2)

Repeal the notes, substitute:

Note: Expressions have the same meaning in this instrument as in the Competition and Consumer Act 2010 as in force from time to time—see paragraph 13(1)(b) of the Legislation Act 2003.

5  Subrule 1.7(1) (definition of sector Schedule)

After “particular designated sector”, insert “or sectors”.

6  Subrule 1.7(3) (note)

Repeal the note.

7  Paragraph 1.12(1)(a)

After “requests”, insert “in relation to data that it holds”.

8  Rule 2.1 (paragraph beginning “A product data request”)

Repeal the paragraph, substitute:

A product data request may be for required product data, voluntary product data, or both.

9  Rule 3.1 (paragraph beginning “A request may be”)

Repeal the paragraph, substitute:

A request may be for the CDR consumer’s required consumer data, their voluntary consumer data, or both.

10  Subrule 3.3(1) (note)

Repeal the note.

11  Subrule 3.3(3) (note)

Repeal the note.

12  Subrule 3.4(2) (note)

Repeal the note.

13  Subrule 3.4(3) (note 1)

Repeal the note.

14  At the end of rule 4.1 (after the boxed text)

Add:

Note: Schedule 3 modifies the application of this Part in some respects where a data holder moves from the non-bank lenders sector to the banking sector.

15  Rule 4.2 (note 1)

Repeal the note.

16  Paragraph 4.11(1)(d)

Repeal the paragraph, substitute:

 (d) if the accredited person intends to charge a fee for disclosure of CDR data, or pass on to the CDR consumer a fee charged by a data holder or accredited data recipient for disclosure of CDR data—clearly distinguish between the CDR data for which a fee will, and will not, be charged or passed on, and either:

 (i) allow the CDR consumer to actively select or otherwise clearly indicate whether they consent to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on; or

 (ii) seek the CDR consumer’s agreement to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on (as presented to the CDR consumer); and

17  Paragraph 4.20E(1)(e)

Repeal the paragraph, substitute:

 (e) if the CDR representative intends to charge a fee for disclosure of CDR data, or pass on to the CDR consumer a fee charged by a data holder or accredited person for disclosure of CDR data—clearly distinguish between the CDR data for which a fee will, and will not, be charged or passed on, and either:

 (i) allow the CDR consumer to actively select or otherwise clearly indicate whether they consent to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on; or

 (ii) seek the CDR consumer’s agreement to the collection or disclosure, as appropriate, of the CDR data for which a fee will be charged or passed on (as presented to the CDR consumer); and

18  Rule 5.5 (notes 1, 2 and 3)

Repeal the notes.

19  Subrule 5.25(1) (note)

Repeal the note.

20  Subrule 8.4(3)

Repeal the subrule, substitute:

 (3) Remuneration is not payable in respect of an appointment to a Data Standards Advisory Committee. The Chair may determine any other terms and conditions of an appointment in writing.

21  After paragraph 9.3(1)(da)

Insert:

 (db) any election by the data holder in effect under subclause 7.1A(1) of Schedule 3;

Part 2—Extension of the consumer data right to the non-bank lenders sector

Competition and Consumer (Consumer Data Right) Rules 2020

22  Schedule 3 (heading)

Omit “banking sector”, substitute “banking and non-bank lenders sectors”.

23  Parts 1 to 3 of Schedule 3

Repeal the Parts, substitute:

Part 1—Preliminary

Division 1.1—Simplified outline

1.1  Simplified outline of this Schedule

Division 1.2—Application of these rules in relation to the banking and NBL sectors

1.1A  Application of these rules

  These rules do not apply in respect of any of the following kinds of data holder in the banking sector or the NBL sector (an excluded data holder):

 (a) a data holder that is a body corporate, if the body:

 (i) is a registered religious body; and

 (ii) offers a covered product or products in advancing its charitable purposes;

 (b) a data holder that is:

 (i) a foreign ADI for the purposes of the Banking Act 1959; or

 (ii) a foreign branch of an Australian ADI; or

 (iii) a restricted ADI.

