Change log

Updated page content and example prototype to reflect v1.35.0 changes. For details relating to the example prototype, see Change logs: 1CO0. Pre-consent v1.35.0.2025.09.16 1CO. Collection and use consents v1.35.0.2025.09.17 2AU1. Redirect to App v1.35.0.2025.09.22 3AU. Authorisation to disclose v1.35.0.2025.09.24 4CM1. Collection and use consent v1.35.0.2025.09.17 4CM2. DR Withdrawal v1.35.0.2025.09.17

Overview: The Consent Flow

Updated CX checklist (web version and files) to reflect requirement changes relating to: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation; and • Change Request 703: CX Guidelines | Pre-consent. Download files CX Checklist v1.35.0.2025.09.26 For details, see Change logs: Consent: Pre-consent v1.35.0.2025.09.16 Consent: Collection and use consents v1.35.0.2025.09.17 Consent: Disclosure consents, Accredited person disclosure consents v1.35.0.2025.09.15 Consent: Disclosure consents, Trusted Adviser disclosure consents v1.35.0.2025.09.15 Consent: Disclosure consents, Insights disclosure consents v1.35.0.2025.09.12 Consent: Disclosure consents, Business Consumer disclosure consents v1.35.0.2025.09.12 Consent: Amending consent v1.35.0.2025.09.22 Authenticate: Redirect to App v1.35.0.2025.09.22 Authenticate: Fallback Authentication Framework v1.35.0.2025.09.22 Authenticate: Redirect to Web with One Time Password v1.35.0.2025.09.22 Authorise: Authorisation to disclose v1.35.0.2025.09.24 Authorise: Amending authorisations v1.35.0.2025.09.24 Consent management (Data recipient): Collection and use consents v1.35.0.2025.09.17 Consent management (Data recipient): Withdrawal v1.35.0.2025.09.17 Overview: Open source assets v1.35.0.2025.09.26

Overview: CX Checklist

As part of general maintenance, updates to CX artefacts to reflect: • UI uplift; and • Minor changes to guidelines stemming from Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines, relating to: ◦ CDR receipts delivery channel (updated checklist item: 4CM3.00.08) ◦ CDR data sharing education (updated checklist item: 5CM5.01.19) For more details, see Change log: 3AU2. Authorisation to disclose joint account data v1.35.0.2025.09.12 4CM1. Disclosure consents v1.35.0.2025.09.23 4CM3. Notifications: CDR Receipt v1.35.0.2025.09.23 5CM1. Authorisations v1.35.0.2025.09.23 5CM2. DH Withdrawal v1.35.0.2025.09.23 5CM3. Joint account disclosure option management service v1.35.0.2025.09.26 5CM5. Joint account notification settings v1.35.0.2025.09.25

Overview: Open Source Assets

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; and • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation. This includes: • Visual, UI and Experiential updates to reflect the new standard requirements and guidance. Default example Standards changes • New standards relating to passwords (new checklist item: 3AU1.00.27) • Updates to standards relating to: ◦ language to be used (updated checklist item: 3AU1.02.14) ◦ detailed scope requests (updated checklist item: 3AU1.02.25) Guidelines changes • New CX guideline relating to authorisation period (new checklist item: 3AU1.02.28) • Updates to guideline relating to historical data ranges (updated checklist item: 3AU1.02.18) Unavailable accounts New CX artefacts and requirements relating to unavailable accounts in the amending authorisation flow. These artefacts provide implementation examples that reflect standards for Unavailable Accounts and related guidelines. CX Guideline website page • Updates to page hierarchy to add new section for ‘Unavailable accounts’ • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 3AU1. Amending authorisations v1.35.0.2025.09.24

Authorise: Amending authorisations

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; and • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation. This includes: Authorise - Default example Standards changes • New standards relating to passwords (new checklist item: 3AU.00.28) • Updates to standards relating to: ◦ language to be used (updated checklist item: 3AU.02.14) ◦ detailed scope requests (updated checklist item: 3AU.02.24) Guidelines changes • New CX guideline relating to authorisation period (new checklist item: 3AU.02.29) • Updates to guideline relating to historical data ranges (updated checklist item: 3AU.02.17) Unavailable accounts Standards changes Retirement of standard reference due to not being applicable to the flow. The standard remains in force (updated checklist item: 3AU.03.05) Guidelines changes • New guideline providing information on how data holders can meet the unavailable accounts standards, including ways to mitigate cognitive overload, facilitate comprehension and provide transparency and control (new checklist item: 3AU.03.09) • Updates to guideline relating to: ◦ types of accounts that may be unavailable (updated checklist items: 3AU.03.03 and 3AU.03a.03) ◦ requesting sharing rights (updated checklist items: 3AU.03.08 and 3AU.03b.08) Selection functionality Standards changes New standards relating to adding or switching profiles (new checklist item: 3AU.05.07) Guidelines changes New CX guidelines relating to: • adding or switching profiles (new checklist item: 3AU.05.08) • profile selection (new checklist item: 3AU.05.09) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 3AU. Authorisation to disclose v1.35.0.2025.09.24

Authorise: Authorisation to disclose

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Amending collection and use consent Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO2.01.66) ◦ redirect to app (new checklist item: 1CO2.01.67) ◦ decoupled authentication (new checklist item: 1CO2.01.68) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO2.01.33) ◦ detailed scope requests (updated checklist item: 1CO2.01.34) Amending business consumer disclosure consent - Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO2.02.23) • detailed scope requests (updated checklist item: 1CO2.02.24) Amending business consumer disclosure consent - Bundled CDR consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO2.03.57) ◦ redirect to app (new checklist item: 1CO2.03.58) ◦ decoupled authentication (new checklist item: 1CO2.03.59) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO2.03.31) ◦ detailed scope requests (updated checklist item: 1CO2.03.32) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO2. Amending consent v1.35.0.2025.09.22

Consent: Amending consents

New CX artefacts and requirements to reflect: • Consultation Draft 369: Redirect to App - Draft Standards; and • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes. This includes: • New CX artefacts and requirements relating to Redirect to App. These artefacts provide implementation examples that reflect standards for Authentication Schedule, Consumer Experience and Security Profile, and related guidelines. • New open source design asset 2AU1. Redirect to App v1.35.0.2025.09.22

Authenticate: Redirect to App

New CX artefacts and requirements to reflect: • Consultation Draft 369: Redirect to App - Draft Standards; and • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes. This includes: • New CX artefacts and requirements relating to the Fallback Authentication Framework. These artefacts include an example flow that reflects standards for Authentication Schedule, Consumer Experience, Security Profile, and related guidelines. • New open source design asset 2AU0. Fallback Authentication Framework v1.35.0.2025.09.22

Authenticate: Fallback Authentication Framework

Updated CX artefacts and requirements to reflect: • Consultation Draft 369: Redirect to App - Draft Standards; and • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes. This includes: • Visual, UI and Experiential updates to reflect the new standard requirements Standards changes • New standards relating to: ◦ fallback authentication flows (new checklist item: 2AU.00.26) ◦ friction (new checklist item: 2AU.00.27) ◦ levels of assurance (new checklist item: 2AU.00.28) ◦ app install (new checklist item: 2AU.00.29) ◦ one time password credential requirements (new checklist item: 2AU.00.30) ◦ passwords (new checklist item: 2AU.00.31) ◦ memorised secrets (new checklist item: 2AU.00.32) ◦ profile selection (new checklist item: 2AU.00.33) • Updates to standard relating to: ◦ password link (updated checklist item: 2AU.00.02) ◦ one time password expiry (updated checklist item: 2AU.03.05) ◦ one time password credential requirements (updated checklist item: 2AU.00.06, 2AU.03.08, 2AU.03.10–15) ◦ user identifiers (updated checklist item: 2AU.01.07) • Retirement of existing standard requirements due to their removal from the standards (retired checklist items: 2AU.00.03–4, 2AU.00.09) Guidelines changes • New CX guidelines relating to: ◦ authentication methods (new checklist item: 2AU.00.34) ◦ authentication credentials (new checklist item: 2AU.00.35) ◦ app download link (new checklist item: 2AU.00.36) • Updates to guidelines relating to CDS guidelines and conventions (updated checklist item: 2AU.01.20–21) CX Guideline website page • Updates to page title and content from ‘Redirect with One Time Password’ to ‘Redirect to Web with One Time Password’ • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 2AU. Redirect to Web with One Time Password v1.35.0.2025.09.22

Authenticate: Redirect to Web with One Time Password

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Collection and use consents - Default example Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO.00.56) ◦ redirect to app (new checklist item: 1CO.00.57) ◦ decoupled authentication (new checklist item: 1CO.00.58) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO.02.26) ◦ detailed scope requests (updated checklist item: 1CO.02.27) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO.01.30) ◦ CDR data sharing education (updated checklist item: 1CO.02.50) ◦ CDR receipts delivery channel (updated checklist item: 1CO.00.54) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO.01.32) CDR representative arrangement Guidelines changes Updates to guideline relating to CDR receipts delivery channel (updated checklist item: 1CO.03c.38) Business consumer statement Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO.04.17) • detailed scope requests (updated checklist item: 1CO.04.18) Notification to hold data as a data holder New CX artefacts and requirements for clause 7.2 of Schedule 3, Conditions for accredited person to be data holder. These artefacts provide implementation examples to reflect requirements for collection consent and subclause 7.2(2) of Schedule 3, Conditions involving notification prior to first collection. Permission to hold collected data as a data holder New CX artefacts and requirements relating to clause 7.2 of Schedule 3, Conditions for an accredited person to be a data holder. These artefacts demonstrate how data recipients can obtain consumer consent to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO. Collection and use consents v1.35.0.2025.09.17

Consent: Collection and use consents

Updated CX artefacts and requirements to reflect Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH. This includes: AP holding collected data as a data holder New CX artefacts and requirements relating to consent management for clause 7.2 of Schedule 3 — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for data recipient dashboards regarding collection consents where subclause 7.2(2) of Schedule 3 applies. Permission to hold collected data as a data holder New CX artefacts and requirements relating to consent management when clause 7.2 of Schedule 3 is in effect — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for data recipient dashboards where consumers have granted permission for the recipient to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 4CM1. Collection and use consent v1.35.0.2025.09.17

Consent Management (Data recipient): Collection and use consents

Updated CX artefacts and requirements to reflect Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH. This includes: Collection consent withdrawal — AP holding collected data as a data holder New CX artefacts and requirements relating to consent withdrawal for clause 7.2 of Schedule 3 — conditions for accredited person to be data holder. These artefacts provide implementation examples to reflect requirements for collection consent withdrawal where subclause 7.2(2) of Schedule 3 applies. Consent withdrawal – Permission to hold collected data as a data holder New CX artefacts and requirements relating to consent withdrawal when clause 7.2 of Schedule 3 is in effect — conditions for an accredited person to be a data holder. These artefacts provide implementation examples for consent withdrawal where consumers have granted permission for the recipient to become a data holder of collected CDR data (subclause 7.2(2A) of Schedule 3). CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 4CM2. DR Withdrawal v1.35.0.2025.09.17

Consent Management (Data recipient): Withdrawal

New CX artefacts and optional guidance to reflect Change Request 703: CX Guidelines | Pre-consent. This includes: • New CX artefacts and guidance relating to Pre-consent. This is the screens after the consumer has commenced CDR onboarding, but before the step where their CDR consent is sought. This guidance is optional and does not include any mandatory requirements. These artefacts provide implementation examples to reflect CX research and new guidelines that may facilitate a consumer's propensity to consent and aid their understanding of the process. • New open source design asset 1CO0. Pre-consent v1.35.0.2025.09.16

Consent: Pre-consent

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow - Disclosing unmodified data Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO1.01.24) • detailed scope requests (updated checklist item: 1CO1.01.25) Detached flow - Disclosing modified data Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO1.02.06) • detailed scope requests (updated checklist item: 1CO1.02.07) Bundled CDR consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO1.03.47) ◦ redirect to app (new checklist item: 1CO1.03.48) ◦ decoupled authentication (new checklist item: 1CO1.03.49) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO1.03.21) ◦ detailed scope requests (updated checklist item: 1CO1.03.22) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO1.03.28) ◦ CDR data sharing education (updated checklist item: 1CO1.03.41) ◦ CDR receipts delivery channel (updated checklist item: 1CO1.03.44) • Retirement of guideline relating to data holder selection (retired checklist item: 1CO1.03.30) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO1. AP disclosure consent v1.35.0.2025.09.15

