Phases of Data Sharing Obligations

The deadlines for the Data Holders to comply with the Competition and Consumer (Consumer Data Right) Rules 2020 (CDR Rules) published by the ACCC are arranged in a timetable of stages. 

Under the CDR rules, the Data Holders are required to share information on specified products and specified types of information they possess on their consumers. The deadlines that apply to the Data Holders depend on the following:

1. Type of the bank 
2. Type of the request 
   • Product data requests
   • Consumer data requests made by CDR consumers
   • Consumer data requests made on behalf of CDR consumers
3. Type of the product that data is being requested on
   • phase 1 product
   • phase 2 product
   • phase 3 product
4. Whether you have applied to become an accredited Authorised Deposit-taking Institutions (ADI) or a voluntarily participating ADI

The CDR Rules define three types of services based on the types of requests that Data Holders are required to implement under the CDR. There are 3 ways to request CDR data under these rules:

1. Product Data Request
   • Any person may request CDR data that relates to products offered by the Data Holder.
   • A product data request cannot be made for CDR data that relates to a CDR consumer.
   • The Data Holder cannot impose conditions, restrictions or limitations on the disclosed data.
   • The data is shared as an API response.
2. Consumer data requests made by CDR consumers
   
   • CDR consumers request a data holder for CDR data that relates to them. 
   • A specialised online service provided by the data holder to make the request.
   • The data is shared through online banking details or SMS notifications.
3. Consumer data requests made on behalf of CDR consumers
   • An accredited entity (Data Recipients) request a Data Holder for CDR data that relates to a consumer on behalf of that consumer.
   • A specialised service provided by the data holder to make the request.
   • The data is shared as an API response.

These services translate into two technology phases according to the proposed phasing timetable applicable to ADIs. 

• Compliance Stage I: Expose the Product Reference Data (PRD) endpoints.
• Compliance Stage II: Reach full compliance with CDR data sharing obligations (covering all products, requests and data types).