Division 1.3—Definitions

1.2  Definitions

  In this Schedule:

account data has the meaning given by clause 1.3 of this Schedule.

accounting standard means an accounting standard made under section 334 of the Corporations Act 2001.

banking business has the meaning given by the banking sector designation instrument.

banking sector means the sector of the Australian economy that is designated by the banking sector designation instrument.

banking sector data means CDR data covered by the banking sector designation instrument.

banking sector designation instrument means the Consumer Data Right (Authorised Deposit‑Taking Institutions) Designation 2019.

covered product has the meaning given by clause 1.4 of this Schedule.

customer data has the meaning given by clause 1.3 of this Schedule.

excluded data holder has the meaning given by clause 1.1A of this Schedule.

NBL sector, or non-bank lenders sector, means the sector of the Australian economy that is designated by the NBL sector designation instrument.

NBL sector data means CDR data covered by the NBL sector designation instrument.

NBL sector designation instrument means the Consumer Data Right (Non-Bank Lenders) Designation 2022.

product has the meaning given by the banking sector designation instrument or the NBL sector designation instrument, as applicable.

product specific data has the meaning given by clause 1.3 of this Schedule.

registered religious body means an entity that is:

 (a) registered under the Australian Charities and Not‑for‑profits Commission Act 2012 as the type of entity mentioned in column 1 of item 1 of the table in subsection 25‑5(5) of that Act; and

 (b) registered under the Australian Charities and Not‑for‑profits Commission Act 2012 as the subtype of entity mentioned in column 2 of item 4 of the table in subsection 25‑5(5) of that Act.

relevant non-bank lender has the meaning given by the NBL sector designation instrument.

transaction data has the meaning given by clause 1.3 of this Schedule.

1.3  Meaning of customer data, account data, transaction data and product specific data

 (1) A term listed in column 1 of an item in the following table has the meaning set out in column 2 of that item.

 (2) For the purposes of subparagraph (b)(iv) of column 2 of item 2, details of authorisations for direct debit deductions include, to the extent available:

 (a) any identifier for the counter-party that is authorised to debit the account; and

 (b) the dates and amounts of any debits the counter-party has made.

1.4  Meaning of covered product

 (1) A product of a kind specified in column 2 of an item of the table below (however described) is a covered product for a sector specified in column 1 of that item if:

 (a) the product is publicly offered by or on behalf of a data holder in that sector; and

 (b) the product is offered to customers by way of standard form contracts.

Note: For paragraph (b), section 27 of the Australian Consumer Law sets out matters that a court may take into account when determining whether a contract is a standard form contract.

 (2) A product need not be available to all members of the public in order to be publicly offered.

Note: A product may be offered subject to eligibility requirements. For instance, it may be available only to a person operating a particular type of business. This does not prevent it from being “publicly offered” if it would otherwise fall within the ordinary meaning of that term.

1.5  Meaning of trial product

 (1) For these rules, in relation to the banking sector and NBL sector, a covered product is a trial product if the product is offered:

 (a) with the description “pilot” or “trial”; and

 (b) with a statement that it will operate as a pilot or trial for a period that ends no more than 6 months after the initial offering (the trial period); and

 (c) on the basis that the number of customers supplied with the product for the purposes of the trial will be no more than 1,000; and

 (d) with a statement that the product may be terminated before the end of the trial period and that, if it is, the CDR data in relation to the product may not be available for data sharing under these rules.

 (2) A covered product will cease to be a trial product from the first time any of the following occurs:

 (a) the product is supplied or offered after the end of the trial period;

 (b) the product begins to be supplied to more than 1,000 customers.

Part 2—Eligible CDR consumers: banking and NBL sectors

2.1  Additional criterion for eligibility—banking and NBL sectors

  For the purposes of subrules 1.10B(1) and (2), the additional criterion for a CDR consumer to be eligible in relation to a particular data holder in the banking sector or the NBL sector at a particular time, is that the account mentioned in paragraph 1.10B(1)(b) or (2)(b) is set up in such a way that, at that time, it can be accessed online.