Consent: Disclosure consents, Accredited person disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO3.00.09) • detailed scope requests (updated checklist item: 1CO3.00.10) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO3.00.42) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO3.01.60) ◦ redirect to app (new checklist item: 1CO3.01.61) ◦ decoupled authentication (new checklist item: 1CO3.01.62) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO3.01.08) ◦ detailed scope requests (updated checklist item: 1CO3.01.09) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO3.01.51) ◦ CDR receipts delivery channel (updated checklist item: 1CO3.01.58) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO3.01.53) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO3. Trusted Adviser disclosure consent v1.35.0.2025.09.15

Consent: Disclosure consents, Trusted Adviser disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: language to be used (updated checklist item: 1CO4.00.14) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO4.00.52) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO4.01.62) ◦ redirect to app (new checklist item: 1CO4.01.63) ◦ decoupled authentication (new checklist item: 1CO4.01.64) • Updates to standards relating to: language to be used (updated checklist item: 1CO4.01.22) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO4.01.41) ◦ CDR receipts delivery channel (updated checklist item: 1CO4.01.59) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO4.01.43) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO4. Insights disclosure consent v1.35.0.2025.09.12

Consent: Disclosure consents, Insight disclosure consents

Updated CX artefacts and requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; and • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367. This includes: Detached flow Standards changes Updates to standards relating to: • language to be used (updated checklist item: 1CO5.00.20) • detailed scope requests (updated checklist item: 1CO5.00.21) Guidelines changes Updates to guidelines relating to: CDR receipts delivery channel (updated checklist item: 1CO5.00.46) Bundled CDR Consents Standards changes • New standards relating to: ◦ passwords (new checklist item: 1CO5.01.70) ◦ redirect to app (new checklist item: 1CO5.01.71) ◦ decoupled authentication (new checklist item: 1CO5.01.72) • Updates to standards relating to: ◦ language to be used (updated checklist item: 1CO5.01.32) ◦ detailed scope requests (updated checklist item: 1CO5.01.33) Guidelines changes • Updates to guidelines relating to: ◦ brand selection filtering (updated checklist item: 1CO5.01.48) ◦ CDR data sharing education (updated checklist item: 1CO5.01.63) ◦ CDR receipts delivery channel (updated checklist item: 1CO5.01.67) • Retirement of guidelines relating to data holder selection (retired checklist item: 1CO5.01.50) CX Guideline website page • Updates to include references to consultations standards and guidelines • Updates to CX checklist • New open source design asset 1CO5. Business consumer disclosure consent v1.35.0.2025.09.12

Consent: Disclosure consents, Business consumer disclosure consents

As part of general maintenance, updates to research participant demographic information to reflect CX research until Q3 2025. This has resulted in figure updates on multiple pages, including: • most data tables on Participant demographics • ‘Participants engaged in CX research’ section on Accessibility, inclusivity and the CDR • ‘About CDR behavioural archetypes’ section on Behavioural archetypes

Overview: Participant demographics Accessibility, inclusivity and the CDR Behavioural archetypes

Updated CX artefacts and requirements to reflect Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines. This includes: Amending collection and use consent Standards changes Updates to standards relating to previously future dated obligations that have now come into effect (updated checklist items: 1CO2.01.62, 1CO2.00.63) Guidelines changes • Updates to guidelines relating to: ◦ CDR data sharing education (updated checklist item: 1CO2.00.60) ◦ CDR receipts (updated checklist item: 1CO2.00.64) • Retirement of guideline relating to previously future dated obligations that have now come into effect (updated checklist item: 1CO2.00.65) Amending business consumer disclosure consent - Detached flow Standards changes Updates to standards relating to previously future dated obligations that have now come into effect (updated checklist items: 1CO2.02.35–36) Guidelines changes • Updates to guidelines relating to CDR receipts (updated checklist item: 1CO2.02.40) • Retirement of guideline relating to previously future dated obligations that have now come into effect (updated checklist item: 1CO2.02.41) Amending business consumer disclosure consent - Bundled CDR Consents New CX artefacts and requirements relating to amending bundled collection, use and disclosure consents for business consumers. These artefacts provide implementation examples to follow relevant rules and standards and better demonstrate a more probable implementation. CX Guideline website page • Updates to page hierarchy to add new section for ‘Amending business consumer disclosure consent - Bundled CDR Consents’ • Updates to include references to consultations for guidelines • Updates to CX checklist • New open source design asset 1CO2. Amending consent v1.35.0.2025.08.04

Consent: Amending consents

Updates to content stemming from: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes CDR Rules on Consent Retirement of this page due to outdated information and low engagement. To improve user experience and streamline site maintenance, relevant content has been relocated to Consent pages: • Collection and use consents • Accredited person disclosure consents • Trusted Adviser disclosure consents • Insight disclosure consents • Business consumer disclosure consents • Amending consents Simplicity Retirement of this page due to outdated information and low engagement. To improve user experience and streamline site maintenance, relevant content can be found on Data Standards Principles The Consent Flow • Updates to better clarify Pre-consent • Updates to the prototype to reflect changes up to v1.34.0 • Updates to page structure to elevate example prototype The Consent Model Updates to page structure to: • separate Consent Management and Notifications • include example prototype

Overview: About consent, The Consent Flow Overview: About consent, The Consent Model

As part of general maintenance: • Updates to align content with definitions provided on the CDR website, Data Standards website and other CDR guidance • New section to cover terms and placeholder text used in CX Guideline wireframes

Overview: Glossary

As part of general maintenance, updates to research participant demographic information to reflect CX research until Q1 2025. This has resulted in figure updates on multiple pages, including: • most data tables on Participant demographics • ‘Participants engaged in CX research’ section on Accessibility, inclusivity and the CDR • ‘About CDR behavioural archetypes’ section on Behavioural archetypes

Overview: Participant demographics Accessibility, inclusivity and the CDR Behavioural archetypes

As part of general maintenance, updates to align images and content to DSB re-brand.

Overview: How to use these guidelines

Updated CX checklist (web version and files) to reflect requirement changes relating to: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes; • Change Request 574: Additional functionality to support account selection; • Change Request 659: Enhancing CDR Adoption: Streamlining Account Selection and Improving Data Transparency; and • Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines Download files CX Checklist v1.34.0.2025.03.19 For details, see Change logs: Consent: Collection and use consents v1.33.0.2025.03.05 Consent: Amending consent v1.33.0.2025.03.05 Consent: Disclosure consents, AP disclosure consents v1.34.0.2025.03.19 Consent: Disclosure consents, Trusted Adviser disclosure consents v1.34.0.2025.03.19 Consent: Disclosure consents, Insights disclosure consents v1.34.0.2025.03.19 Consent: Disclosure consents, Business Consumer disclosure consents v1.34.0.2025.03.19 Consent management (Data recipient): Collection and use consents v1.33.1.2025.03.07 Consent management (Data recipient): Disclosure consents v1.33.1.2025.03.07 Consent management (Data recipient): Withdrawal v1.33.1.2025.03.07 Notifications: CDR Receipts v1.33.0.2025.02.27 Notifications: 90-day Notifications v1.33.0.2025.02.27 Authorise: Authorisation to disclose joint account data v1.33.0.2025.02.26 Consent management (Data holder): Authorisations v1.33.0.2025.02.26 Consent management (Data holder): Withdrawal v1.33.0.2025.02.26 Consent management (Data holder): Account permissions - Secondary Users v1.33.0.2025.02.26 Authorise: Authorisation to disclose v1.32.0.2024.12.10 Consent: Disclosure consents, Trusted Adviser disclosure consents v1.31.0.2024.10.03

Overview: CX Checklist

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • Visual, UI and Experiential updates to reflect the new rule and standard requirements TA disclosure consents - Detached flow Rules changes • New rules annotations relating to: ◦ information that must be given to a consumer during the consent process (new checklist reference 1CO3.00.36) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (new checklist item: 1CO3.00.37) ◦ transitional provisions for CDR Receipts (new checklist item: 1CO3.00.38) • Updates to existing rules requirements relating to requirements for: ◦ seeking consent including bundling (updated checklist item: 1CO3.00.01) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist item: 1CO3.00.02 and 1CO3.00.05) ◦ CDR Receipts (updated checklist item: 1CO3.00.06) • Retirement of existing rules requirements due to their removal from the rules (retired checklist item: 1CO3.00.07 and 1CO3.00.08) Standards changes New CX standard relating to CDR Receipt delivery (new checklist item: 1CO3.00.39) Guidelines changes • New CX guidelines relating to: ◦ when the TA selection step should be included or omitted (new checklist item: 1CO3.00.40) ◦ upfront information to onboard the consumer (new checklist item: 1CO3.00.41) ◦ CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO3.00.42–3) • Updates to existing CX guidelines to better clarify expectations (updated checklist items: 1CO3.00.29 and 1CO3.00.35) • Retirement of CX guideline annotations: ◦ that have been removed from this artefact for simplicity, stemming from feedback on CR674 (retired checklist items: 1CO3.00.19–20) ◦ relating to CDR Receipts (retired checklist item: 1CO3.00.31) TA disclosure consents - Bundled CDR Consents Rules changes • New rules annotations relating to: ◦ seeking consent including bundling (new checklist item: 1CO3.01.35–36 and 1CO3.01.39) ◦ information that must be given to a consumer during the consent process (new checklist item: 1CO3.01.36, 1CO3.01.41–43) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (new checklist item: 1CO3.01.38) ◦ the data minimisation principle (new checklist item: 1CO3.01.37 and 1CO3.01.40) ◦ redundant data handling (new checklist item: 1CO3.01.44) ◦ CDR Receipts and transitional provisions for CDR Receipts (new checklist item: 1CO3.01.45–46) • Updates to existing rules requirements relating to requirements for: ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist item: 1CO3.01.01 and 1CO3.01.03) ◦ seeking consent including bundling (updated checklist item: 1CO3.01.04) ◦ CDR Receipts (updated checklist item: 1CO3.01.05) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO3.01.06–07) Standards changes • New annotation of existing CX standard relating to the Collection Source (new checklist item: 1CO3.01.47) • New CX standard relating to CDR Receipt delivery (new checklist item: 1CO3.01.48) • Retirement of standards annotations that — while not removed from the standards — have been removed from this artefact to simplify the consent flow (retired checklist item: 1CO3.01.13–14) Guidelines changes • New CX guidelines relating to: ◦ data holder selection (new checklist items: 1CO3.01.49–53) ◦ when the TA selection step should be included or omitted (new checklist item: 1CO3.01.54) ◦ time period and the data minimisation principle (new checklist item: 1CO3.01.55) ◦ data recipient accreditation verification (new checklist item: 1CO3.01.56) ◦ the display of information (new checklist item: 1CO3.01.57) ◦ CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist item: 1CO3.01.58–59) • Updates to existing CX guidelines to better clarify expectations (updated checklist item: 1CO3.01.27 and 1CO3.01.33–34) • Retirement of CX guideline annotations that have been removed from this artefact for simplicity, stemming from feedback on CR674 (retired checklist items: 1CO3.00.19–20) CX Guideline website page • Updates to page hierarchy for clarity — ◦ updates to section title, from ‘Detached flow - default example’ to ‘Detached flow' ◦ new section for ‘Bundled CDR Consents’ • Updates to include references to consultations for rules, standards and guidelines • Updates to CX checklist • New open source design asset 1CO3. Trusted Adviser disclosure consent v1.34.0.2025.03.19

Consent: Disclosure consents, Trusted Adviser disclosure consents

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • Visual, UI and Experiential updates to reflect the new rule and standard requirements Business consumer disclosure consents - Detached flow Rules changes • New annotations relating to: ◦ information that must be given to a consumer during the consent process (new checklist item: 1CO5.00.38) ◦ seeking consent (updated checklist item: 1CO5.00.39) ◦ transitional provisions for CDR Receipts (new checklist item: 1CO1.00.40) • Updates to existing rules requirements relating to requirements for: ◦ seeking consent including bundling (updated checklist item: 1CO5.00.01) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist items: 1CO5.00.04, 1CO5.00.11 and 1CO5.00.14) ◦ CDR Receipts (updated checklist item: 1CO5.00.15) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO5.00.16–17) Standards changes New CX standard relating to CDR Receipt delivery (new checklist reference 1CO5.00.41) Guidelines changes • New CX guidelines relating to: ◦ the fact that individuals without an active ABN cannot be treated as business consumers (new checklist item: 1CO5.00.42) ◦ clarifying when a non-accredited person selection step may be required (new checklist item: 1CO5.00.43) ◦ the display of information (new checklist item: 1CO5.00.44) ◦ when data language standards apply (new checklist item: 1CO5.00.45) ◦ CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO5.00.46–47) • Updates to existing CX Guideline annotations to better clarify expectations in relating to duration selection (updated checklist item: 1CO5.00.35) • Retirement of CX guideline annotations that have been removed from this artefact for simplicity, stemming from feedback on CR674 (retired checklist items: 1CO5.00.30–31) Business consumer disclosure consents - Bundled CDR Consents New CX artefacts and requirements relating to bundled collection, use and disclosure consents for business consumers. These artefacts provide implementation examples to reflect the updated rules relating to seeking consent. CX Guideline website page • Updates to page hierarchy to add new section for ‘Bundled CDR Consents’ • Updates to include references to consultations for rules, standards and guidelines • New open source design asset 1CO5. Business consumer disclosure consent v1.34.0.2025.03.19

