This page covers 90-day notifications as per rule 4.20 (and 4.20U for CDR representatives) and the associated consumer experience data standards.
This page outlines requirements that take effect on 14 July 2025.
The existing requirements regarding notifications about current consents will continue to apply until the relevant CX standards are made and in effect, as per the transitional provision outlined in CDR Rule 504 (and 507 for CDR representatives).
Data recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to notifications about current consents until this date.
Overview
The CDR Rules require, where a collection, use or disclosure is current, but 90 days have passed since the CDR consumer either gave or amended the consent, used their consumer dashboard or received a notification under the same rule, the consumer to be notified by the data recipient that the consent is still current.
Where circumstances apply to more than one current consent, a data recipient can give the consumer a single notification setting out all the current consents. In other words, a separate notification does not need to be given for each consent. The notifications must be given in accordance with the consumer experience data standards.
Wireframes and guidelines
Note: The wireframes shown are examples of how to implement key rules, standards, and guidelines. Use the on-screen functions to adjust zoom level or expand the wireframes to be viewed at full screen.
The following wireframes show 90-day notification examples across different delivery methods — email, SMS, and push notification. It also cover two scenarios:
- a single consent notification; and
- multiple consents consolidated into one notification.
Download open source asset
Open source design assets are created in Figma for the purposes of assisting implementation. This Figma file contains annotated wireframes for 90-day Notifications.
Item | File | Date released | Version introduced |
|---|---|---|---|
4CM4. Notifications: 90-day Notifications v1.33.0.2025.02.27 | 4CM4. 90-day notification v1.33.0.2025.02.27.fig | February 27, 2025 | 1.33.0 |
For past versions, refer to Change log.
About this page
References
The artefacts on this page were informed by the following sources.
Title | Author | Date published | URL | Type |
|---|---|---|---|---|
Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes | Data Standards Body (DSB) | October 2, 2024 | github.com | Consultations |
Consumer Data Right Rules: consent and operational enhancement amendments consultation | The Treasury | August 9, 2024 | treasury.gov.au | Consultations |
Decision Proposal 350: August 2024 Rules - Standards Impacts | Data Standards Body (DSB) | June 6, 2024 | github.com | Consultations |
Phase 2, Stream 3 Research Report | Tobias | July 31, 2019 | cx.dsb.gov.au | Research |
Last updated
This page was updated @February 27, 2025
Have your say
Community consultations and maintenance are part of our ongoing process. Here’s how you can get involved:
- Request new Guidelines or changes to existing Guidelines through the CX Guidelines Consultation process
- Request new Standards or changes to existing Standards through the Standards Maintenance process
- Log a ticket for any questions about the rules, standards, or guidelines through the CDR Support Portal
- Email your feedback to cx@dsb.gov.au
Quick links to CX Guidelines:
Overview
Consent
Authenticate
Authorise
Consent Management
Notifications
Accessibility statement
→ cx@dsb.gov.au → cx.dsb.gov.au | cds.gov.au