Note: Rule 1.10B provides, among other things, that a person is eligible in relation to a data holder if the person is:

(a) an account holder or secondary user for an account with the data holder; or

(b) a partner in a partnership that has an account with the data holder (whether or not the person is an account holder or secondary user).

2.2  Meaning of account privileges—banking and NBL sectors

 (1) This clause is made for the purposes of the definition of account privileges in subrule 1.7(1).

 (2) For the banking sector and NBL sector, a person has account privileges in relation to an account the person holds with a data holder in either of those sectors if:

 (a) the account is, or is for, a covered product; and

 (b) the person is able to make transactions on the account.

2.3  Consumer dashboard—application of rule 1.15

  For the purposes of subrule 1.15(1), if a data holder in the banking sector or NBL sector receives a consumer data request from an accredited person on behalf of a CDR consumer who is eligible in relation to the data holder, the data holder must provide the CDR consumer with a consumer dashboard.

Part 3—CDR data that may be accessed under these rules in relation to the banking sector and NBL sector

3.1  Meaning of required product data and voluntary product data—banking sector and NBL sector

 (1) Required product data, in relation to the banking sector or the NBL sector, means CDR data for which there are no CDR consumers:

 (a) that is banking sector data or NBL sector data (as applicable); and

 (b) that is product specific data about a covered product (other than a covered product mentioned in subclause (2)); and

 (c) that is held by the data holder in a digital form.

Note:  Product data can only be required to be disclosed if the data is about the eligibility criteria, terms and conditions, price, availability or performance of a covered product, or if the data is about availability or performance and is publicly available (see section 56BF of the Act).

 (2) For the purposes of paragraph (1)(b), the covered products mentioned in this subclause are:

 (a) a foreign currency account; and

 (b) a consumer lease; and

 (c) a reverse mortgage; and

 (d) a margin loan; and

 (e) asset finance that is non-standard vehicle finance (for example, a novated lease).

 (3) Voluntary product data, in relation to the banking sector or the NBL sector, means CDR data for which there are no CDR consumers:

 (a) that is banking sector data or NBL sector data (as applicable); and

 (b) that is product specific data about a covered product; and

 (c) that is not required product data.

3.2  Meaning of required consumer data and voluntary consumer data—banking and NBL sectors

 (1) A relevant account, in relation to a CDR consumer, means an account that is held with a data holder of banking sector data or NBL sector data and is, or is for, a covered product, and that:

 (a) is held in the name of the CDR consumer alone; or

 (b)  is a joint account of which the CDR consumer is one of the account holders; or

 (c) is a partnership account for a partnership in which the CDR consumer is a partner; or

 (d) is an account for which the CDR consumer is a secondary user;

whether or not the account can be accessed online, and, subject to subclauses (6) and (7), whether or not the account is open.

 (2) Subject to this clause, required consumer data, in relation to the banking sector or the NBL sector, means CDR data for which there is at least one CDR consumer:

 (a) that is banking sector data or NBL sector data (as applicable) of a kind mentioned in clause 1.3 relating to a relevant account of a CDR consumer (other than an account that is, or is for, a covered product mentioned in subclause (3); and

 (b) that is held by the data holder in a digital form.

Note 1: Paragraph (a), as it applies to product specific data mentioned in clause 1.3, would cover the following:

 any product prices that were negotiated individually with a CDR consumer;

 the interest rates that are current at the time of the request, as well as any other interest rates applicable to the covered product, and any terms and conditions associated with those interest rates;

 any features and benefits negotiated individually with a CDR consumer.

Note 2: So long as the CDR consumer is eligible to make a consumer data request in relation to a particular data holder, they will be able to make a consumer data request that relates to any relevant open account they have with the data holder (subject to subclauses (6) and (7)), including accounts that cannot be accessed online.

Note 3: A person is not a data holder of CDR data that was held by or on behalf of them before the earliest holding day (see paragraph 56AJ(1)(b) of the Act). Accordingly, such data cannot be requested under these rules.