Consent: Disclosure consents, Business consumer disclosure consents

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • Visual, UI and Experiential updates to reflect the new rule and standard requirements AP disclosure consents - Detached flow, Disclosing unmodified data Rules changes • New annotations relating to: ◦ information that must be given to a consumer during the consent process (new checklist item: 1CO1.00.36) ◦ transitional provisions for CDR Receipts (new checklist item: 1CO1.00.37) • Updates to existing rules requirements relating to requirements for: ◦ seeking consent including bundling (updated checklist items: 1CO1.00.03–04, 1CO1.01.11, 1CO1.00.13 and 1CO1.00.19) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist items: 1CO1.00.06–07 and 1CO1.01.09) ◦ CDR Receipts (updated checklist item: 1CO1.00.20) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO1.00.12 and 1CO1.00.21–22) • Retirement of rules annotations that — while not removed from the rules package — have been removed from this artefact for simplicity, or because they are no longer relevant to the flow (retired checklist items: 1CO1.00.14–15, 1CO1.00.18 and 1CO1.00.34) Standards changes • New CX standard relating to CDR Receipt delivery (new checklist reference 1CO1.00.38) • Retirement of standards annotations that — while not removed from the standards — have been removed from this artefact for simplicity, or because they are no longer relevant to the flow (retired checklist items: 1CO1.00.23 and 1CO1.00.27) Guidelines changes • New CX guidelines relating to: ◦ when data language standards apply (new checklist item: 1CO1.00.39) ◦ CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist item: 1CO1.00.40) • Retirement of CX guideline annotations that have been removed from this artefact for simplicity, or because they are no longer relevant to the flow (retired checklist items: 1CO1.00.33) AP disclosure consents - Detached flow, Disclosing unmodified data Rules changes Updates to existing rules requirements relating to requirements for: • allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist item: 1CO1.01.01) • seeking consent including bundling (updated checklist item: 1CO1.02.03) AP disclosure consents - Bundled CDR Consents New CX artefacts and requirements relating to bundled collection, use and disclosure consents for accredited persons. These artefacts provide implementation examples to reflect the updated rules relating to seeking consent. CX Guideline website page • Updates to page hierarchy for clarity — ◦ new ‘Detached flow’ section containing exisiting ‘Disclosing unmodified data’ and ‘Disclosing modified data' ◦ new section for ‘Bundled CDR Consents’ • Updates to include references to consultations for rules, standards and guidelines • New open source design asset 1CO1. AP disclosure consent v1.34.0.2025.03.19

Consent: Disclosure consents, Accredited person disclosure consents

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: Insights disclosure consents - Detached flow • Visual, UI and Experiential updates to reflect the new rule and standard requirements Rules changes • New annotations relating to: ◦ information that must be given to a consumer during the consent process (new checklist item: 1CO4.00.47) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (new checklist item: 1CO4.00.48) ◦ transitional provisions for CDR Receipts (new checklist item: 1CO4.00.49) • Updates to existing rules requirements relating to requirements for: ◦ seeking consent including bundling (updated checklist item: 1CO4.00.01) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist items: 1CO4.00.02 and 1CO4.00.04) ◦ CDR Receipts (updated checklist item: 1CO4.00.07) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO4.00.08 and 1CO4.00.09) Standards changes • New CX standard relating to CDR Receipt delivery (new checklist item: 1CO4.00.50) Guidelines changes • New CX guidelines relating to: ◦ when the non-AP selection step should be included or omitted (new checklist item: 1CO4.00.51) ◦ CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO4.00.52 and 1CO4.00.53) • Updates to existing CX guidelines to simplify and better clarify expectations regarding what data will be disclosed, actual insights and success messages (updated checklist items: 1CO4.00.28, 1CO4.00.29 and 1CO4.00.41) • Retirement of CX guidelines relating to: ◦ annotations that have been removed from this artefact for simplicity, stemming from feedback on CR674 (retired checklist items: 1CO4.00.24 and 1CO4.00.26) ◦ the trust rating component (retired checklist item: 1CO4.00.25) ◦ CDR receipts and the display of actual insights (retired checklist items: 1CO4.00.42 and 1CO4.00.43) Insights disclosure consents - Bundled CDR Consents New CX artefacts and requirements relating to bundled collect, use and insights disclosure consents. These artefacts provide implementation examples to reflect the updated rules relating to seeking consent. CX Guideline website page • Updates to page hierarchy for clarity — ◦ updates to section title, from ‘Detached flow - default example’ to ‘Detached flow' ◦ new section for ‘Bundled CDR Consents’ • Updates to include references to consultations for rules, standards and guidelines • New open source design asset 1CO4. Insights disclosure consent v1.34.0.2025.03.19

Consent: Disclosure consents, Insight disclosure consents

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; and • Decision 350: August 2024 Rules - Standards Impacts. This includes: • Visual, UI and Experiential updates to reflect the new rules and standards requirements, including updates to the dashboard information architecture to account for bundled consents, which may include both "incoming" and "outgoing" data requests. DR Withdrawal default example Rules changes • New rules annotation for displaying a message, in accordance with the data standards, on consequences of proceeding with withdrawing a consent (new checklist item: 4CM2.00.20) • Updates to existing rules requirements relating to requirements for CDR Receipts (new checklist item: 4CM2.00.04) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 4CM2.00.05–07) • Minor updates to checklist references for accuracy and consistency (updated checklist item: 4CM2.00.10) Standards change New CX standard relating to CDR Receipt delivery (new checklist item: 4CM2.00.21) Guidelines changes • Updates to existing CX guidelines to better align to the updated rules requirements (updated checklist item: 4CM2.00.12) • Minor updates to checklist references for accuracy and consistency (updated checklist item: 4CM2.00.18) AP Disclosure consent withdrawal Rules changes • New rules annotation for displaying a message, in accordance with the data standards, on consequences of proceeding with withdrawing a consent (new checklist item: 4CM2.01.20) • Updates to existing rules requirements relating to requirements for CDR Receipts (new checklist item: 4CM2.01.05) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 4CM2.01.06–08) Guidelines changes Minor updates to checklist references for accuracy and consistency (updated checklist items: 4CM2.01.11 and 4CM2.01.19) CX Guideline website page New open source design asset 4CM2. DR Withdrawal v1.33.1.2025.03.07

Consent Management (Data recipient): Withdrawal

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • Visual, UI and Experiential updates to reflect the new rules and standards requirements, including updates to the dashboard information architecture to account for bundled consents, which may include both "incoming" and "outgoing" data requests. Collection and use consents - default example Rules changes • New and updated rule references to reflect renumbered and reworded rules for ADR dashboards, including that the dashboard be readily accessible (new checklist item: 4CM1.00.43; updated checklist items: 4CM1.00.09–10, 4CM1.00.34). • Retirement of an existing rules requirement relating to CDR receipts due to its removal from the rules package (retired checklist item: 4CM1.00.08) • Minor updates to checklist references for accuracy and consistency (updated checklist item: 4CM1.00.01) Guidelines changes • New CX guideline relating to accessing CDR receipts on the dashboard (updated checklist item: 4CM1.00.44) • Updates to existing CX guidelines to reflect updated rules references and minor wording and formatting changes (updated checklist items: 4CM1.00.27, 4CM1.00.40–41) • Retirement of an existing CX guideline to help streamline the dashboard, removing detail previously recommended—but not required—to be included. This is intended to align with the government’s objectives of increasing CDR uptake and reducing obligations for CDR participants (retired checklist reference 4CM1.00.39) • Minor updates to wording for accuracy and consistency (updated checklist item: 4CM1.00.31) CDR outsourcing, sponsorship, and CDR representative arrangements Rules changes Minor update checklist formatting (updated checklist item: 4CM1.03b.02) Guidelines changes • Updates to existing CX guidelines to better align to the updated rules requirements (updated checklist item: 4CM1.03a.07) • Minor updates to checklist references for accuracy and consistency (updated checklist items: 4CM1.03b.05, 4CM1.03c.13) • Minor updates to wording and formatting (updated checklist items: 4CM1.03a.09, 4CM1.03b.08–09, 4CM1.03c.08–09) Amended consents Rules changes Updates to existing rules requirements relating to requirements for CDR Receipts (new checklist item: 4CM1.02.02) Guidelines changes Minor updates to checklist references for accuracy and consistency (updated checklist items: 4CM1.02.06–07) CX Guideline website page New open source design asset 4CM1. Collection and use consent v1.33.1.2025.03.07

Consent Management (Data recipient): Collection and use consents

Updated CX artefacts and requirements to reflect Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024. This includes: • Visual, UI and Experiential updates to reflect the new rules and standards requirements, including updates to the dashboard information architecture to account for bundled consents, which may include both "incoming" and "outgoing" data requests. Accredited persons disclosure consent Rules changes • New rule references to reflect renumbered and reworded rules for ADR dashboards, including that the dashboard be readily accessible (new checklist item: 4CM1.01.30) • Retirement of existing rules requirements due to their removal from the rules (retired checklist item: 4CM1.01.07) Guidelines changes • New CX guideline relating to accessing CDR receipts on the dashboard (new checklist item: 4CM1.01.31) • New CX guideline relating to the display of information for dispute resolution and making a complaint (new checklist item: 4CM1.01.32) • Minor updates to wording (updated checklist items: 4CM1.01.16 and 4CM1.01.24) • Minor updates to checklist references for accuracy and consistency (updated checklist items: 4CM1.01.01, 4CM1.01.05–06, 4CM1.01.09) CX Guideline website page New open source design asset 4CM1. Disclosure consents v1.33.1.2025.03.07

Consent management (Data recipient): Disclosure consents

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • Visual, UI and Experiential updates to reflect the new rule and standard requirements Amending collection and use consent Rules changes • Updates to existing rules requirements relating to: • inviting a consumer to amend their consent, and how a consent amendment request must be presented to the consumer (updated checklist items: 1CO2.00.02 and 1CO2.00.09–10) • information that must be given to a consumer during the consent amendment process (updated checklist items: 1CO2.01.12 and 1CO2.01.22) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist items: 1CO2.01.13, 1CO2.01.15–16 and 1CO2.01.19) ◦ CDR Receipts (updated checklist item: 1CO2.00.31) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO2.01.18, 1CO2.01.21, 1CO2.00.30 and 1CO2.00.32) • Retirement of rules annotations that — while not removed from the rules package — have been removed from this artefact for simplicity, or because they are no longer relevant to the flow (retired checklist items: 1CO2.01.23–24 and 1CO2.01.27–28) Standards changes • New CX standards relating to: ◦ supplying the CDR arrangement ID when notifying a Data Holder of an amended collection consent (new checklist item: 1CO2.01.61) ◦ indicating amended consent terms (new checklist item: 1CO2.01.62) ◦ CDR Receipt delivery (new checklist item: 1CO2.00.63) • Retirement of standards annotations that — while not removed from the standards — have been removed from this artefact to simplify the consent flow (retired checklist items: 1CO2.01.53–54) Guidelines changes • New CX guidelines relating to CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO2.00.64–65) • Updates to existing CX guidelines to better clarify expectations and to improve checklist references for accuracy and consistency (updated checklist items: 1CO2.01.43–45 and 1CO2.01.56) • Retirement of existing CX guidelines: ◦ which are now required by the standards (retired checklist item: 1CO2.01.41) ◦ to help streamline the consent flow by removing detail previously recommended, but not required, to be included in the consent flow, to align with the government’s objectives of increasing CDR uptake and reducing obligations for CDR participants (retired checklist items: 1CO2.01.47–48, 1CO2.01.50 and 1.CO2.01.52) Amending business consumer disclosure consent Rules changes • Updates to existing rules requirements relating to: ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist items: 1CO2.02.09, 1CO2.02.11–12 and 1CO2.02.15) ◦ CDR Receipts (updated checklist item: 1CO2.02.18) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO2.02.16–17 and 1CO2.02.19) Standards changes New CX standards relating to: • indicating amended consent terms (new checklist reference 1CO2.02.35) • CDR Receipt delivery (new checklist item: 1CO2.02.36) Guidelines changes • New CX guidelines relating to: • clarifying requirements for business consumers, including the offering of duration options for business consumer disclosure consents (new checklist items: 1CO2.02.37–39) • CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO2.02.40–41) • Retirement of existing CX guidelines: • which are now required by the standards (retired checklist item: 1CO2.02.33) • to help streamline the consent flow by removing detail previously recommended, but not required, to be included in the consent flow, to align with the government’s objectives of increasing CDR uptake and reducing obligations for CDR participants (retired checklist item: 1CO2.02.34) CX Guideline website page • Updates to include: • reference in the Overview section to the Consent: Amendment of Collection Consents and Authorisations Standard ◦ references to consultations for rules and standards, and ACCC fact sheets • New open source design asset 1CO2. Amending consent v1.33.0.2025.03.05

