Australia's Consumer Data Right (CDR) is an economy-wide data-portability law that gives consumers the right to share their data with accredited third parties, beginning with banking (open banking). It is the legal mandate behind the Consumer Data Standards, requiring every accredited data holder to expose a byte-for-byte machine-readable API contract under a consent-and-accreditation regime.
Consumer Data Right
Australia’s Consumer Data Right (CDR) is a general, economy-wide data-portability law — not a banking rule that happens to touch data. It gives consumers a legal right to direct that their data be shared, securely, with accredited recipients, and it was switched on in banking first as the country’s version of open banking.
- A right, sector by sector - The CDR is designed to roll across the economy (banking, then energy, then beyond), with banking as the proving ground; the law defines the accreditation, consent, and privacy-safeguard machinery, and the Data Standards Body writes the technical contract.
- Data sharing, not payment initiation - Unlike the UK and EU regimes, the CDR as implemented is read-only — an accredited recipient can read a consumer’s banking data but cannot initiate a payment. An agent can see your account; it cannot act on it.
- Accreditation and consent as the gate - Access to the consumer-data surface is gated behind ACCC accreditation and explicit, revocable consumer consent, mapped to a least-privilege scope model.
The CDR is the cleanest specimen in my research of a mandate producing existence, not quality: it dragged an entire banking sector across the machine-readability line, and left governance, operational transparency, and product maturity to each bank. It is the law; the Consumer Data Standards are the contract that makes it real.
Referenced in API Evangelist papers
This regulation shows up in my published research. These reports read the machine-readable evidence provider by provider — and put this regulation in the context of a real sector.
The State of Australian Banking APIs
The law behind the fifty-bank commodity contract the report anatomizes — read-only data sharing, no payment initiation.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at contracts.apievangelist.com.
Consumer Data Standards
The machine-readable Banking API contract every accredited data holder implements to satisfy the CDR.