 (3) For the purposes of paragraph (2)(a), the covered products mentioned in this subclause are:

 (a) a foreign currency account; and

 (b) a consumer lease; and

 (c) a reverse mortgage; and

 (d) a margin loan; and

 (e) asset finance that is non-standard vehicle finance (for example, a novated lease).

 (4) Subject to this clause, CDR data is voluntary consumer data in relation to the banking sector or the NBL sector if:

 (a) there is at least one CDR consumer for the CDR data; and

 (b) the CDR data relates to a covered product; and

 (c) the CDR data is not required consumer data.

 (5) However:

 (a) CDR data is neither required consumer data nor voluntary consumer data at a particular time if the data is:

 (i) account data, transaction data or product specific data in relation to a joint account or partnership account for which any of the individuals who are account holders or partners in the relevant partnership is less than 18 years of age at that time; or

 (ii) CDR data relating to a debt of a CDR consumer, if the data was acquired by a data holder acting in its capacity as a debt collector or debt buyer; and

 (b) for a consumer data request made by or on behalf of a particular person, customer data in relation to any account holder or secondary user other than that person is neither required consumer data nor voluntary consumer data.

Exception to required consumer data―open accounts

 (6) Despite subclause (2), if a relevant account is open at a particular time, CDR data relating to that account is not required consumer data at that time if the data is:

 (a) transaction data in relation to a transaction that occurred more than 2 years before that time; or

 (b) account data that relates to an authorisation for a direct debit from the account, if the direct debit occurred more than 13 months before that time.

Note: As a result, such CDR data would be voluntary consumer data unless otherwise excluded by this clause.

Exception to required consumer data―closed accounts

 (7) Despite subclause (2), if a relevant account is closed at a particular time, CDR data relating to that account is not required consumer data at that time.

Note: As a result, such CDR data would be voluntary consumer data unless otherwise excluded by this clause.

24  Part 5 of Schedule 3 (heading)

Repeal the heading, substitute:

Part 5—Dispute resolution: banking sector and NBL sector

25  Clause 5.1 of Schedule 3 (heading)

Omit “banking sector”, substitute “banking sector and NBL sector”.

26  Subclause 5.1(1) of Schedule 3

Omit “For the banking sector, a CDR participant”, substitute “For the banking sector and NBL sector, an accredited person or data holder”.

27  Subclause 5.1(2) of Schedule 3

Omit “CDR participants”, substitute “accredited persons and data holders”.

28  Subclause 5.1(2) of Schedule 3 (note)

Repeal the note, substitute:

Note: Regulatory Guide 271 could, in 2025, be accessed from the Australian Securities and Investments Commission’s website (https://asic.gov.au).

29  Clause 5.2 of Schedule 3

Repeal the clause, substitute:

5.2  Meeting external dispute resolution requirements―banking sector and NBL sector

  For the banking sector and NBL sector, an accredited person or data holder meets the external dispute resolution requirements if it is a member of the recognised external dispute resolution scheme operated by the Australian Financial Complaints Authority Limited for the relevant sector.

30  Part 6 of Schedule 3

Repeal the Part, substitute:

Part 6—Application of these rules to the banking and NBL sectors

Division 6.1—Staged application to the NBL sector

6.1  Definitions

  In this Part:

complex request means a consumer data request that:

 (a) is made on behalf of a secondary user; or

 (b) relates to a joint account or a partnership account; or

 (c) is made on behalf of a CDR consumer who has a nominated representative.

Note: For paragraph (c), see paragraph 1.13(1)(c) of these rules.

initial provider—see clause 6.2.

large provider—see clause 6.2.

tranche 1 date means 13 July 2026.

tranche 2 date means 9 November 2026.

tranche 3 date means 10 May 2027.