Consent: Amending consents

Updated CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • Visual, UI and Experiential updates to reflect the new rule and standard requirements Collection and use consent: Default example Rules changes • New annotations relating to: ◦ information that must be given to a consumer during the consent process (new checklist item: 1CO.02.51) ◦ CDR Receipts (new checklist item: 1CO.00.52) • Updates to existing rules requirements relating to requirements for: ◦ seeking consent including bundling (updated checklist items: 1CO.00.03, 1CO.00.04, 1CO.02.08 and 1CO.02.22) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist items: 1CO.02.06, 1CO.02.09–10 and 1CO.02.12) ◦ information that must be given to the consumer during consent (updated checklist items: 1CO.02.07 and 1CO.02.15) ◦ CDR Receipts (updated checklist item: 1CO.02.23) • Retirement of existing rules requirements due to their removal from the rules (retired checklist items: 1CO.02.14 and 1CO.02.24–25) • Retirement of rules annotations that — while not removed from the rules package — have been removed from this artefact for simplicity, or because they are no longer relevant to the flow (retired checklist items: 1CO.01.01, 1CO.02.16–17 and 1CO.02.20–21) Standards changes • New CX standard relating to CDR Receipt delivery (new checklist item: 1CO.00.53) • Retirement of standards annotations that — while not removed from the standards — have been removed from this artefact to simplify the consent flow (retired checklist items: 1CO.02.44–45) Guidelines changes • New CX guidelines relating to CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO.00.54–55) • Updates to existing CX guidelines to better clarify expectations (updated checklist items: 1CO.01.29, 1CO.02.35–36, 1CO.02.40, 1CO.02.47–48) • Retirement of CX guidelines and standards to help streamline the consent flow by removing detail previously recommended, but not required, to be included in the consent flow, to align with the government’s objectives of increasing CDR uptake and reducing obligations for CDR participants (retired checklist items: 1CO.02.38–39, 1CO.02.42–43 and 1CO.02.46) Collection and use consent: Using outsourced service providers Rules changes • New rule requirement relating to the transitional provision for information about OSPs that must be given during consent (new checklist item: 1CO.03a.07) • Updates to existing rules requirements relating to information that must be given during the consent flow about OSPs (updated checklist item: 1CO.03a.02) Guidelines changes • New CX guidelines to: ◦ recommend appropriate interventions to mitigate cognitive load in relation to information about OSPs (new checklist item: 1CO.03a.08) ◦ clarify the transitional provision relating to the amended rules for information that must be given during the consent flow about OSPs (new checklist item: 1CO.03a.09) • Updates to existing CX guidelines to better align to the updated rules requirements (updated checklist item: 1CO.03a.03) • Minor updates to formatting for accuracy and consistency (updated checklist item: 1CO.03a.06) • Retirement of existing CX guidelines which were made redundant by the updated rules requirements, which now require this information to be shown (retired checklist items: 1CO.03a.04 and 1CO.03a.05) Collection and use consent: Sponsorship arrangement Rules changes Updates to existing rules requirements relating to information that must be given during the consent flow about OSPs (updated checklist item: 1CO.03b.02) Guidelines changes Minor updates to formatting and checklist references for accuracy and consistency (updated checklist items: 1CO.03b.04–07 and 1CO.03b.09–10) Collection and use consent: CDR representative arrangement Rules changes • New rule annotation relating to information required to be given about the CDR representative’s redundant data handling policy (new checklist item: 1CO.03c.36) • Updates to existing rules requirements relating to requirements for: ◦ CDR representative compliance to any consumer experience data standards that are expressed to apply to ADRs (updated checklist item: 1CO.03c.01) ◦ information that must be given to the consumer during consent (updated checklist item: 1CO.03c.25) ◦ CDR receipts (updated checklist item: 1CO.03c.29) ◦ seeking consent including bundling (updated checklist items: 1CO.03c.30) ◦ allowing data recipients to seek agreement to certain consent elements as presented to the consumer (updated checklist item: 1CO.03c.31–35) • Retirement of rules annotations that — while not removed from the rules package — have been removed from this artefact for simplicity, or because they are no longer relevant to the flow (retired checklist item: 1CO.03c.08 and 1CO.03c.28) • Minor updates to formatting and checklist references for accuracy and consistency (updated checklist items: 1CO.03c.02 and 1CO.03c.21) Standards changes New CX standard relating to CDR Receipt delivery (new checklist item: 1CO.03c.37) Guidelines changes • New CX guidelines relating to CDR Receipt delivery and the transitional provisions for CDR Receipts (new checklist items: 1CO.03c.38-39) • Retirement of CX guidelines and standards to help streamline the consent flow by removing detail previously recommended, but not required, to be included in the consent flow, to align with the government’s objectives of increasing CDR uptake and reducing obligations for CDR participants (retired checklist items: 1CO.03c.14 and 1CO.03c.19–20) • Minor updates to formatting and checklist references for accuracy and consistency (updated checklist items: 1CO.03c.12, 1CO.03c.16, 1CO.03c.21) Business consumer statement Rules changes • New and updated rule annotation relating to requirements for seeking consent (new checklist item: 1CO.04.25; updated checklist items: 1CO.04.07–08) • Updated rule annotation relating to CDR receipts (updated checklist item: 1CO.04.12) • Retirement of existing rules requirements due to their removal from the rules (retired checklist item: 1CO.04.13–14) Standards changes New CX standard relating to CDR Receipt delivery (new checklist item: 1CO.04.26) Guidelines changes • New CX guideline relating to having an active ABN to be treated as a business consumer (new checklist items: 1CO.04.27) • Updates to existing CX guideline to better align to the updated rules requirements (updated checklist item: 1CO.04.24) • Minor updates to formatting and checklist references for accuracy and consistency (updated checklist items: 1CO.04.19–20) CX Guideline website page • Updates to include: ◦ notice for future obligated date of outsourced service providers ◦ references to consultations for rules and standards, and ACCC fact sheets • New open source design asset 1CO. Collection and use consents v1.33.0.2025.03.05

Consent: Collection and use consents

Updates to website information architecture: • A new ‘Notifications’ section page has been created to cover guidance for various CDR notification requirements. • The ‘Joint account notifications settings’ page has moved from the ‘Consent Management’ section to ‘Notifications’, while maintaining its past URL. • The ‘Overview’ section on the homepage has been updated to prioritise frequently visited pages: ‘Change log’, ‘CX checklist’, ‘Open Source Assets’, and ‘CX reports’. Other Overview pages remain accessible via the main ‘Overview’ section page.

For Notification section page, see Notifications For main Overview section page, see Overview

New CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • New CX artefacts and requirements relating to 90-day notifications. These artefacts provide implementation examples to reflect the updated rules and new standards for 90-day notifications delivery and content. • New open source design asset 4CM4. Notifications: 90-day Notifications v1.33.0.2025.02.27

Notifications: 90-day Notifications

New CX artefacts and requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; and • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes. This includes: • New CX artefacts and requirements relating to CDR receipts. These artefacts provide implementation examples to reflect the updated rules and new standards for CDR receipt delivery and content. • New open source design asset 4CM3. Notifications: CDR Receipt v1.33.0.2025.02.27

Notifications: CDR Receipts

Updated CX artefacts and requirements to reflect Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024. This includes: Rules changes Retirement of rules annotation that — while not removed from the rules — has been removed from this artefact for simplicity (retired checklist item: 3AU2.03.18). Guidelines changes Minor updates to checklist references for accuracy and consistency (updated checklist items: 3AU2.01.14, 3AU2.01.17, 3AU2.01.19–20, 3AU2.02.04, 3AU2.02.06, 3AU2.03.23, 3AU2.03.25, 3AU2.03.27–28 and 3AU2.03.30–31). CX Guideline website page New open source design asset 3AU2. Authorisation to disclose joint account data v1.33.0.2025.02.26

Authorise: Authorisation to disclose joint account data

Updated CX artefacts and requirements to reflect Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024. This includes: Rules changes • New and updated rule references to reflect renumbered and reworded rules for DH dashboards, including that the dashboard be readily accessible (new checklist item: 5CM4.01.15; updated checklist items: 5CM4.01.01 and 5CM4.01.03–4) • Updated rules reference to explain that a consumer data request service may be offered in an online form even if the subrule does not require it to be an online service (updated checklist item: 5CM4.01.02) Guidelines changes Minor update to the CX guideline that clarifies scenarios where search and filter functionality may be implemented (updated checklist item: 5CM4.01.07) CX Guideline website page New open source design asset 5CM4. Secondary Users v1.33.0.2025.02.26

Consent Management (Data holder): Account permissions - Secondary Users

Updated CX artefacts and requirements to reflect Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024. This includes: • Visual, UI and Experiential updates to reflect the new rules and standards requirements, including updates to the dashboard information architecture to account for bundled consents, which may include both "incoming" and "outgoing" data requests. Rules changes • Updated rule references to reflect renumbered and reworded rules for data holder consumer dashboards (updated checklist items: 5CM2.00.08) • Updated rule references to reflect renumbered and reworded rules for data holder consumer dashboard functionality requirements for joint account holders, including requirements on data holders to provide services that are ‘prominently displayed and readily accessible’ (updated checklist items: 5CM2.01.02–05) Standards change Minor update to remove future obligated dates that have now passed (updated checklist item: 5CM2.00.12) Guidelines changes • Minor update to CX guideline that clarifies use of the generic term ‘stop access’ (updated checklist item: 5CM2.00.04) • Minor updates to checklist references for accuracy and consistency (updated checklist items: 5CM2.01.16–18, 5CM2.01.20–21 and 5CM2.01.23) CX Guideline website page New open source design asset 5CM2. DH Withdrawal v1.33.0.2025.02.26

Consent management (Data holder): Withdrawal

Updated CX artefacts and requirements to reflect Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024. This includes: • Visual, UI and Experiential updates to reflect the new rules and standards requirements, including updates to the dashboard information architecture to account for bundled consents, which may include both "incoming" and "outgoing" data requests. Rules changes • New and updated rule references to reflect renumbered and reworded rules for data holder consumer dashboards, including that the dashboard be ‘readily accessible’ (new checklist items: 5CM1.00.30 and 5CM1.04.19; updated checklist items: 5CM1.00.04 and 5CM1.04.01) • New and updated rule references to reflect renumbered and reworded rules for data holder consumer dashboard functionality requirements for joint account holders, including requirements on data holders to provide services that are ‘prominently displayed and readily accessible’ (new checklist item: 5CM1.04.20; updated checklist item: 5CM1.04.03) • Minor updates to checklist reference for accuracy and consistency (updated checklist item: 5CM1.00.07 and 5CM1.00.25) Standards change Minor update to remove future obligated dates that have now passed (updated checklist items: 5CM1.00.28 and 5CM1.02.04) Guidelines changes • Minor update to CX guideline that clarifies use of the generic term ‘stop access’ (updated checklist item: 5CM1.00.12) • Minor update to CX guideline that clarifies use of terms related to time-based qualities of the data sharing arrangement (updated checklist item: 5CM1.00.18) • Minor updates to checklist references for accuracy and consistency (updated checklist items: 5CM1.00.15, 5CM1.01.02, 5CM1.01.03, 5CM1.02.09, 5CM1.04.10–11, and 5CM1.04.13–18) CX Guideline website page New open source design asset 5CM1. Authorisations v1.33.0.2025.02.26

Consent management (Data holder): Authorisations

Updated to include all research and engagement reports (previously found on cds.gov.au). For details, see: Community Engagement Reports (2018–2022) Phase 1 Reports (2019) Phase 2 Research Reports (2019) Phase 3 Research Reports (2020, R1-6)

