The Consumer Data Right, commonly known as CDR, is an Australian Government system designed to give customers greater control over information held about them by businesses.
It allows a customer to authorise selected data to be transferred securely from one participating provider to another. The customer decides whether information is shared, which organisation receives it, what it may be used for and how long the permission remains active.
CDR is already operating across banking and energy. From July 2026, it is also being progressively extended to eligible non-bank lenders. (Consumer Data Right)
How does CDR work?
CDR is an opt-in system. A business cannot simply access someone’s financial information because it wants to assess an application.
In a lending-related situation, the process may work as follows:
The customer chooses to use a service that participates in CDR.
The customer provides consent for specific information to be collected and used.
The participating bank or lender confirms the customer’s identity and authorisation.
The selected information is transferred through the secure CDR system.
The authorised recipient uses the information for the purpose agreed to by the customer.
Data can only be transferred to an accredited CDR participant or through an approved participation arrangement. Customers can withdraw their consent, and accredited businesses must comply with specific privacy, security and data-handling requirements. (ACCC)
An accredited provider should never ask a customer to provide their personal internet banking password as part of the CDR process. (OAIC)
What information can be shared through CDR?
The information available depends on the industry, provider, product and consent given by the customer.
In banking and lending, the information may include:
account balances and transaction history
current loans and credit accounts
repayment amounts and frequency
interest rates and fees
loan or account features
publicly available product information.
CDR includes two different types of information that should not be confused.
Product data is general information about the products a lender offers. This may include interest rates, fees, eligibility requirements and product features. It does not reveal information about an individual customer.
Consumer data relates to a particular customer and their accounts or lending arrangements. This information can only be transferred where the customer has provided the required consent and authorisation.
Is CDR the same as open banking?
Open banking is the banking component of the broader Consumer Data Right system.
CDR is intended to operate across multiple industries, while open banking specifically relates to banking data. Banking was the first sector to begin live consumer data sharing under CDR in July 2020, followed by the energy sector in November 2022. (ACCC)
The extension into non-bank lending is another stage in the broader rollout.
What is changing for non-bank lenders?
Non-bank lenders provide loans or credit but do not hold a full banking licence and do not accept customer deposits in the same way as banks.
They may include:
mortgage lenders
vehicle finance providers
personal loan providers
business and equipment finance providers
buy now, pay later providers.
The extension of CDR does not apply to every non-bank lender at the same time. The obligations are being introduced progressively, based partly on how lenders are classified under the CDR rules. (ACCC)
The non-bank lending rollout
The official rollout timetable includes three important stages.
From 13 July 2026
Initial providers and certain large non-bank lenders must begin making product data available electronically in a standardised format.
This may include information about loan types, interest rates, fees, eligibility requirements and other product features. This first stage relates to public product information rather than an individual customer’s private loan records.
From 9 November 2026
Non-bank lenders classified as initial providers must begin complying with consumer data-sharing obligations, except for certain complex data requests.
This is the stage at which eligible customer account and loan information may begin to be shared through CDR when the customer has provided consent.
From 10 May 2027
Consumer data-sharing obligations extend to relevant large providers that became large providers by the applicable date.
Non-bank lenders that become large providers later may have different commencement dates calculated from when they meet the relevant criteria. (Consumer Data Right)
What could CDR mean for loan applications?
The immediate change beginning in July 2026 is primarily technical. It does not mean every broker or lender can suddenly access a customer’s non-bank loan records.
However, as more non-bank lenders begin sharing consumer data, CDR could eventually reduce some of the manual work involved in collecting and verifying financial information.
With a customer’s consent, participating finance platforms may be able to retrieve verified information directly from participating lenders rather than relying as heavily on:
screenshots
downloaded account statements
manually entered balances
repayment figures supplied from memory
incomplete liability information.
This could make it easier to identify existing non-bank loans, confirm balances and repayments, compare products, assess refinancing options and reduce errors caused by missing or outdated information.
It may be particularly useful where a customer has vehicle finance, personal loans, equipment finance or other credit facilities with providers that do not appear alongside their everyday bank accounts.
Will CDR make loan applications faster?
CDR has the potential to make parts of the application and assessment process more efficient, but it will not remove every document or verification requirement.
A lender may still need information that is not available through CDR. Lending policies, responsible lending requirements, servicing calculations and credit assessment processes will also continue to apply.
The practical benefit is more likely to be improved access to accurate, structured and current information. Over time, that may help brokers and lenders spend less time entering figures manually and more time reviewing whether a proposed loan is suitable for the customer’s circumstances.
The benefit will also depend on whether the customer’s lender participates, what data is available and whether the broker’s finance platform is properly connected to an accredited CDR service.
Does the customer remain in control?
Customer consent is fundamental to CDR.
A customer must be told what information will be collected, why it is needed, who will receive it and how it will be used. Consent can also be withdrawn.
CDR participants are subject to legally binding privacy safeguards and strict requirements covering data security, collection, storage, use and deletion. (OAIC)
CDR therefore does not provide unrestricted access to financial information. It creates a controlled method for transferring selected data when the customer actively chooses to share it.
What happens next?
The commencement of product data sharing for non-bank lenders on 13 July 2026 is the first operational stage of the sector’s transition into CDR.
Customers are unlikely to notice an immediate change to most loan applications. The more significant change will occur progressively as eligible non-bank lenders begin sharing consumer account data and more finance platforms develop services that can use it.
Over time, the inclusion of non-bank lending may make loan information easier to verify and products easier to compare. It may also reduce the need for customers and brokers to repeatedly collect, upload and manually enter the same financial information.
For now, it is best understood as an important step towards a more connected lending system, rather than an overnight change to the application process.
Official information and further reading
Australian Government Consumer Data Right: What is CDR? (Consumer Data Right)
Australian Government Consumer Data Right: CDR in the non-bank lenders sector (Consumer Data Right)
Australian Competition and Consumer Commission: Non-bank lenders join Consumer Data Right as next stage commences (ACCC)
Office of the Australian Information Commissioner: Consumer Data Right privacy and security (OAIC)