This page covers collection and use consents as per the requirements in rule 4.11 and the associated consumer experience data standards.

Overview

In accordance with CDR rule 4.11(1)(Note 1), an accredited person cannot infer consent, or seek to rely on an implied consent.

Data recipients should make the consent process as easy to understand as possible by using appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.

This section provides examples illustrating how the guidelines may be implemented.

Wireframes and guidelines

Note: The wireframes shown are examples of how to implement key rules, standards, and guidelines. Use the on-screen functions to adjust zoom level or expand the wireframes to be viewed at full screen.

Collection and use consents - default example

The following wireframes show a basic example of a collection and use consent.

CDR outsourcing, sponsorship and CDR representative arrangements

Using outsourced service providers

An accredited person or CDR representative may engage outsourced service providers (OSPs) to do one or both of the following: (1) to collect CDR data on their behalf; (2) to use or disclose data to provide specified goods or services to them.

To do so, a written contract, called a CDR outsourcing arrangement, must be in place with the OSP which meets the requirements set out in the CDR Rules. A data recipient may have both direct and indirect OSPs. This can occur where a direct OSP of the data recipient engages further OSPs in their own CDR outsourcing arrangements.

For more information on CDR outsourcing arrangements, see OAIC’s guidance on privacy obligations for principals and outsourced service providers.

This section outlines requirements for OSPs that apply on and after 12 November 2025.

The previous requirements under CDR Rule 4.11(3)(f) of the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 will continue to apply until 11 November 2025, as per the transitional provision outlined in CDR Rule 502.

Sponsorship arrangement

The sponsored accreditation model allows a person accredited to the ‘sponsored’ level (an ‘affiliate’) to provide goods or services directly to a consumer. To do so, they must have a written contract with an unrestricted accredited person (a ‘sponsor’) who collect CDR data from data holders on their behalf.

For more information on the sponsored accreditation model, see OAIC’s guidance on privacy obligations of sponsors and affiliates.

CDR representative arrangement

Under CDR Rules 1.10AA, the CDR representative model enables unaccredited persons (a ‘CDR representative’) to provide goods and services to consumers using CDR data, when they are in a CDR representative arrangement with an unrestricted accredited person (’a CDR representative principal’) who is liable for them.

In accordance with CDR Rule 1.10AA(1)(a), CDR representatives cannot deal with consumers in their capacity as a CDR business consumer, and as such can’t invite consumers to give a business consumer statement.

For more information on the CDR representative model, see OAIC’s guidance on privacy obligations for CDR principals and CDR representatives as well as ACCC’s CDR outsourcing arrangement fact sheet.

Business consumer statement

An accredited person can treat a consumer as a business consumer if they take reasonable steps to confirm that the consumer is a business, using the criteria specified in CDR Rule 1.10A(9).

CDR Rule 1.10A(10) outlines the circumstances in which a business consumer can be asked to provide a business consumer statement. Importantly, a business consumer statement can’t be given in relation to a Collection consent. Additionally, CDR Representatives cannot deal with consumers in their capacity as a CDR business consumer, as per CDR Rule 1.10AA(1)(a).

The following wireframes provide an example of how an accredited person can invite a business consumer to give a business consumer statement in relation to a Use consent.

Holding data as a data holder

Under the CDR Rules Clause 7.2 of Schedule 3 (Conditions for accredited person to be data holder), an authorised deposit‑taking institution (ADI) or non-bank lender who is an accredited data recipient can hold CDR data as a data holder, provided the conditions of the clause are met.

Notification prior to first collection

The following wireframes show examples to reflect requirements for collection consent and subclause 7.2(2) of Schedule 3, Conditions involving notification prior to first collection.

Permission to hold collected data as a data holder

The following wireframes demonstrate how data recipients can obtain consumer permission to become a data holder of collected CDR data per subclause 7.2(2A) of Schedule 3.

Download open source asset

Download design asset

Item	File	Date released	Version introduced
1CO. Collection and use consents v1.35.0.2025.09.17	1CO. Collection and use consent v1.35.0.2025.09.17.fig	September 17, 2025	1.35.0

For past versions, refer to Change log.

About this page

References

The artefacts on this page were informed by the following sources.

Last updated

This page was updated @September 17, 2025

Have your say

Community consultations and maintenance are part of our ongoing process. Here’s how you can get involved:

• Request new Guidelines or changes to existing Guidelines through the CX Guidelines Consultation process
• Request new Standards or changes to existing Standards through the Standards Maintenance process
• Log a ticket for any questions about the rules, standards, or guidelines through the CDR Support Portal
• Email your feedback to cx@dsb.gov.au