Overview: CX reports

Updated CX artefacts and requirements to reflect: • Change Request 574: Additional functionality to support account selection • Change Request 659: Enhancing CDR Adoption: Streamlining Account Selection and Improving Data Transparency This includes: Standards changes New CX standard relating to voluntary account selection functionality (new checklist items: 3AU.01.27 and 3AU.05.02) Guidelines changes New CX guidelines to: • emphasise that this is an example implementation only (new checklist item: 3AU.05.03) • explain example elements used for enhanced account selection functionality (new checklist item: 3AU.05.04) • explain select options when enhanced account selection functionality is implemented (new checklist item: 3AU.05.05) • outline scenarios where search and filter functionality may be implemented (new checklist item: 3AU.05.06) CX Guideline website page • Updated section titles to accommodate standards and guideline changes — ‘Profile selection’ renamed to ‘Selection functionality’ — on CX Guidelines page, Open Source Asset design file and related CX checklist items. • New open source design asset 3AU. Authorisation to disclose v1.32.0.2024.12.10

Authorise: Authorisation to disclose

The CX Guidelines has been re-branded and re-launched on a new domain: cx.dsb.gov.au.

cx.dsb.gov.au

Wireframe, annotation and page updates to reflect Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines. Updates include: • Section copy for Detached flow - default example and Consolidated flow updated to outline hypothetical scenario and use case. • Wireframe title amendment from ‘Trusted Adviser Directory’ to ‘Select a Trusted Adviser’, for simplicity. • Removal of the trust rating component and annotation retired in the ‘About Trusted Adviser’ screen (see checklist items: 1CO3.00.18 and 1CO3.01.18). • New CX Guidelines clarifying that it is optional for an ADR to offer a TA disclosure service for any TA of the consumer’s choosing (see checklist items: 1CO3.00.34 and 1CO3.01.32–33). • New CX Guideline clarifying that a consumer's selection of a TA can constitute nomination (see checklist items: 1CO3.00.35 and 1CO3.01.34). • Open source design asset 1CO3. Trusted Adviser disclosure consent v1.31.0.2024.10.03

Consent: Disclosure consents, Trusted Adviser disclosure consents

As part of general maintenance, minor updates to website. Updates to all website pages include: • Breadcrumbs - Bug fix • ‘Last updated’ - Changed from ‘Updated’ and moved to the bottom of the page for improved UX. Updates to Overview pages include: • ‘Developing the CX Standards and Guidelines’ page - Updated links to Standards Maintenance and Guidelines Consultations. • ‘Accessibility, inclusivity and the CDR’ page - Updated ‘References’ section for consistency across website. • ‘References’ page - New section with links to consultations, research reports and guidance articles • ‘Participant demographics’ page - Updated ‘References’ section for consistency across website. Updates to individual CX Guidelines pages include: • ‘References’ section - Updated for consistency across website. • ‘Have your say’ section - New section with links to Guidelines Consultations, Standards Maintenance, CDR Support Portal and CX email.

See Overview pages: Developing the CX Standards and Guidelines Accessibility, inclusivity and the CDR References Participant demographics See individual CX Guidelines pages in: Consent Authenticate Authorise Consent Management

Updated CX checklist (web version and files) to reflect guideline amendments for: • Consent Management (Data holder): Authorisations - Amended Authorisations. Download files CX Checklist v1.30.0.2024.06.12 For details, see Change log: Consent management (Data holder): Authorisations v1.30.0.2024.06.12

Overview: CX Checklist

Updated CX artefacts and guidelines to clarify requirements relating to the display of details of amended authorisations on the dashboard from 1 July 2024. Updates include: • Adjustments to wireframes and guidelines in Amending Authorisations to clarify the requirements and display of details of amended authorisations (new checklist items 5CM1.02.09 and 5CM1.02.10; updated checklist items 5CM1.02.06 and 5CM1.02.07; retired checklist items 5CM1.02.05) • Open source design asset 5CM1. Authorisations v1.30.0.2024.06.12

Consent management (Data holder): Authorisations

Updated to include all ‘archived’ PDF versions of the CX Guidelines (previously found on cds.gov.au). For details, see: CX Guidelines v1.4.0 CX Guidelines v1.3.0 CX Guidelines v1.2.0 CX Guidelines v1.0.1 Change log v1.0.1 CX Guidelines v1.0.0 CX Guidelines v0.9.5

Overview: Change log

New and updated CX artefacts and guidelines to support July 2023 rules amendments and Decision 333. Updates include: • New requirements relating to Business consumer disclosure consents (new checklist items starting with 4CM1.05) • UI uplift throughout • Open source design asset 4CM1. Disclosure consents v1.30.0.2024.05.01

Consent management (Data recipient): Disclosure consents

New and updated CX artefacts and guidelines to support July 2023 rules amendments and Decision 333. Updates include: • Slight requirements modifications to the Amending collection and use consent example (updated title from Amending duration and datasets | updated checklist items 1CO2.00.07, 1CO2.00.09, 1CO2.00.10, 1CO2.01.20, 1CO2.01.23, 1CO2.01.24, 1CO2.00.31, new references 1CO2.00.58–60, retired reference 1CO2.00.05) • New requirements relating to Amending business consumer disclosure consent example (new checklist items beginning with 1CO2.02) • UI uplift throughout • Open source design asset 1CO2. Amending consents v1.30.0.2024.05.01

Consent: Amending consents

New and updated CX artefacts and guidelines to support July 2023 rules amendments and Decision 333. Updates include: • Slight requirements modifications to the Default example (updated checklist items 1CO.00.03, 1CO.00.04, 1CO.02.12, 1CO.02.13, 1CO.02.23 and new checklist items 1CO.02.49, 1CO.02.50) and the Using direct or indirect OSPs example (updated title from ADR uses outsourced service providers | updated checklist items 1CO.03a.01–04, 1CO.03a.06) • Updated requirements related to CDR representative arrangements due to new CDR Rules Division 4.3A (updated checklist items 1CO.03c.01–04, 1CO.03c.06, 1CO.03c.08, 1CO.03c.12, 1CO.03c.14, 1CO.03c.16, 1CO.03c.19, 1CO.03c.20; new checklist items 1CO.03c.21–35 and retired items 1CO.03c.05, 1CO.03c.07, 1CO.03c.09, 1CO.03c.10, 1CO.03c.11, 1CO.03c.17, 1CO.03c.18) • New requirements relating to Business consumer statements (new checklist items starting with 1CO.04) • UI uplift throughout • Open source design asset 1CO. Collection and use consents v1.30.0.2024.05.01

Consent: Collection and use consents

Updated CX checklist (web version and files) to reflect rules, standards and guideline amendments for: • Collect and use consents; • Disclosure consents, Business consumer disclosure consents; • Amending consents; • Consent Management (Data recipient): Disclosure consents. Download files CX Checklist v1.30.0.2024.05.01 For details, see Change log: Consent: Collection and use consents v1.30.0.2024.05.01 Consent: Disclosure consents, Business consumer disclosure consents v1.30.0.2024.05.01 Consent: Amending consents v1.30.0.2024.05.01 Consent management (Data recipient): Disclosure consents v1.30.0.2024.05.01

Overview: CX Checklist

New CX artefacts and guidelines to support Business Consumer Disclosure Consents. These artefacts provide implementation examples to reflect the July 2023 rules amendments and Decision 333 relating to business consumer disclosure consents. Updates include: • New requirements relating to business consumer disclosure consents (see checklist items starting with 1CO5) • Open source design asset 1CO5. Business consumer disclosure consents v1.30.0.2024.05.01

Consent: Business consumer disclosure consents

Updated figures for “# of participants” based on 2023 and 2024 CX research cohorts.

Overview: Participant demographics

Updated CX checklist (web version and files) to reflect rules, standards and guideline amendments for Consent Management (Data holder): Authorisation and Withdrawal. Download files CX Checklist v1.29.1.2024.04.09 For details, see Change log: Consent management (Data holder): Authorisations v1.29.1.2024.04.09 Consent management (Data holder): Withdrawal v1.29.1.2024.04.09

Overview: CX Checklist

Minor revisions to Standards and Guidelines referenced in wireframes, open source design assets and CX Checklist. Updates include: • Slight requirement modification (checklist items: 5CM2.01.17) • New requirement relating to Data recipient handling details (new checklist item 5CM2.00.12). This requirements are effective from 1 July 2024 • New requirement relating to disclosure option management service (new checklist item 5CM2.00.23) • UI uplift throughout • Open source design asset 5CM2. Withdrawals v1.29.1.2024.04.09

Consent management (Data holder): Withdrawal

New and updated CX artefacts and guidelines to support July 2023 rules amendments, Decision 334 and Change Request 557. Updates include: • Slight requirements modifications (checklist items 5CM1.00.07, 5CM1.00.17) • New requirements in the Default example relating to Data recipient handling details (new checklist items 5CM1.00.28, 5CM1.00.29 and retired item 5CM1.00.22). These requirements are effective from 1 July 2024 • New wireframes and requirements in Amending Authorisations relating to the requirement to display details of amended authorisations (new checklist items 5CM1.02.03, 5CM1.02.04, 5CM1.02.05, 5CM1.02.06, 5CM1.02.07 and 5CM1.02.08 and retired item 5CM1.02.02). These requirements are effective from 1 July 2024 • New wireframes and guidance in Joint Accounts to demonstrate how data holders should display the status and visibility of joint accounts for other account holders (new checklist item starting with 5CM1.04) • UI uplift throughout • Open source design asset 5CM1. Authorisations v1.29.1.2024.04.09

Consent management (Data holder): Authorisations

‘Importance of privacy when choosing a digital service’ updated based on OAIC Australian Community Attitudes to Privacy Survey 2023: • Updated figures for “% of Australians” • Updated reference

Overview: Participant demographics

Updated CX checklist (web version and files) to reflect rules, standards and guideline amendments for Disclosure consents and Consent Management (Data recipient). Download files CX Checklist v1.29.1.2024.03.06 For details, see Change log: Consent: Disclosure consents, Accredited person disclosure consents v1.29.1.2024.03.06 Consent: Disclosure consents, Trusted Adviser disclosure consents v1.29.1.2024.03.06 Consent: Disclosure consents, Insights disclosure consents v1.29.1.2024.03.06 Consent management (Data recipient): Collection and use consents v1.29.1.2024.03.06 Consent management (Data recipient): Disclosure consents v1.29.1.2024.03.06 Consent management (Data recipient): Withdrawal v1.29.1.2024.03.06

Overview: CX Checklist

General annotation updates to reflect July 2023 rules amendments. Updates include: • Slight requirement modifications (checklist items: 4CM2.00.01, 4CM2.00.02, 4CM2.00.04, 4CM2.00.08, 4CM2.00.09, 4CM2.00.10, 4CM2.01.01, 4CM2.01.02, 4CM2.01.04, 4CM2.01.05, 4CM2.01.09, 4CM2.01.10 and 4CM2.01.11) • New reference for notification of data holder or accredited data recipient if collection consent expires (checklist items: 4CM2.00.19 and 4CM2.01.18). Related requirements retired (checklist items: 4CM2.00.03 and 4CM2.01.03). • New reference for notification if collection consent or AP disclosure consent expires (checklist item: 4CM2.01.19) • Minor updates to the page copy • Open source design asset 4CM2. Withdrawal v1.29.1.2024.03.06

Consent Management (Data recipient): Withdrawal

General annotation updates to reflect July 2023 rules amendments. Updates include: • Slight requirement modifications (checklist items: 4CM1.00.03, 4CM1.00.07, 4CM1.00.10, 4CM1.00.12, 4CM1.00.13, 4CM1.00.22, 4CM1.00.29, 4CM1.00.36, 4CM1.02.01, 4CM1.02.02, 4CM1.02.06, 4CM1.03b.02, 4CM1.03b.03 and 4CM1.03c.04) • New reference clarifying who is responsible for providing the dashboard in sponsor/affiliate arrangements (checklist item: 4CM1.03b.10) • New references clarifying requirements for updating a consumer dashboard in a CDR representative arrangement (checklist items: 4CM1.03c.11 and 4CM1.03c.12) • New reference for information on CDR Representative obligations (checklist items: 4CM1.03c.13) • Open source design asset 4CM1. Collection and use consents v1.29.1.2024.03.06

Consent Management (Data recipient): Collection and use consents

General annotation updates to reflect July 2023 rules amendments. Updates include: • Slight requirement modifications (checklist items: 4CM1.01.05, 4CM1.01.11 and 4CM1.04.02) • New reference related to consumer requests for copies of records (checklist item: 4CM1.01.29) • Open source design asset 4CM1. Disclosure consents v1.29.1.2024.03.06

