Consumer Data Right (Open Banking) Integration in Australia: A Technical Guide for Product Teams
How product teams can use Australia's Consumer Data Right: sectors and status, accreditation and representative options, consent flows and data handling.
How can product teams use the Consumer Data Right?
The Consumer Data Right (CDR) lets Australian consumers direct banks, energy retailers and, progressively, non-bank lenders to share their data with accredited recipients through standardised APIs. Product teams can access it by becoming accredited, by operating as a CDR representative of an accredited principal, or by using an accredited intermediary; then they must build compliant consent flows, consumer dashboards, data handling and deletion, and meet the privacy safeguards. Choose the access model with legal advice before designing the product.
This guide is for fintech, proptech, accounting and energy product teams. It is general information, not legal advice. ZSpace Labs is not an accredited data recipient.
Key takeaways
- Banking and energy are live; non-bank lending is phasing in.
- Decide the access model first: accreditation, representative or intermediary.
- Consent flows follow the Consumer Data Standards.
- Consumers need a dashboard to see and withdraw consents.
- Delete or de-identify data when consent ends, as the rules require.
- Check current status on official sources; it changes.
Sectors and status
| Sector | Status (as reported, October 2026) |
|---|---|
| Banking | Live since 1 July 2020; all banks participate |
| Energy | Consumer data sharing since 15 November 2022 for covered retailers |
| Non-bank lending | Product data from 13 July 2026; consumer data phased in from 9 November 2026 by provider size |
| Action initiation | Framework legislated; specific actions require declarations and rules |
Access models
| Model | What it involves | Fits when |
|---|---|---|
| Accreditation | Apply to the ACCC; meet information security, insurance and governance requirements | CDR data is core to your business at scale |
| Sponsored accreditation | Accredited with an accredited sponsor collecting data for you | You want accreditation with less infrastructure |
| CDR representative | An accredited principal collects data on your behalf under a contract with required terms | Faster start; principal carries much of the compliance |
| Intermediary services | Accredited providers offer APIs and consent flows | Building directly would duplicate commodity work |
Building the experience
- Consent flows that follow the Consumer Data Standards and their consumer experience guidelines (Consumer Data Standards).
- Ask only for data you need, for a stated purpose and duration.
- Authentication with the data holder through the standard redirect flow; never collect bank passwords.
- A consumer dashboard to view and withdraw consents.
- Data handling: storage, access controls, logging, retention, deletion or de-identification when consent ends.
- Use product reference data (published by data holders) for comparison features without consumer consent.
- See privacy by design and OAuth and OpenID Connect for the underlying patterns.
Use cases
Common uses include income and expense verification for lending, budgeting and financial management apps, accounting feeds, energy plan comparison using actual usage, and switching services. Check that the data you need is in scope for the sector and that the use fits your access model.
Hypothetical example: a lending application flow
This example is hypothetical. A small lender wanted to replace bank statement uploads. Legal advice led it to start as a CDR representative of an accredited intermediary. Applicants chose their bank, were redirected to authenticate with it, consented to share 90 days of transactions for assessing the application, and could see and withdraw the consent in a dashboard. Data was deleted when the consent expired or the application closed, and screen scraping was removed.
Common mistakes
- Designing the product before choosing the access model.
- Asking for more data or a longer duration than needed.
- No consent dashboard or withdrawal path.
- Keeping data after consent ends.
- Assuming action initiation is available.
Related guides
- Fintech website development for the surrounding product.
- First-party data strategy for Privacy Act basics.
- Payment reconciliation automation for finance workflows.
- AI agents in banking for adjacent automation.
Conclusion
CDR offers a consented, standardised alternative to statement uploads and screen scraping. Choose an access model with legal advice, follow the standards for consent and authentication, give consumers control through dashboards, and delete data when consent ends. Check official sources for the latest sector status. For the UK's payments-led regime, see open banking integration in the UK.
Building a product on CDR data?
ZSpace Labs is an India-based, remote-first technology studio working with Australian and international businesses on fintech web applications and integrations and mobile apps. We are not an accredited data recipient or legal adviser, but we can build the product around your chosen access model.
Common questions.
An Australian regime that lets consumers direct data holders, such as banks and energy retailers, to share data about them securely with accredited recipients. It is often called open banking in the banking sector. It also requires data holders to publish product reference data.