05a. Conditions involving notification prior to first collection when holding data as a data holder

1CO.05a.25

25

Data recipients implementing CDR Rule Clause 7.2(2) need only comply with rules and standards for collection consents. Authorised deposit-taking institutions (ADIs) or non-bank lenders (NBLs) who are accredited persons, do not need to comply with CDR requirements for other consent types (such as use, de-identification, or disclosure). These entities may use and disclose the collected data according to their usual data handling practices for the use case, even when these practices extend beyond the use and disclosure constraints in the CDR rules.

Consent: Collection and use consents

17 September 2025