Consent Management (Data recipient): Disclosure consents

General annotation updates to reflect July 2023 rules amendments and ⁠Decision 333. Updates include: • Slight requirement modifications (checklist items: 1CO4.00.01, 1CO4.00.03, 1CO4.00.06 and 1CO4.00.07, 1CO4.00.18) • New reference for information on CDR Representative obligations (checklist items: 1CO4.00.46) • New references for not making certain elements of consent a condition for the supply of goods or services (checklist items: 1CO4.00.44 and 1CO4.00.45) • Minor updates to the page introduction to account for CDR Representatives • Open source design asset 1CO4. Insights disclosure consent v1.29.1.2024.03.06

Consent: Disclosure consents, Insight disclosure consents

General annotation updates to reflect July 2023 rules amendments and ⁠Decision 333. Updates include: • Slight requirement modifications (checklist items: 1CO3.00.01, 1CO3.00.03, 1CO3.00.04, 1CO3.00.06, 1CO3.00.13, 1CO3.01.02, 1CO3.01.04, 1CO3.01.05 and 1CO3.01.10) • New reference clarifying scenarios where CDR data is collected from a data holder and provided to a trusted adviser (checklist items: 1CO3.00.32 and 1CO3.01.30) • New reference for information on CDR Representative obligations (checklist items: 1CO3.00.33 and 1CO3.01.31) • Retired reference related to CDR Rule 1.10C(4) (checklist items: 1CO3.00.21 and 1CO3.01.21) • Minor updates to the page introduction to account for CDR Representatives • Open source design asset 1CO3. Trusted Adviser disclosure consent v1.29.1.2024.03.06

Consent: Disclosure consents, Trusted Adviser disclosure consents

General annotation updates to reflect July 2023 rules amendments. Updates include: • Slight requirement modifications (checklist items: 1CO1.00.03, 1CO1.00.04, 1CO1.00.08, 1CO1.00.14, 1CO1.00.15 and 1CO1.00.20) • New reference reflecting maximum durations for CDR business consumers (checklist item: 1CO1.00.34) • New reference for information on CDR Representative obligations (checklist item: 1CO1.00.35) • Updates to the page introduction to account for CDR Representatives • Open source design asset 1CO1. AP disclosure consents v1.29.1.2024.03.06

Consent: Disclosure consents, Accredited person disclosure consents

Updated CX checklist (web version and files) to reflect rules amendments for Authenticate and Authorise. Download file CX Checklist v1.29.0.2024.02.22 For details, see Change log: Authenticate: Redirect with One Time Password v1.29.0.2024.02.22 Authorise: Authorisation to disclose v1.29.0.2024.02.22 Authorise: Amending authorisations v1.29.0.2024.02.22

Overview: CX Checklist

General annotation updates to reflect July 2023 rules amendments. Updates include: • Slight requirement modifications (checklist items: 3AU1.00.01, 3AU1.02.07 and 3AU1.02.18) • Open source design asset 3AU1. Amending authorisations v1.29.0.2024.02.22

Authorise: Amending authorisations

General annotation updates to reflect November 2021 changes. Updates include: • Slight requirement modifications (checklist item: 2AU.00.01) • Open source design asset 2AU. Redirect with One Time Password v1.29.0.2024.02.22

Authenticate: Redirect to Web with One Time Password

General annotation updates to reflect July 2023 rules amendments. Updates include: • Slight requirement modifications (checklist items: 3AU.02.06, 3AU.02.09, 3AU.02.10, 3AU.02.17 and 3AU.06.02) • New reference reflecting notification requirements where the authorisation to disclose CDR data is withdrawn or otherwise expires (checklist item: 3AU.02.26) • Open source design asset 3AU. Authorisation to disclose v1.29.0.2024.02.22

Authorise: Authorisation to disclose

Updated content: • New section highlighting Consumer Policy Research Centre (CPRC) findings and recommendations. • New section highlighting CX guidelines website accessibility compliance. • Minor copy and link fixes in ‘Open source assets’ section.

Overview: Accessibility, inclusivity and the CDR

Updated ‘Wireframes’ section to include descriptions and images for: • ‘Open source asset’ to reflect Overview: Change log v1.28.0.2023.11.16 • ‘References’ to reflect CX Guidelines pages - References v1.27.0.2023.11.09

Overview: How to use these guidelines

Updated to include all ‘active’ and ‘archived’ versions of the CX checklist and CX open source assets. High-level changes between versions are noted alongside the option to preview and/or download files.

Overview: Change log

Updated to include a consolidated list of CX open source assets. All ‘active’ files can be accessed and downloaded from a single location.

Overview: Open Source Assets

Updated to include references section. This section contextually consolidates the research and other sources used to develop CX guidelines.

See individual CX Guidelines pages in: • Consent • Authenticate • Authorise • Consent Management

Updated to include image showing the archetypes on a scale of propensity to consent.

Overview: Behavioural archetypes

The DSB strives to create an accessible and inclusive CDR that is easier and simpler to access for everyone. This new page provides an overview of how the DSB has developed CX research, standards and artefacts to help achieve this. Included on this page are criteria and measures used to engage a diverse range of consumers, DSB research, processes, and recommendations in relation to accessibility, inclusivity, and vulnerability, along with artefacts, assets, and opportunities to support an accessible and inclusive CDR ecosystem.

Overview: Accessibility, inclusivity and the CDR

The DSB strives to create accessible and inclusive experiences. This new page provides an overview of how the CX Guidelines website (cx.cds.gov.au) has been designed so that it can be used by as many people as possible. On this page, the community can read about measures used to support accessibility, technical specifications, and conformance status and testing.

Accessibility statement

The CX Guidelines were re-launched on a new domain: cx.cds.gov.au. This was the result of a new platform being adopted to better host the DSB’s CX guidelines, open source assets, and research artefacts. Content is created on Notion.so and hosted on Super.so to improve site performance and accessibility. Appropriate redirections are in place to ensure past URLs remain functional.

cx.cds.gov.au

New CX research report on Consent Review research. The purpose of the research was to examine the viability of simplifying rules and standards for CDR consents and dashboards, as identified by the Consent Review Working Group. This report collates findings from three rounds of CX research. Two key areas of focus were: 1. Information presented to the consumer 2. Consumer control and choice

Overview: CX reports, Consent Review Research Report (Q3 2022, R1-3)

New CX research page outlining participant demographics. This page includes research participant figures and percentages for demographic information, financial literacy, energy literacy, digital use and CDR behavioural archetypes.

Overview: Participant demographics

New CX research page outlining CDR behavioural archetypes (the Sceptic, Sensemaker, Assurance seeker, and the Enthusiast). This page includes approach, descriptions, and design rationale.

Overview: Behavioural archetypes

New CX research report on Authentication Uplift. This report collates findings from three rounds of CX research and provides a comparison on models tested. The purpose of the research was to identify consumer experience considerations to support and inform an expanded approach to CDR. Report includes comparisons on: • Redirect with One Time Password • App/Web-to-App • Decoupled • Supporting metrics

Overview: CX reports, Authentication Uplift - Comparison Report (Q2 2023, R1-3)

New CX research report on Authentication Uplift research conducted in Q1 2023. This report contains finding and insights for Round 3 of CX research that was conducted on Decoupled Authentication in March of 2022 as part of the Authentication Uplift project. The purpose of the research is to identify consumer experience considerations to support and inform an expanded approach to CDR. Report includes: • Behavioural archetypes • SUS • Global Performance measures + metrics

Overview: CX reports, Decoupled Research Report (Q2 2023, R3)

New CX research report on Authentication Uplift research conducted in Q4 2022. This report contains findings and recommendations from Round 2 round of CX research which focussed on ‘App/Browser-to-App with Biometric’ and ran in November of 2022. The purpose of the research was to identify consumer experience considerations to support and inform an expanded approach to CDR. Report includes: • Behavioural archetypes • Fogg Behaviour Model (FBM) • SUS • Global Performance measures + metrics

Overview: CX reports, App/Browser-to-App Research Report (Q4 2022, R2)

New CX research report on Authentication Uplift research conducted in Q3 2022. This report contains finding and insights for Round 1 of CX research that was conducted on the ‘Redirect with One Time Password’ (OTP) in September of 2022 as part of the Authentication Uplift project. The purpose of the research is to identify consumer experience considerations to support and inform an expanded approach to CDR. Report includes: • Behavioural archetypes • Fogg Behaviour Model (FBM) • SUS • Global Performance measures + metrics

Overview: CX reports, One Time Password Research Report (Q3 2022, R1)

Updated Open Source Assets page includes coded prototype preview and external link to Proof Of Concept.

Overview: Open Source Assets

New Open Source Assets page for wireframes and working prototypes; included is a ‘how to’ for open source assets and prototype source code.

Overview: Open Source Assets

CX Checklist reflecting v1.17.0 changes available as downloadable xlsx and csv files.

Overview: CX Checklist

Minor revisions to Consent Management (Data recipient): Withdrawal. Changes include: • Slight updates to accounts and post withdrawal screens in default example • New annotations included on consent withdrawal record keeping (checklist references 4CM2.00.17, 4CM2.00.18) Changes reflected in open source asset and CX Checklist (website version).

Consent management (Data recipient):Withdrawal

Minor revisions to Consent Management (Data recipient). Changes include slight content modification to match current version of the CDR Rules (checklist reference 4CM1.00.13), and slightly revised amended consents wireframes. Changes reflected in open source asset and CX Checklist (website version).

Consent management (Data recipient): Collection and use consents

General updates and slight revisions to the CX Guidelines to accommodate the energy sector. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist items 5CM5.01.21) Slight requirement modifications • Slight reference modification to match current Standards website (checklist items 5CM5.01.05, 5CM5.01.06, 5CM5.01.07, 5CM5.01.08, 5CM5.01.09, 5CM5.01.10, 5CM5.01.11, 5CM5.01.12)

Consent Management (Data holder): Joint account notification settings

General updates and slight revisions to the CX Guidelines to accommodate the energy sector. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist items 5CM3.01.24, 5CM3.02.28) Slight requirement modifications • Slight reference modification to match current Standards website (checklist items 5CM3.01.13, 5CM3.01.15, 5CM3.02.17, 5CM3.02.18)

Consent Management (Data holder): Account permissions - Joint account disclosure option management service

General updates and slight revisions to the CX Guidelines to accommodate the energy sector. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist item 5CM4.01.14) Slight requirement modifications • Slight content modification to match current version of the CDR Rules (checklist item 5CM4.01.02) • Slight content modification to guideline (checklist item 5CM4.01.07)

Consent Management (Data holder): Account permissions - Secondary Users

CX Checklist reflecting v1.16.1 changes available as downloadable xlsx and csv files.

Overview: CX Checklist

General updates and slight revisions to the CX Guidelines to accommodate the energy sector and revised guidance on record keeping. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist items 5CM2.00.11, 5CM2.01.22) Slight requirement modifications • Slight content and reference modification to match Standards website (checklist items 5CM2.00.02, 5CM2.00.03, 5CM2.01.13, 5CM2.01.14, 5CM2.01.15) • New annotations included on authorisation withdrawal record keeping (checklist items 5CM2.00.09, 5CM2.00.10) • Additional annotation included (checklist item 5CM2.00.08) Open source assets and CX Checklist (website version) revised to reflect changes for each of the above areas

Consent management (Data holder): Withdrawal

Slight modification to guideline and reference to clarify that rules 2.3(1) and 2.3(2) refer to Schedule 4—Provisions relevant to the energy sector (checklist items 5CM1.03.02, 5CM1.03.03, 5CM1.03.04)

Consent management (Data holder): Authorisations

General updates and slight revisions to the CX Guidelines to accommodate the energy sector. New variations added to provide guidance for ‘offline customers’ (energy sector) and amending authorisations. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Variations outlining requirements and guidance for amended authorisations and offline customers added (checklist items starting with 5CM1.02 and 5CM1.03) • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist reference 5CM1.00.27) Slight requirement modifications • Slight content modification to match current version of the CDR Rules (checklist items 5CM1.00.01, 5CM1.00.03, 5CM1.00.04, 5CM1.00.05, 5CM1.00.06, 5CM1.00.07, 5CM1.01.01) • New annotations for CDR policy in default example (checklist items 5CM1.00.25, 5CM1.00.26) Open source assets • Revised to reflect changes for each of the above areas

Consent management (Data holder): Authorisations

CX Guidelines amended to provide guidance for ‘offline customers’ relating to the energy sector (checklist items 2AU.00.23, 2AU.00.24, 2AU.00.25)

Authenticate: Redirect to Web with One Time Password

Updated Consent Flow prototype to reflect amended wireframes relating to v1.16.0 and v1.16.1.

