This fact sheet is for information only. You should get legal advice about your personal situation.
Main ideas
• Consumer data right (CDR) is an easy and secure way to share your financial data with banks, financial service companies and energy retailers
• You control who the data is shared with, what data is shared, and how it is used.
• Consumer data right is an Australian Government initiative and heavily regulated.
• Only deal with an accredited CDR provider.
In this fact sheet:
CDR: An Australian Government initiative to help you control and use your own data
• Where does CDR work?
You choose who can see your data and what it is used for
• Manage your data sharing
• Correcting your data
CDR: An Australian Government initiative to help you control and use your own data
Consumer Data Right (CDR) was developed by the Australian Government to make it easier for you to share the data your bank, non-bank lender, or energy retailer holds about you with accredited companies. Choosing to share your data can help you find the products and services that are best for you.
For example, you might want to find a better loan or energy plan, or use a budgeting app. However, always keep in mind that sharing sensitive financial data with other parties (or other financial services) always carries a risk. You may be able to use CDR to share your data with a broker or comparison website to get product quotes and comparisons tailored to you. CDR may also allow your data to be transferred easily to a new bank or service if you want to apply for another product, like a home loan. You can visit the CDR website for more details.
You can only share data with an accredited CDR provider. You can search for accredited CDR providers on the CDR website. The provider must comply with all regulations to protect and secure your privacy and financial information. You can read ‘Protecting your CDR data’ on the Office of the Australian Information Commissioner (OAIC) website for more details.
Where does CDR work?
CDR currently works in the banking sector. You can share data about your savings account, home loan, credit card, and other financial products. From 9 November 2026, it will also work for some non-bank lenders who offer financial products like loans, credit cards, and buy now pay later services.
CDR also works in the energy sector, but not yet in Western Australia or the Northern Territory. You can share data about your energy plan and energy usage.
There are plans for CDR to expand over time to other sectors, like telecommunications, superannuation, and insurance.
You choose who can see your data and what it is used for
Your bank, non-bank lender, or energy retailer holds a lot of data about you. Banks and non-bank lenders hold data like your name, your account balance, how you earn and spend money, and the interest rates on your accounts or loans. Energy retailers hold data like your name, your energy bills, and your energy usage.
Your data can only be shared if you give your consent. Your consent must be voluntary and made as an active choice. You don’t have to share your data if you don’t want to. Sharing sensitive data with other parties always carries a risk.
You can choose:
- which services see and use your data
- what types of data you share
- how your data is used
- how long your data is shared for.
You can also stop sharing your data at any time and can ask for it to be deleted or de-identified when it is no longer needed.
An accredited CDR provider may only collect, use and disclose your data with your express consent. Read about how your data must be managed on the Office of the Australian Information Commissioner (OAIC) website.
How to share your data
- Check if the service asking for your data is an accredited CDR provider. Do not provide your data to any service that is not accredited.
- Go to the accredited CDR provider’s website or app and confirm your identity. Your bank, non-bank lender, or energy retailer will then verify your identity using a one-time password. You will not be asked for your passwords or verification codes.
- Follow the link and select the data you will share and who you will share it with. Your bank, non-bank lender, or energy retailer will then share your data with the accredited CDR provider.
Manage your data sharing
Manage your consent within the accredited CDR provider’s website or app. Know how to withdraw your consent and delete your data.
- You don’t have to share your CDR data if you don’t want to. You should not feel pressured into giving your consent. Think carefully about whether sharing sensitive financial data is in your best interests. Get legal advice if you are unsure.
- Only share the minimum amount of data required to use the service. An accredited CDR provider must only collect data necessary for the product or service they are giving you.
- Check how your data will be used – will it be used to advertise to you? Will the provider recommend the best deal for you or the deal that makes them the most money? You should only consent to your data being used in the way you want it to be used. Your data can’t be used for direct marketing unless you consent.
- Decide how long the provider will have access to your data (maximum 12 months). You can withdraw your consent at any time.
- To protect your privacy, you should choose to delete your data when you no longer need the service.
- Do not consent to sharing your data with a company that is not accredited.
Correcting your data
If data you have shared is incorrect, you can ask the bank, non-bank lender, or energy retailer who holds your data to correct it.
If the data holder considers it appropriate, they will, within 10 business days, either:
- correct your data, or
- include an explanation with your data to ensure it is accurate and complete, and try to attach this explanation to your data so anyone using it will see the explanation.
The data holder must let you know how they corrected your data.
If the data holder does not make changes to your data, they need to explain to you why a correction or explanation is not necessary or appropriate. They must also let you know how you can complain.
Energy retailers can’t correct some types of data. For data about electricity meters, it may have to start a longer correction process. For data about things like solar panels or batteries, your energy retailer may tell you how to contact your distributor to correct your data.
Complaining about CDR matters
You have the right to complain if you think a data holder or accredited CDR provider has mishandled your CDR data.
You should complain to the data holder or accredited CDR provider first. Each data holder and CDR provider has a policy available on their website or app explaining how to complain. Explain why you think they have mishandled your data.
If the data holder or accredited CDR provider does not respond within 30 days, or if you are not happy with their response, you can complain to the Office of the Australian Information Commissioner (OAIC). The OAIC has more information about how to make a complaint and more information about the CDR on its website.
If your complaint is about a bank, non-bank lender or an accredited CDR provider, you can also complain to Australian Financial Complaints Authority (AFCA). AFCA is a free and independent consumer complaints service. Read our fact sheet about Financial Complaints to AFCA.
If your complaint is about an energy retailer, you can also complain to the relevant state authority:
- Australian Capital Territory: ACAT
- New South Wales: Energy and Water Ombudsman NSW
- Queensland: Energy and Water Ombudsman Queensland
- South Australia: Energy and Water Ombudsman SA
- Tasmania: Energy Ombudsman Tasmania
- Victoria: Energy Ombudsman Victoria
Time limits apply to making a complaint, so do not delay.
If you are in NSW, you can call the Credit & Debt Legal Advice line for help on 1800 844 949 if you have any questions. You can also make an enquiry on the CDR website if you have a question about CDR privacy rights or making a complaint.
Need more help?
Visit our Useful Links page for a list of other resources.
Last updated: July 2026