1CO.03a.
If data becomes redundant, data recipients MUST direct any outsourced provider that has been provided with a copy of such data to either: • return the redundant data to the data recipient; or • delete the redundant data, as well as any CDR data that has been directly or indirectly derived from it, and notify the data recipient of the deletion If the outsourced provider has provided any such data to another person, the data recipient MUST direct the outsourced provider to direct said person to: • take either of the above mentioned steps; and • cause similar directions to be made to any person to whom such data has been further disclosed
CDR Rule 7.12(2)(b)
CX Guidelines v1.4.0 PDF, p. 59, 63 [https://consumerdatastandards.gov.au/sites/consumerdatastandards.gov.au/files/uploads/2020/08/CX-Guidelines_v1.4.0.pdf]
12 August 2020 or earlier