Overview: The Consent Flow

New CX artefacts and guidelines to support Consent Management (Data recipient): Disclosure consents. These artefacts provide implementation examples to reflect the new rules on TA disclosure consents, and the CX standards introduced in v1.16.0, related to Disclosure Consent: Non-Accredited Person Disclosure Notification. Updated CX Checklist (on website) includes key requirements and guidelines related to TA disclosure consents, see checklist references starting with 4CM1.04.

Consent management (Data recipient): Disclosure consents

Minor revisions to wireframes, open source design assets and prototype and CX Checklist (website only). Updates include: • CX Standards for pre-authentication, see checklist items 1CO2.01.53 and 1CO2.01.54. Refer to wireframes, annotations 53 and 54. • CX Guideline relating to complaint handling added, see checklist items 1CO2.01.55. For wireframes, refer to annotation 55. • CX Guideline relating to data handling retired (checklist item 1CO2.01.51) and replaced with 1CO2.01.56. For wireframes, refer to annotation 56. • CX Guideline relating to Privacy Safeguard 12 added, see checklist references 1CO2.01.57. For wireframes, refer to annotation 57.

Consent: Amending consents

Minor revisions to wireframes, open source design assets and prototype and CX Checklist (website only). Updates include: • CX Guideline relating to complaint handling added, see checklist item 1CO.02.47. For wireframes, refer to annotation 47. • CX Guideline relating to Privacy Safeguard 12 added, see checklist references 1CO.02.48. For wireframes, refer to annotation 48.

Consent: Collection and use consents

Minor revisions to ‘Collection and use use consent - default example’ wireframes, open source design assets and prototype and CX Checklist (website only). Update includes CX Guideline relating to Privacy Safeguard 12, see checklist item 4CM1.00.42. For wireframes, refer to annotation 42.

Consent management (Data recipient): Collection and use consents

New CX artefacts and guidelines to support insight disclosure consents. These artefacts provide implementation examples to reflect the new rules on insight disclosure consents and the CX standards introduced in v1.16.0, related to Disclosure Consent: Insight Descriptions, and Disclosure Consent: Non-Accredited Person Disclosure Notification. Updated CX Checklist (on website) includes key requirements and guidelines related to insights disclosure consents, see checklist references starting with 1CO4.

Consent: Insight disclosure consents

New CX research section includes report on insight and trusted adviser consent research conducted in Q4 2021. Report contains findings and recommendations that support new rules on non-AP disclosure consents and the CX standards introduced in v1.16.0, related to Disclosure Consent: Insight Descriptions, and Disclosure Consent: Non-Accredited Person Disclosure Notification. Report introduces a new format and new outputs, including: • Behavioural archetypes to segment and describe different consumer drivers, behaviours, and needs observed in the research, including the Sceptic, Sensemaker, Assurance seeker, and the Enthusiast • A design rationale, demonstrating how the proposed guidelines for insight and trusted adviser consents tend to the needs and expectations of these behavioural archetypes • A Fogg Behaviour Model (FBM), which is a Behaviour Design approach which suggests that a Behaviour (B) occurs when Motivation (M), Ability (A), and a Prompt (P) converge, summarised in the formula B=MAP. Research participants were plotted on the FBM according to their behavioural archetypes in relation to an ‘action line’, which indicates whether or not a consumer is likely to act on the CDR value proposition.

Overview: CX reports, Disclosure Consent Research Report (Q4 2021, R1-2)

New CX artefacts and guidelines to support Trusted Adviser (TA) disclosure consents. These artefacts provide implementation examples to reflect the new rules on TA disclosure consents and the CX standards introduced in v1.16.0, related to Disclosure Consent: Non-Accredited Person Disclosure Notification. Updated CX Checklist (on website) includes key requirements and guidelines related to TA disclosure consents, see checklist references starting with 1CO3.

Consent: Disclosure consent - Trusted Adviser disclosure consents

CX Checklist reflecting v1.16.0 changes available as downloadable xlsx and csv files.

Overview: CX Checklist

General updates and slight revisions to the CX Guidelines including additions to accommodate the energy sector. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist reference 3AU.01.25) Slight requirement modifications • Slight content and reference modification to match current rules and Standards website (checklist items 3AU.02.11, 3AU.01.12, 3AU.02.13, 3AU.02.14, 3AU.02.24, 3AU.03.01, 3AU.03.02, 3AU.03a.01, 3AU.04.01, 3AU.04.02, 3AU.05.01) • Guideline modification (checklist reference 3AU.08.02) Open source assets • Revised to reflect changes for each of the above areas

Authorise: Authorisation to disclose

General updates and slight revisions to the CX Guidelines including additions to accommodate the energy sector. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist item 3AU1.01.26) Slight requirement modifications • Slight content and reference modification to match current Standards website (checklist items 3AU1.02.11, 3AU1.01.12, 3AU1.02.14, 3AU1.02.15, 3AU1.03.01) • Additional requirement (checklist item 3AU1.02.25) Open source assets • Revised to reflect changes for each of the above areas

Authorise: Amending authorisations

General updates and slight revisions to the CX Guidelines including additions to accommodate the energy sector. Updates include: Artefact changes • References to accounts have been generalised to be sector-agnostic • Clarifications to note that additional account information can be included, such as any related plans, services, properties, numbers, and products (checklist item 3AU2.01.21, 3AU2.02.07, 3AU2.03.34) Slight requirement modifications • Slight content and reference modification to match current Standards website (checklist items 3AU2.01.10, 3AU2.01.11, 3AU2.01.12, 3AU2.01.13, 3AU2.02.02, 3AU2.02.03, 3AU2.03.19, 3AU2.03.21, 3AU2.03.22) • Inclusion of reference for CX Guideline (3AU2.01.19, 3AU2.03.30) Open source assets • Revised to reflect changes for each of the above areas

Authorise: Authorisation to disclose joint account data

Minor revisions to wireframes, open source design assets and prototype and updated CX Checklist (website only). Updates include: • New CX guideline in relation to account referencing. See checklist item 4CM2.00.16. Refer to annotation 16 in the default flow for this change. • CX Standards referencing for withdrawal, see checklist item 4CM2.01.12. Refer to annotation 12.

Consent management (Data recipient):Withdrawal

New open source design asset for data recipient dashboard related to Disclosure consent. Requirement references slightly modified on CX Checklist (website)— key requirements related to v3 rule amendments, see checklist items 4CM1.01.01, 4CM1.01.08, 4CM1.01.09 and 4CM1.01.27. Refer to annotations 01, 08, 09 and 27 for these changes.

Consent management (Data recipient): Disclosure consents

New open source design asset for data recipient dashboard related to Collection and use use consent. This includes: • Collection and use use consent - default example • CDR outsourcing, sponsorship and CDR representative arrangements • Amended consents Updates to CX Checklist (website only) to key requirements and guidelines. This includes: • Updated CDR Rules. See checklist items 4CM1.00.01 and 4CM1.00.09. Refer to annotation 01 and 09 for these changes. • Additional CDR Rules. See checklist items 4CM1.00.34, 4CM1.00.35 and 4CM1.00.36. Refer to annotation 34, 35, 36 for these changes. • Additional CX Guidelines. See checklist items 4CM1.00.37, 4CM1.00.38, 4CM1.00.39, 4CM1.00.40 and 4CM1.00.41. Refer to annotation 37, 38, 39, 40 and 41 for these changes.

Consent management (Data recipient): Collection and use consents

Minor revisions to wireframes, open source design assets and prototype and CX Checklist. Updates include: • CX Standards referencing for data language, see checklist items 1CO.02.26 and 1CO.02.27. Refer to annotations 26 and 27. • CX Standards for pre-authentication, see checklist items 1CO.02.44 and 1CO.02.45. Refer to wireframes, annotations 44 and 45, and prototype. • CX Guideline retired (checklist item 1CO.02.41) and replaced with 1CO.02.46. Refer to annotation 46.

Consent: Collection and use consents

Slight revisions to the CX Guidelines for authentication (Redirect with One Time Password), including additions to accommodate the energy sector. Updates include: • Authentication conventions for user identifiers and OTP delivery added • Guidelines for support pathways and possibilities included for error states and offline (energy) consumers • Revised open source assets published to reflect guidelines changes

Authenticate: Redirect to Web with One Time Password

New open source design asset for AP Disclosure consent to accredited person. Requirement references slightly modified on CX Checklist (website)— key requirements related to v3 rule amendments, see checklist items 1CO1.00.03, 1CO1.01.24 and 1CO1.01.25. Refer to annotations 3, 24 and 25 in the default flow for these changes.

Consent: Accredited person disclosure consents

New open source design asset for Amending consent. Requirement references slightly modified on CX Checklist (website)— key requirements related to v3 rule amendments, see checklist items 1CO2.01.28, 1CO2.01.33 and 1CO2.01.34. Refer to annotations 28, 33 and 34 in the default flow for these changes.

Consent: Amending consents

New open source design asset for Collection and use consents (default example), ADR uses outsourced service providers, Sponsorship arrangements and CDR representative arrangements. Requirement references slightly modified on CX Checklist (website)— key requirements related to v3 rule amendments, see checklist items 1CO.00.03, 1CO.02.21, 1CO.02.26, 1CO.02.27 and 1CO.03c.19. Refer to annotations 03, 21, 26 and 27 in the default flow and annotation 19 in the CDR representative arrangement flow for these changes.

Consent: Collection and use consents

New CX artefacts and guidelines reflecting requirements for CDR outsourcing, sponsorship and CDR representative arrangements.

Consent: Collection and use consents

New CX artefacts and guidelines reflecting requirements for CDR outsourcing, sponsorship and CDR representative arrangements.

Consent Management (Data recipient): Collection and use consents

Addition of key requirements and guidelines related to: - DP162, see checklist references starting with 3AU2, 5CM2.01, 5CM3 and 5CM5. - CDR outsourcing, sponsorship and CDR representative arrangements, see checklist items starting with 1CO.03a, 1CO.03b, 1CO.03c, 4CM1.03a, 4CM1.03b and 4CM1.03c. Current CX Checklist available on website and as downloadable versions.

Overview: CX Checklist

Updated open source design asset reflecting the DP162 decision.

Consent management (Data holder): Withdrawal

New open source design asset reflecting the DP162 decision.

Consent management (Data holder): Account permissions - Joint account disclosure option management service

New open source design asset reflecting the DP162 decision.

Consent management (Data holder): Joint account notification settings

New open source design asset reflecting the DP162 decision.

Authorisation: Authorisation to disclose joint account data

New CX artefacts and guidelines reflecting the DP162 decision. These artefacts provide implementation examples for notification standards related to joint account that will be introduced in v1.15.0.

Consent management (Data holder): Joint account notification settings

New CX artefacts and guidelines reflecting the DP162 decision. These artefacts provide implementation examples for withdrawal and notification standards related to joint account that will be introduced in v1.15.0.

Consent Management (Data holder): Account permissions - Joint account disclosure option management service

New CX artefacts and guidelines reflecting the DP162 decision. These artefacts provide implementation examples for withdrawal and notification standards related to joint account that will be introduced in v1.15.0.

Consent Management (Data holder): Withdrawal

New CX artefacts and guidelines reflecting the DP162 decision. These artefacts provide implementation examples for authorisation and notification standards related to joint account that will be introduced in v1.15.0.

Authorise: Authorisation to disclose joint account data

New CX artefacts and guidelines to accompany DP160. These artefacts provide implementation examples for the updates to the CX standards for unavailable accounts introduced in v1.11.0.

Authorise: Authorisation to disclose

New CX artefacts and guidelines to accompany DP160. These artefacts provide implementation examples for the updates to the CX standards for secondary users introduced in v1.11.0.

Consent Management (Data holder): Account permissions -Secondary Users

Addition of key requirements and guidelines related to DP160 on the CX Checklist, website version. See checklist references starting with 3AU.03, 3AU.03a, 3AU.03b, and 5CM4.01. Downloadable versions of the current CX Checklist also available.

Overview: CX Checklist

Inclusion of guideline on legal entity name of data recipient and guidance on Privacy Safeguard 10. See annotations 23 and 24. Update includes minor wireframe revision and updated open source design asset.

Consent management (Data holder): Authorisations

Downloadable version of the CX Checklist now available. Files contain key requirements and guidelines related to Consent, Consent management and Withdrawal (Data recipient).

