Consumer Data Right
The age of open banking and beyond
Every day, banks and electricity providers collect vast amounts of data about us. Although this data serves these businesses exceptionally well, its utility extends far beyond their immediate uses. Yet, our ability to share and integrate this data with third parties has been limited – until now.
The Consumer Data Right (CDR) was established on 31 March 2025 under the Consumer and Product Data Act 2025. It is a framework for consumers to securely and efficiently access and share their data with trusted third parties. The CDR aims to bolster an individual’s control over their data as well as to increase competition and innovation across various industries.
Sector-by-sector approach
Not all sectors will be subject to the CDR. Instead, sectors will be designated individually. Banking is scheduled to become the first designated sector, with regulations for the four largest banks (ANZ, Westpac, BNZ and ASB) expected to come into effect by the end of 2025. Discussions are also underway to expand the CDR to the electricity, telecommunications and insurance sectors.
How it works
Once sector-specific regulations are in place, individuals may request the transfer of their data to accredited third parties under this framework. It even allows these accredited third parties to make such requests on behalf of the customer (with their authorisation). Businesses that come under this scheme are obligated to fulfil these requests. This includes providing access to some of their own product-related data and performing certain requested actions, such as closing accounts.
Preparing for accreditation
Accredited third parties must meet strict security requirements set by the Ministry of Business, Innovation, and Employment (MBIE). MBIE’s accreditation process is expected to include information security standards and data storage protocols. Businesses seeking accreditation as third parties within these sectors should begin assessing their security policies and data-handling practices while we wait for further direction.
Impact on businesses and consumers
Historically, access to this data has been in formats and mediums that are not portable. By ensuring that accredited third parties can directly obtain data that is readily integrated with their own services, it is hoped that the CDR will create a seamless experience for us – the customer.
With respect to the banking sector, the CDR could streamline moving banks, allow mortgage brokers to find better lending terms, and foster new and innovative services around budgeting or financial planning.
We will have to wait for the roll-out of these sector-specific regulations to get the full details as to how the CDR will work in practice. As regulations begin to roll out, businesses and consumers alike will need to stay informed about their rights and responsibilities under this transformative legislation.
DISCLAIMER: All the information published is true and accurate to the best of the authors’ knowledge. It should not be a substitute for legal advice. No liability is assumed by the authors or publisher for losses suffered by any person or organisation relying directly or indirectly on this article. Views expressed are those of individual authors, and do not necessarily reflect the view of this firm. Articles appearing in this newsletter may be reproduced with prior approval from the editor and credit given to the source. Copyright, NZ LAW Limited, 2019. Editor: Adrienne Olsen. E-mail: adrienne@adroite.co.nz. Ph: 029 286 3650 or 04 496 5513.