6.2  Meaning of initial provider and large provider

 (1) A relevant non-bank lender is an initial provider on and after the commencement day if, on the commencement day, each of the following is over $10 billion:

 (a) the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority under the applicable standards by the lender and each of its associated non-bank lenders in relation to the most recent calendar month for which a report was given to the Australian Prudential Regulation Authority before the commencement day;

1.     the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority under the applicable standards by the lender and each of its associated non-bank lenders during the 12 months before the commencement day, averaged over that period.

 (2) Subject to this clause, a relevant non-bank lender is a large provider on and after the first day on which it meets the large provider qualification if, on that day, the lender:

 (a) is not an initial provider; and

 (b) meets the large provider qualification, as set out in subclause (3) or (4).

 (3) A relevant non-bank lender meets the large provider qualification on the commencement day, or on a 1 July after that day (the relevant day), if:

  (a) each of the following is over $1 billion:

 (i) the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority under the applicable standards by the lender and each of its associated non-bank lenders in relation to the most recent calendar month for which a report was given to the Australian Prudential Regulation Authority before the relevant day;

 (ii) the total value of the resident loans and resident finance leases reported to the Australian Prudential Regulation Authority under the applicable standards by the lender and each of its associated non-bank lenders during the 12 months before the relevant day, averaged over that period; and

 (b) the lender has more than 1,000 customers on that day.

 (4) A relevant non-bank lender also meets the large provider qualification on a day that is, or is after, the commencement day, if the lender is an accredited person on that day.

 (5) However, a relevant non-bank lender to whom subclause (4) applies is taken, for the purposes of that subclause, to cease to meet the large provider qualification on and after a later day if the lender:

 (a) ceases to be an accredited person on that later day; and

 (b) has not met the large provider qualification in subclause (3) at any time before that later day.

Calculating averaged value of resident loans and resident finance leases

 (6) For the purpose of calculating the averaged value of resident loans and resident finance leases reported by a relevant non-bank lender and each of its associated non-bank lenders over 12 calendar months, any month in relation to which no report was made by the lender, or any of its associated non-bank lenders, is to be disregarded.

Note: A lender is not required to provide a monthly report to the Australian Prudential Regulation Authority under the applicable standards if its total assets are less than $400 million as at the last day of its financial year.

 (7) In this clause:

applicable standards means the standards made by the Australian Prudential Regulation Authority under the Financial Sector (Collection of Data) Act 2001 dealing with the provision of information to the Authority relating to the loans and finance leases of an ADI or registered financial corporation.

Note: The applicable standards were, in 2025, set out in the Financial Sector (Collection of Data) (reporting standard) determination No. 9 of 2022 [F2022L00212].

associated non-bank lender: a relevant non-bank lender (the first lender) is an associated non-bank lender of another relevant non-bank lender (the second lender) if any of the following apply:

 (a) the first lender is a related body corporate of the second lender for the purposes of the Act (see subsection 4A(5) of the Act);

 (b) the first lender has an arrangement with the second lender in relation to the administration, offering, provision or underwriting of resident loans or resident finance leases;

 (c) the second lender has an arrangement with the first lender for the administration, offering, provision or underwriting of resident loans or resident finance leases.

commencement day means the day on which the Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025 commences.

finance lease has the meaning given by AASB 16 - Leases - February 2016 [F2016L00233].

loan, in relation to a relevant non-bank lender, means a financial asset that is:

 (a) created when a relevant non-bank lender lends funds directly to a debtor; and

 (b) evidenced by non-negotiable documents.

resident, applied to a loan or a finance lease, means that the loan or finance lease is made to a resident institutional unit or units.

resident institutional unit has the meaning given by the relevant standard made by the Australian Prudential Regulation Authority under the Financial Sector (Collection of Data) Act 2001 dealing with definitions for the collection of Economic and Financial Statistics information.

Note: The relevant standard was, in 2025, set out in the Financial Sector (Collection of Data) (reporting standard) determination No. 5 of 2024. In general terms, “resident institutional unit” refers to an economic entity that is capable of owning assets, incurring liabilities and engaging in economic activities and in transactions with other entities, and whose centre of predominant economic interest is Australia. It includes individuals and groups of individuals that form a household, as well as legal entities such as businesses.