Overview: CX Checklist

Addition of Consent, Consent management and Withdrawal (Data recipient) key requirements and guidelines in the CX Checklist.

Overview: CX Checklist

General update to wireframes to reflect best practice, compliance with relevant WCAG criteria, and annotations for relevant key requirements and guidelines.

Consent management (Data recipient): Collection and use consents

New CX artefacts and guidelines to accompany DP187. These artefacts provide implementation examples for the disclosure consent standards introduced in v1.11.0.

Consent management (Data recipient): Disclosure consents

New CX artefacts and guidelines to reflect v2 CDR Rules (Compilation No.3) and related guidelines on amended consents for consumer dashboards.

Consent management (Data recipient): Collection and use consents

General update to wireframes to reflect best practice, compliance with relevant WCAG criteria, and annotations for relevant key requirements and guidelines.

Consent Management (Data recipient): Withdrawal

New CX artefacts and guidelines to accompany DP187. These artefacts provide implementation examples for the withdrawal standard for disclosure consent introduced in v1.11.0.

Consent Management (Data recipient): Withdrawal

General update to wireframes to reflect best practice, compliance with relevant WCAG criteria, and annotations for key requirements and guidelines.

Consent: Collection and use consents

New CX artefacts and guidelines to accompany DP187. These artefacts provide implementation examples for the disclosure consent standards introduced in v1.11.0.

Consent: Accredited person disclosure consents

New CX artefacts and guidelines to reflect v2 CDR Rules (Compilation No.3) and related guidelines on amending consent.

Consent: Amending consents

New CX artefacts to accompany the v1.8.0 release. These artefacts provide implementation examples for the amending authorisations standards, which are optional from July 2021 and mandatory from November 2021 for all DHs.

Authorise: Amending authorisations

General update to withdrawal guidelines, including a revision to reflect the DP168 change released in v1.7.0.

Consent management (Data holder): Withdrawal

Examples for single occasion disclosure based on v1.7.0 standards. Revised guidelines to demonstrate how a data holder may communicate single occasion disclosures where duration is 0, absent, or up to 24 hours.

Consent management (Data holder): Authorisations

General update to wireframes to reflect best practice, compliance with relevant WCAG criteria, and to demonstrate ADR presentation through the use of legal entity, brand, and product name fields.

Consent management (Data holder): Authorisations

New guidelines and wireframes to demonstrate how data holders can show disclosure on a single occasion.

Authorise: Authorisation to disclose

New guideline and wireframe to demonstrate what a data holder might show when a consumer chooses to cancel Authentication / Authorisation.

Authorise: Authorisation to disclose

New wireframes to demonstrate how a profile selection step can be included to the authorisation flow when necessary.

Authorise: Authorisation to disclose

New guidelines and wireframes to demonstrate how data holders can design for unavailable and ineligible accounts.

Authorise: Authorisation to disclose

New guideline and wireframes to demonstrate how a data holder can comply with CX Standards for Authorise (Account selection and Confirmation) when data related to only one or no accounts are requested.

Authorise: Authorisation to disclose

General update to wireframes to reflect best practice, compliance with relevant WCAG criteria, and annotations for relevant technical standards. This revision also demonstrates ADR presentation in the authorisation flow using the legal entity field as required by rule 4.23(1)(a).

Authorise: Authorisation to disclose

An optional message in CX Standard on Withdrawing Authorisation: Redundant Data has been removed to align with the v2 rules on separate consents.

https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience

CX Standards have been ported from the PDF version into the main Data Standards published on GitHub.

https://consumerdatastandardsaustralia.github.io/standards/#consumer-experience

The CX Working Group is developing web-based CX artefacts. Change logs will reflect iterations of these artefacts, which will not constitute a new version of the standards. The change log will reflect the current version of the standards plus the date of the iteration to indicate the distinction. New or amended CX Standards will result in a new version of the standards, as with any data standard. There are no new or amended CX Standards in this iteration.

New guideline and wireframes to demonstrate where a data holder might introduce their CDR policy

Authenticate: Redirect to Web with One Time Password

General update to wireframes to reflect best practice, compliance with relevant WCAG criteria, and annotations for relevant technical standards.

Authenticate: Redirect to Web with One Time Password

New guideline and wireframes to demonstrate the expected presentation of ADRs by Brand Name, without reference to the Software Product Name, throughout the authentication process.

Authenticate: Redirect to Web with One Time Password

New guideline and wireframes to demonstrate how a data holder might include organisation details in the authentication flow (such as ABN).

Authenticate: Redirect to Web with One Time Password

CX Guideline and accompanying wireframe introduced to allow for the inclusion of an OTP resend functionality.

Authenticate: Redirect to Web with One Time Password

Detailed change logs for older versions of the standards and guidelines can be found on the standards page.

https://consumerdatastandardsaustralia.github.io/standards/#change-log

For details, see CDS Change log, v1.4.0 release notes

For details, see CDS Change log, v1.3.0 release notes

For details, see CDS Change log, v1.2.0 release notes

For details, see CDS Change log, v1.0.1 release notes

v1.35.0 contains all existing CX Standards plus new and revised guidelines and wireframe references. Added and Modified New and updated requirements to reflect: • Consultation Draft 367: March 2025 Rules - Draft Standards; • Consultation Draft 369: Redirect to App - Draft Standards; • Change Request 684: CX Guidelines | ADI or NBL to hold CDR data as a DH; • Change Request 691: CX Guidelines | Expanding Amending BCDC CX Guidelines; • Change Request 693: CX Guidelines | Historical date ranges for Authorisations; • Change Request 700: CX Guidelines | Redirect to App (R2A) CX Guidelines Changes; • Change Request 701: CX Guidelines | Data Language Standards changes stemming from CD367; • Change Request 702: CX Guidelines | Required and voluntary data - Authorisation; and • Change Request 703: CX Guidelines | Pre-consent. For more details, see Change log: Overview: CX Checklist v1.35.0.2025.09.26

Overview: CX Checklist

v1.34.0 contains all existing CX Standards plus new and revised guidelines and wireframe references. Added and Modified New and updated requirements to reflect: • Competition and Consumer (Consumer Data Right) Amendment (2024 Measures No. 1) Rules 2024; • Decision 350: August 2024 Rules - Standards Impacts; • Change Request 674: CX Guidelines | Updates stemming from 2024 Consent Review changes; • Change Request 574: Additional functionality to support account selection; • Change Request 659: Enhancing CDR Adoption: Streamlining Account Selection and Improving Data Transparency; and • Change Request 646: Clarify selection of Trusted Adviser in the CX Guidelines. For more details, see Change log: Overview: CX Checklist v1.34.0.2025.03.19

Overview: CX Checklist

v1.30.0 contains all existing CX Standards plus revised guidelines and wireframe references. Modified New requirements, minor revisions to existing requirements and retirement of one requirement relating to: • Consent Management (Data holder) Amended Authorisations For more details, see Change log: Overview: CX Checklist v1.30.0.2024.06.12

Overview: CX Checklist

v1.30.0 contains all existing CX Standards plus revised guidelines and wireframe references. Added New requirements relating to: • Collection and use consents- Business consumer statement • Amending consents- Amending business consumer disclosure consent • Business consumer disclosure consent • Consent Management (Data recipient)- Business consumer disclosure consent Modified Minor revisions to: • Collection and use consents • Amending consents • Consent Management (Data recipient) For more details, see Change log: Overview: CX Checklist v1.30.0.2024.05.01

Overview: CX Checklist

v1.29.1 contains all existing CX Standards plus revised guidelines and wireframe references. Added New requirements relating to Consent Management (Data holder): Authorisation- • Data recipient handling details • Joint accounts • Amending authorisations Withdrawal- • Data recipient handling details • Disclosure option management service Modified Minor revisions to Consent Management (Data holder): • Authorisation- Default example • Withdrawal- Withdraw approvals For more details, see Change log: Overview: CX Checklist v1.29.1.2024.04.09

Overview: CX Checklist

v1.29.1 contains all existing CX Standards plus revised guidelines and wireframe references. Modified Minor revisions to: • Consent: Disclosure consent- Accredited person disclosure consents, Trusted Adviser disclosure consents, Insight disclosure consents. • Consent Management (Data recipient)- Collection and use consents, Disclosure consents, Withdrawal. For more details, see Change log: Overview: CX Checklist v1.29.1.2024.03.06

Overview: CX Checklist

v1.29.0 contains all existing CX Standards plus revised guidelines and wireframe references. Added Authorise- Authorisation to disclose: Reference reflecting notification requirements where the authorisation to disclose CDR data is withdrawn or otherwise expires. Modified Minor revisions to: • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose; Amending Authorisations For more details, see Change log: Overview: CX Checklist v1.29.0.2024.02.22

Overview: CX Checklist

v1.17.0 contains all existing CX Standards plus revised guidelines and wireframe references. Added • Consent management (Data recipient)- Collection and use consents, Withdrawal • Consent management (Data holder)- Secondary user instruction removal, Joint account disclosure option management service, Joint account notification settings

CX Checklist

v1.16.1 contains all existing CX Standards plus new and revised guidelines and wireframe references. Added • Consent- Trusted Advisers disclosure consents, Insight disclosure consents • Authenticate- Redirect with One Time Password (Offline customer guidance) • Consent management (Data recipient)- Trusted Advisers disclosure consents Modified Minor revisions to: • Consent- Collection and use consents, Amending consents • Consent management (Data recipient)- Collection and use consents • Consent management (Data holder)- Authorisations (default example; amended authorisations; offline customers), Withdrawal

CX Checklist

v1.16.0 contains all existing CX Standards plus new and revised guidelines and wireframe references. Modified Minor revisions to: • Consent- Collect and use consent (default example; CDR outsourcing, sponsorship and CDR representative arrangements); Amending consent; Disclosure consent • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose; Amending authorisations; Authorisation to disclose joint account data • Consent Management (Data recipient)- Dashboards (default example; CDR outsourcing, sponsorship and CDR representative arrangements); Withdrawals for Consent to collect and use (default example), Amended consent, Disclosure consent

CX Checklist

v1.15.0 contains all existing CX Standards plus new and revised guidelines and wireframe references. Added • Consent- Collect and use consent (default example; CDR outsourcing, sponsorship and CDR representative arrangements) • Authorise- Authorisation to disclose joint account data • Consent Management (Data holder)- Withdrawals (default example; Withdrawing approvals); Account permissions- Remove secondary user instruction; Disclosure option management service; Joint account notification settings • Consent Management (Data recipient)- Dashboards (CDR outsourcing, sponsorship and CDR representative arrangements); Withdrawals for Consent to collect and use (default example) Modified Minor revisions to: • Consent- Amending consent; Disclosure consent • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose; Amending authorisations • Consent Management (Data holder)- Dashboards • Consent Management (Data recipient)- Dashboards (default example); Amending consent, Disclosure consent

CX Checklist

v1.11.0 contains all existing CX Standards plus new and revised guidelines and wireframe references. Added • Consent Management (Data holder)- Account permissions- Remove secondary user instruction Modified Minor revisions to: • Consent- Collect and use consent (default example); Amending consent; Disclosure consent • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose; Amending authorisations • Consent Management (Data holder)- Dashboards; Withdrawals • Consent Management (Data recipient)- Dashboards; Withdrawals for Consent to collect and use (default example), Amending consent, Disclosure consent

CX Checklist

v1.11.0 contains all existing CX Standards plus new and revised guidelines and wireframe references. Added • Consent- Collect and use consent (default example); Amending consent; Disclosure consent • Consent Management (Data recipient)- Dashboards; Withdrawals for Consent to collect and use (default example), Amending consent, Disclosure consent Modified Minor revisions to: • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose; Amending authorisations • Consent Management (Data holder)- Dashboards; Withdrawals

CX Checklist

v1.8.0 contains all existing CX Standards plus revised guidelines and wireframe references. Modified • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose; Amending authorisations • Consent Management (Data holder)- Dashboards; Withdrawals

CX Checklist

v1.7.0 contains all existing CX Standards plus revised guidelines and wireframe references. Modified • Authenticate- Redirect with One Time Password • Authorise- Authorisation to disclose • Consent Management (Data holder)- Dashboards; Withdrawals

CX Checklist

Initial release v1.4.0 contains all existing CX Standards plus guidelines from the previous PDF format.

CX Checklist

Initial release v1.5.1 contains all existing data language.

https://consumerdatastandardsaustralia.github.io/standards/#data-language-standards-common

Initial release v1.5.1 contains all existing CX Standards plus revised guidelines and wireframes for Authenticate- Redirect with One Time Password.

CX Checklist