How does Consumer Data Right (CDR) work and what data can be shared?

Open Banking is an evolving, economy-wide reform that is being embedded in the banking sector across Australia. It was originally introduced in 2020 and, with effect from late-2026, will also include the non-bank lending sector.

Non-bank lenders are financial institutions that provide credit or loans but do not hold a full banking licence and are not an Authorised Deposit-taking Institution (ADI), which means they do not take customer deposits in the way that banks do. They can include mortgage lenders, car finance providers, personal loan providers and Buy Now, Pay Later (BNPL) providers.

Banks can now provide a more complete view of your finances by securely integrating your non-bank loan and BNPL data. This visibility supports more responsible lending decisions and allows your bank to offer tailored solutions based on your full financial situation.

Consumer Data Right (CDR) is the Australian Government framework that provides consumers and businesses with greater control over their data. It is essentially the enabling law that underpins Open Banking.

Yes. A joint account holder/signatory can share your data through Open Banking if they are set up as a delegate within Open Banking. This must be done by the account owner or controlling person.

At a high-level, the opt-in process follows these steps:

1. Determine the participating provider, e.g. the financial institution you use for your everyday banking

• Initiate an activity with the requesting institution (for example, a prospective home loan provider) through one of your providers services; mobile app, internet banking portal, budgeting tool, comparison service, etc.
• The provider must be accredited to send/receive CDR data.

2. Provide your explicit consent

• The provider will clearly illustrate:
  • What data will be accessed;
  • Why it is needed;
  • How long access will last; and
  • Which account(s) will be included.
• You retain complete control over the selection of each individual data item and must actively consent to proceed before any data can be shared.

3. Authenticate with your bank

• You will be redirected to your bank's secure authentication page and sign-in using your normal banking credentials.
• The party that you are interacting with will never receive your online banking identity or password.

4. Review and approve

• Your bank will present a consent screen containing the following:
  • The accredited recipient;
  • The account(s) to be shared;
  • The types of data requested; and
  • The duration of the consent.
• You can then confirm your final approval to proceed.

5. Data sharing begins

• Once approved, the bank securely shares the authorised data with the accredited provider via CDR APIs.
  • API stands for Application Programming Interface. It is a set of rules and protocols which allow software applications to communicate and share data with one another.
• To reiterate, Open Banking in Australia is strictly opt-in. Customers must provide explicit consent before any banking data is shared, and they remain in control of that consent throughout the sharing period.

Your data will only be made available through Open Banking if you opt-in to provide information to an accredited third-party, so the decision on whether your data is made available or not is entirely yours.

You can also change your mind and revoke your consent at any time.