6.3  Obligation to notify Commission about customer numbers

 (1) A relevant non-bank lender that satisfies paragraph 6.2(3)(a) must, if requested by the Commission, notify the Commission of the following, in writing, as soon as practicable after receiving the request:

 (a) the total value of the resident loans and resident finance leases mentioned in subparagraphs 6.2(3)(a)(i) and (ii);

 (b) whether the lender also satisfies paragraph 6.2(3)(b).

Civil penalty: $250,000.

 (2) A relevant non-bank lender must notify the Commission in writing as soon as practicable if, on a day mentioned in subclause 6.2(3), it satisfies paragraph 6.2(3)(a) but does not satisfy paragraph 6.2(3)(b).

Civil penalty: $250,000.

6.4  Application to initial providers

 (1) These rules apply, as set out in the following table, in relation to a relevant non‑bank lender that is an initial provider.

 (2) These rules do not apply to a complex request under Part 4, in relation to a relevant non‑bank lender that is an initial provider.

6.5  Application to large providers

 (1) In this clause, where a relevant non-bank lender is a large provider, its LP date is the date that it became a large provider.

 (2) These rules apply in relation to such a large provider with an LP date that is on or before 13 July 2025 as set out in the following table.

 (3) These rules apply in relation to such a large provider with an LP date that is after 13 July 2025 date as set out in the following table.

 (4) These rules do not apply to a complex request under Part 4, in relation to a relevant non‑bank lender that is a large provider.

6.6  Application to other non-bank lenders

  These rules only apply in relation to a relevant non-bank lender that:

 (a) is an initial provider; or

 (b) is a large provider; or

 (c) has notified the Commission under clause 6.11 that it wishes Part 2 or Part 4 of these rules to apply to it from a specified date.

6.7  Consumer data requests under Part 3 of these rules

  Part 3 of these rules does not apply in relation to NBL sector data.

Division 6.2—Application to data holders in the banking sector

6.8  Consumer data requests under Part 3 of these rules

  Part 3 of these rules does not apply in relation to banking sector data.

6.9  Entities that become unrestricted ADIs after specified date

 (1) This clause applies to a person who becomes an unrestricted ADI on a day (the relevant day) that is on or after the day the Competition and Consumer (Consumer Data Right) Amendment Rules (2025 Measures No. 1) 2025 commences.

Note: This includes a person who was previously a restricted ADI, and was therefore an excluded data holder for this sector.

 (2) These rules apply in relation to the person:

 (a) in respect of a product data request—on and after the day that is 12 months after the relevant day; and

 (b) in respect of a consumer data request made by an accredited person, other than a complex request—on and after the day that is 15 months after the relevant day; and

 (c) in respect of a complex request made by an accredited person—on and after the day that is 18 months after the relevant day.

6.10  Providers of buy now, pay later products

 (1) In this clause, where a data holder in the banking sector offers a covered product that is a buy now, pay later product (a BNPL product), its BNPL date is the date that it first offered a BNPL product.

 (2) These rules apply in relation to such a data holder with a BNPL date that is on or before the tranche 1 date, in respect of CDR data that relates to a BNPL product, as set out in the following table:

 (3) These rules apply in relation to such a data holder with a BNPL date that is between 14 July 2026 and 10 May 2027, in respect of CDR data that relates to a BNPL product, as set out in the following table:

 (4) These rules do not apply to a complex request under Part 4, in relation to such a data holder in respect of CDR data that relates to a BNPL product.

Division 6.3—Disclosing CDR data voluntarily: banking sector and NBL sector

6.11  Disclosure of CDR data voluntarily

 (1) A data holder in the banking sector or NBL sector, other than an excluded data holder, may notify the Commission that it wishes Part 2 or Part 4 of these rules to apply to it from a specified date.

 (2) The data holder, from that specified date, may:

 (a) receive a request under Part 2 or Part 4 of these rules from a CDR consumer who is eligible in relation to that data holder; and

 (b) disclose required or voluntary product or consumer data in response to the request.

