Consumer Data Right

Statute Australia

Australia’s Consumer Data Right (CDR) is a general, economy-wide data-portability law — not a banking rule that happens to touch data. It gives consumers a legal right to direct that their data be shared, securely, with accredited recipients, and it was switched on in banking first as the country’s version of open banking.

• A right, sector by sector - The CDR is designed to roll across the economy (banking, then energy, then beyond), with banking as the proving ground; the law defines the accreditation, consent, and privacy-safeguard machinery, and the Data Standards Body writes the technical contract.
• Data sharing, not payment initiation - Unlike the UK and EU regimes, the CDR as implemented is read-only — an accredited recipient can read a consumer’s banking data but cannot initiate a payment. An agent can see your account; it cannot act on it.
• Accreditation and consent as the gate - Access to the consumer-data surface is gated behind ACCC accreditation and explicit, revocable consumer consent, mapped to a least-privilege scope model.

The CDR is the cleanest specimen in my research of a mandate producing existence, not quality: it dragged an entire banking sector across the machine-readability line, and left governance, operational transparency, and product maturity to each bank. It is the law; the Consumer Data Standards are the contract that makes it real.

The energy extension — a mandate proved replicable

The CDR was designed for banking and then designated into energy, where it is live. That makes it the only regime in this catalog tested twice, in two different industries, under the same statute, regulator and standards body — and The State of Australian Energy APIs measured what happened.

It transplanted. Across ninety-five energy organizations researched across four markets, those with a live, verified mandate implementation average 42.2 against 30.2 for organizations under no obligation at all. Australia leads the four-market energy quartet at 41.6 with agent-readiness of 57.3, against the United States’ 30.2 — and the United States has had a perfectly serviceable voluntary standard, Green Button, for over a decade.

Three things that regime designers should take from it:

• Verification is the whole mechanism. Organizations that claim the mandate but whose implementation could not be verified average 30.4 — lower than having no obligation. The CDR’s public register, standards-conformant discovery endpoints and ACCC-issued certificates are what make the difference checkable from outside. A compliance page proves nothing.
• It produced the only shared vocabulary in the series. Four Australian retailers publish byte-identical cds-energy and cds-common documents. No unmandated market anywhere in this research shares a domain resource across more than two organizations.
• The obligation transplanted; the architecture did not. CDR banking has every bank self-hosting its own Product Reference Data. CDR energy centralises it at the regulator: AGL’s own base URI returns 404 on /energy/plans while the AER’s gateway serves 1,343 AGL plans anonymously. Same law, redesigned topology — plan for that when designating the next sector.

What it did not deliver is governance. Australian energy scores 1.6 on that facet with twenty-one of twenty-four organizations at zero. The CDR specifies schemas, a security profile and a consent model, and says nothing about versioning or deprecation. A mandate delivers exactly what it asks for.

Worth reading against the two other energy instruments in this catalog: Ontario Regulation 633/21, which compelled adoption of an existing standard and produced far less, and Ofgem’s Data Best Practice Guidance, which aimed a comparable obligation at network data instead of customer data and got world-class results in that lane.