CX Guidelines

Read first CX Checklist attributes ◦ Area refers to the stage in the consumer journey, such as Pre-consent, Consent, Authenticate, Authorise, or Consent Management. ◦ Focus area refers to a specific theme in each stage (e.g. 01. User Identifier). ◦ Checklist ref contains a unique reference number for the item. ▪ The first values refer to the Area (e.g. 0DL.xx.xx for data language; 2AU.xx.xx for authentication). ▪ The second set values refer to the Focus area (e.g. xxx.01.xx). ▪ The last values refer to the annotation number used on the wireframe, where available (e.g. xxx.xx.02; wireframes are linked to in the Example column). ◦ Type refers to the source of the statement: Rules, Standards and Guidelines. ◦ Participant refers to the relevant CDR Participant for the item. ◦ Requirement level refers to the level of obligation. For the data standards, the key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY are to be interpreted as described in RFC2119. CX Guidelines provide optional examples and recommendations; as such, a MAY is used to denote a CX Guideline for the purposes of this checklist regardless of the language used in the guideline statement. ◦ Statement refers to the relevant requirement or recommendation as articulated in the rules, standards, or guidelines. ◦ References points to the requirement itself, or its location; typically a rule, standard, or research. ◦ Example links to the relevant artefact, such as the CX Guideline page, which includes wireframes of example implementations, or a table in the case of data language standards. ◦ Version introduced refers to the version of the data standards that was current when the item was introduced to the CX Guidelines, starting from version 1.4.0. Items noted as introduced in 1.4.0 or earlier are requirements that exist in v1.4.0 of the CX Guidelines (PDF). ◦ Date introduced refers to the specific date the item was introduced to the CX Checklist, using August 2020 as a starting point (when v1.4.0 was introduced). The date will typically be the date of the version release, but some new items may not constitute a standards change (e.g. a revised wireframe or rules change) and as such may not align with standards versioning. ◦ Date modified refers to when an existing CX Checklist entry was updated, which is not necessarily the date the corresponding requirement (Rule, Standard or Guideline) was changed. ◦ Status refers to whether the item is active or has been retired from the CX Guidelines. An 'active' item is applicable and current. A 'retired' item may be labelled as such because it no longer applies, has been merged with another item, or has been removed from the CX Guidelines. A 'retired' item may still be a requirement. These statuses are used in the live CX Checklist and CSV to highlight changes between versions of the CX Guidelines.

Wireframe ref	Type	Requirement level	Statement	Reference	Checklist ref	Focus area
01	CDR Rule	MUST	(1) This rule applies in relation to a collection consent, use consent or disclosure consent given under this Division if: (a) the consent is current; and (b) 90 days have elapsed since the latest of the following: (i) the CDR consumer gave the consent; (ia) the CDR consumer last amended the consent; (ii) the CDR consumer last used their consumer dashboard; (iii) the accredited person last notified the CDR consumer that the consent is still current. (2) The accredited person must notify the CDR consumer, in relation to each consent given by the CDR consumer that is still current, that the consent is still current. Note: This subrule is a civil penalty provision (see rule 9.8). (3) The notification must be given in accordance with the data standards. Note: This subrule is a civil penalty provision (see rule 9.8).	CDR Rule 4.20	4CM4.00.01	00. 90-day Notifications
02	CDR Rule	MUST	Rule 4.20 of the principal rules, as in force immediately before the commencement of the amending rules, continues to apply, on and after that commencement, to an accredited person until the coming into effect of data standards made for the purposes of paragraph 8.11(1)(fb) of the principal rules in relation to rule 4.20.	CDR Rule 504	4CM4.00.02	00. 90-day Notifications
03	CX Standard	MUST	A 90-day notification provided by a data recipient MUST be given in writing otherwise than through the consumer dashboard.	Notification Standards, 90-day notifications: Delivery	4CM4.00.03	00. 90-day Notifications
04	CX Standard	MUST	A 90-day notification provided by a data recipient: • MUST include the following information: ◦ The name of the person the CDR consumer gave consent to; and ◦ The purpose of the consent(s); and ◦ Instructions for how the consent(s) can be reviewed, which MAY include details, links, or interactive components that direct the consumer to their consumer dashboard • SHOULD include the following information: ◦ In the case of a collection consent, the name of each CDR participant, or number of participants, the CDR consumer consented to the collection of CDR data from; and ◦ In the case of a disclosure consent, the name of each person, or number of persons, the CDR consumer consented to the disclosure of CDR data to; and ◦ The expiry date(s) of the relevant consent.	Notification Standards, 90-day notifications: Content	4CM4.00.04	00. 90-day Notifications
05	CX Guideline	MAY	The CX Standards for 90-day notifications take effect on 14 July 2025. The existing requirements regarding notification of current consents will continue to apply until the relevant data standards are made and in effect, as per the transitional provision outlined in CDR Rule 504 (and 507 for CDR representatives). Data recipients should refer to the CDR Rules as they were in effect from 22 July 2023 to 11 November 2024 for details of their obligations with regards to notification of current consents until this date.	CDR Rules 4.20 and 504; 4.20U and 507 \| Notification Standards, 90-day Notifications	4CM4.00.05	00. 90-day Notifications
06	CX Guideline	MAY	CDR Representatives should refer to CDR Rule 4.20U for further information on their obligations when providing ongoing notifications.	CDR Rule 4.20U	4CM4.00.06	00. 90-day Notifications
07	CX Guideline	MAY	Where a 90-day notification is sent for a single consent, links or interactive components should direct the consumer directly to that consent on the dashboard.		4CM4.00.07	00. 90-day Notifications
08	CX Guideline	MAY	Data recipients should provide a consolidated notification when multiple consents align with CDR Rule 4.20(1). Being mindful of the rules and standards, the timing and delivery method of the 90 days reminder should also be considered to manage notification fatigue.	CDR Rule 4.20(1) \| Notification Standards, 90-day notifications \| CX Research: 2019 Phase 2, Stream 3 report	4CM4.00.08	00. 90-day Notifications
09	CX Guideline	MAY	Where a consolidated 90-day notification is sent for multiple consents, links or interactive components should direct the consumer to a view of consents that were included in the notification.		4CM4.00.09	00. 90-day Notifications