 (3) These rules apply to the data holder in respect of that request, and all subsequent requests under Part 2 or Part 4 of these rules by consumers who are eligible in relation to that data holder.

Note: This clause means that, among other things, a data holder who elects to receive and respond to such a request must comply with all aspects of these rules relevant to handling it (and all future requests by eligible consumers). For instance, the data holder would need to provide the consumer dashboard in accordance with subrule 1.15(1) upon receiving a request under Part 4, and would need to meet the internal and external dispute resolution requirements.

Division 6.4—Application to trial products

6.12  CDR data relating to trial products

 (1) These rules do not apply in respect of banking sector data or NBL sector data that relates to a trial product, while the product is a trial product.

 (2) If a covered product ceases to be a trial product under subclause 1.5(2), these rules apply in respect of banking sector data or NBL sector data relating to that product (including such data generated while the product was a trial product).

31  Part 7 of Schedule 3 (heading)

Omit “banking sector”, substitute “banking sector and NBL sector”.

32  Before clause 7.1 of Schedule 3

Insert:

7.1A  Transfer of data sharing obligations between data holders

 (1) A data holder in the banking sector or NBL sector (the first data holder) may elect to comply with these rules in the place of another data holder in the banking sector or NBL sector (the second data holder), in relation to a covered product, if:

 (a) either:

 (i) the second data holder offers the product on behalf of the first data holder, such that the first data holder is the data holder that enters into contracts with consumers to provide the product; or

 (ii) the first and second data holders are related bodies corporate for the purposes of the Act (see subsection 4A(5) of the Act); and

 (b) both data holders have agreed to the election in writing.

 (2) If an election is in effect under subclause (1), these rules apply in relation to the first data holder in relation to the covered product as if it were the second data holder.

33  Clause 7.1 of Schedule 3 (heading)

Omit “banking sector”, substitute “banking sector and NBL sector”.

34  Clause 7.1 of Schedule 3

Omit “banking sector”, substitute “banking sector and NBL sector”.

35  Paragraph 7.2(1)(a) of Schedule 3

Repeal the paragraph, substitute:

 (a) the person is an ADI or a relevant non-bank lender; and

 (aa) under Part 6 of this Schedule, these rules already apply to the person in their capacity as a data holder of other CDR data; and

36  After Part 7 of Schedule 3

Insert:

Part 8—Entities that move from NBL sector to banking sector

8.1  Moving from the NBL sector to the banking sector

Clause applies where data holder moves from NBL to banking sector

 (1) This clause applies where:

 (a) for the purpose of moving to the banking sector, a person ceases to be a data holder in the NBL sector at a particular time (the NBL exit time); and

 (b) at a time as soon as practicable thereafter (the transition time), the person becomes a data holder in the banking sector; and

 (c) immediately before the NBL exit time:

 (i) a request was on foot under Part 2 or 4 of these rules in respect of NBL sector data of the data holder; or

 (ii) a current authorisation or consent given under Part 4 of these rules in respect of NBL sector data covered by such a request was in existence.

Request taken to be made in respect of banking sector

 (2) The request, consent or authorisation mentioned in subclause (1) remains effective after the transition time as though it had instead been made on the basis that the data holder was in the banking sector, and the NBL sector data was banking sector data.

 (3) To avoid doubt, without limiting subclause (2):

 (a) these rules apply as though a reference in the request, authorisation or consent to the data holder and the CDR data in the NBL sector were a reference to the data holder and CDR data in the banking sector; and

 (b) the consent or authorisation does not expire merely because the data holder has ceased to operate in in the NBL sector.

Data holder must respond to the request

 (4) Despite anything else in this Schedule, the data holder must respond to the request in accordance with Part 2 or Part 4 as the case requires.

Note: If the data holder has become a restricted ADI, it will be an excluded ADI, and this provision will override clause 1.1A. If it becomes an unrestricted ADI, this provision will override the allowance of time in clause 6.9.

CDR consumer must be notified of change of sector

 (5) As soon as practicable after the transition time, the data holder must give a written notification to each CDR consumer in respect of whom a request mentioned in subclause (1) is on foot that:

 (a) the data holder has ceased to operate in the NBL sector; and

 (b) the data holder is now operating in the banking sector; and

 (c) the data requested is now banking sector data; and

 (d) the CDR consumer may, under rule 4.13, 4.20J or 4.25, choose to withdraw an authorisation or consent given under Part 4 in respect of the request.

 (6) As soon as practicable after the transition time, the data holder must give a written notification to each accredited person who made a consumer data request mentioned in subclause (1) that:

 (a) the data holder has ceased to operate in the NBL sector; and

 (b) the data holder is now operating in the banking sector.

 (7) Where an accredited person would be required to update the consumer dashboard of a relevant CDR consumer under rule 4.19 as a result of the sector change mentioned in subclause (1), the accredited person must instead update the consumer dashboard within a reasonable period after receiving the notification mentioned in subclause (6).

Part 3—General amendments of listed provisions

Competition and Consumer (Consumer Data Right) Rules 2020

37  Amendments of listed provisions—banking and non-bank lenders sectors

Omit “banking sector”, substitute “banking sector and non-bank lenders sector” in the following provisions:

1.     subrule 1.7(1), notes to the following definitions:

 (i)  law relevant to the management of CDR data;

 (ii) meet the external dispute resolution requirements;

 (iii) meet the internal dispute resolution requirements;

 (iv) required consumer data;

 (v) required product data;

 (vi) voluntary consumer data;

 (vii) voluntary product data;

1.     rule 1.10B (note to heading);

 (c) subrule 1.15(1) (note 2);

 (d) subrule 2.3(1) (note);

 (e) subrule 2.4(2) (note);

 (f) subrule 2.4(3) (note 1);

 (g) subrule 4.4(2) (note 2);

 (h) subrule 4.5(1) (note);

 (i) subrule 4.5(2) (note 1);

 (j) subrule 4.5(3) (note 1);

 (k) subrule 4.6(2) (note 1);

 (l) subrule 4.6(4) (note 1);

 (m) subrule 4.7B(1) (note);

 (n) subrule 5.12(1) (notes 4 and 5);

 (o) rule 6.1 (note 1);

 (p) rule 6.2 (note 2).

38  Amendments of listed provisions—CDR Accreditor

Omit “Data Recipient Accreditor” (wherever occurring) and substitute “CDR Accreditor” in the following provisions:

 (a) rule 5.1;

 (b) paragraph 5.1B(8)(a);

 (c) subrules 5.2(1) and (2);

 (d) rule 5.3 (heading);

 (e) subrule 5.3(1);

 (f) paragraph 5.3(2)(b);

 (g) subrule 5.3(2) (note);

 (h) rule 5.4 (heading);

 (i) subrules 5.3 (1), (2) and (3);

 (j) rule 5.5 (note to heading);

 (k) rule 5.6;

 (l) subrule 5.7(1);

 (m) rule 5.8;

 (n) subrules 5.10(1), (1A) and (3);

 (o) subrule 5.11(1);

 (p) subrules 5.14(1), (2), (3) and (5);

 (q) rule 5.15;

 (r) subrule 5.17(1), table (heading);

 (s) subrule 5.17(1) table, items 1 to 4, 6, 8 and 10;

 (t) subrule 5.18(1);

 (u) subrules 5.19(1) and (2);

 (v) subrule 5.20(2);

 (w) paragraphs 5.21(1)(a) and (b);

 (x) paragraph 5.24(c);

 (y) paragraphs 5.26(a) and (c);

 (z) rule 5.28;

 (za) paragraph 5.30(d);

 (zb) paragraphs 9.2(a) and (b);

 (zc) rule 9.7;

 (zd) subclause 2.1(1) of Schedule 1, definition of approved;

 (ze) subclauses 2.1(2), (3) and (4) of Schedule 1;

 (zf) clause 9.3 of Schedule 4.