[Home](/)/[Resources](/resources)/Australia Consumer Data Right — Connected Devices

AustraliaData / Privacy

# Australia Consumer Data Right (CDR): Obligations for Connected Device Manufacturers

The Consumer Data Right is reshaping how data flows between Australian consumers, financial institutions, energy retailers, and telcos — and connected device manufacturers who touch any of those data streams need to understand where their obligations begin. This guide covers the CDR framework, Data Recipient accreditation, API security requirements, and the penalties that apply when organisations get it wrong.

Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Faustralia-consumer-data-right-connected-devices)

At a glance

Authority

ACCC + OAIC (joint)

Governing Law

Competition and Consumer Act 2010, Sch. 2

Max Penalty

AUD $10M per contravention

Ongoing Breach

AUD $50,000 per day

Accreditation Timeline

3–6 months

## Key CDR concepts for connected device manufacturers

### CDR Legal Foundation — Treasury Laws Amendment Act 2019

The Consumer Data Right was established by the Treasury Laws Amendment (Consumer Data Right) Act 2019, which inserted the CDR framework into Schedule 2 of the Competition and Consumer Act 2010. The CDR gives consumers a legislated right to direct that their data held by one business be securely shared with accredited third parties of their choice. Joint administration sits with the ACCC (which sets the CDR Rules and enforces compliance) and the Office of the Australian Information Commissioner (OAIC, which enforces the CDR Privacy Safeguards). The regime launched in banking in July 2020, expanded to energy in November 2022, and extended to telecommunications in 2024 — with additional sectors under active consideration.

### Sector Designation and Connected Devices

CDR obligations attach to designated sectors, not to product categories per se. However, as the CDR expands into telecommunications and eventually broader technology services, connected device manufacturers increasingly face two exposure points: first, if their device collects data within a designated sector (e.g. smart meters, connected home energy monitors); second, if they want to receive CDR data on behalf of consumers as an accredited Data Recipient. The ACCC's sector designation process uses a ministerial designation order, and manufacturers in adjacent sectors should monitor the Treasury's CDR expansion roadmap closely — the window between designation announcement and compliance deadline can be as short as 12 months.

### Data Recipient Accreditation

Any entity that wants to receive CDR data from a Data Holder on a consumer's instruction must be accredited by the ACCC as a Data Recipient. The accreditation process requires demonstrating technical capability (including a conformant API integration), organisational security controls, an insurance policy meeting ACCC minimums, and a published CDR Policy. The ACCC operates three accreditation tiers — Unrestricted, Sponsored, and Affiliate — with different capability and obligation levels. The full Unrestricted accreditation process typically takes 3 to 6 months from application to approval, and applicants should budget significant engineering time to achieve the required API conformance.

### Technical Security Standards — OAuth 2.0 and FAPI

The CDR Data Standards set by the ACCC's Data Standards Body (DSB) mandate specific security controls for all CDR API interactions. Data Recipients must implement OAuth 2.0 with PKCE (Proof Key for Code Exchange), the Financial-grade API (FAPI) security profile, and TLS 1.2 as a minimum (TLS 1.3 is strongly recommended). Token endpoints must enforce a 90-second timeout on authorisation flows. For connected device manufacturers, these standards have direct firmware implications — OAuth flows must be initiated from a user-facing interface capable of rendering a browser redirect, which rules out headless embedded implementations without a companion app architecture.

### Consent Framework and Consumer Controls

CDR consent is highly regulated — it cannot be bundled with general terms and conditions, must be specific about the data clusters being shared, must specify a sharing duration (maximum 12 months for ongoing consent, though one-time sharing has no time limit), and must be easy for the consumer to withdraw at any time. Data Recipients must maintain an active consent dashboard accessible to consumers and must delete consumer data within specified periods after consent lapses. For device manufacturers, this means building consent lifecycle management into both the device interface and the backend — not merely ticking a box at onboarding.

### Penalties for CDR Non-Compliance

The CDR regime carries substantial civil penalties. Data Recipients who breach CDR Rules face civil penalties of up to AUD $10 million per contravention. Ongoing breaches can attract additional penalties of AUD $50,000 per day while the breach continues. The OAIC can also take enforcement action for breaches of the CDR Privacy Safeguards, which mirror and extend the Privacy Act 1988 obligations. Beyond financial penalties, the ACCC can suspend or revoke accreditation — effectively barring the entity from receiving CDR data — which can be commercially catastrophic for a product that depends on data sharing as a core feature.

## CDR compliance process for device manufacturers

01

Determine whether your device or service falls within a CDR-designated sector. Check the current list of designated sectors in the Competition and Consumer Act 2010 Schedule 4, and monitor Treasury announcements for upcoming designations. If your device collects energy, banking, or telecommunications data on behalf of consumers, CDR obligations may already apply or be imminent.

02

Assess whether you need to become an accredited Data Recipient. If your product's value proposition involves receiving CDR-shared data — for example, a home energy management device that aggregates smart meter data — you will need ACCC accreditation. Engage a CDR consultant early to map your data flows and determine which accreditation tier fits your use case.

03

Review the current CDR Rules and Data Standards published by the ACCC and DSB. The CDR Rules govern consent, data handling, and dispute resolution. The Data Standards (available at consumerdatastandards.gov.au) specify API schemas, security profiles, and conformance requirements. Both documents are versioned and updated regularly — subscribe to DSB notifications.

04

Implement the OAuth 2.0 + FAPI security profile in your platform. Build your API integration to satisfy FAPI Read/Write security requirements, including mTLS for token binding, PKCE for authorisation code flows, and signed request objects. Engage a security-specialist firm to perform a pre-submission conformance test against the CDR test suite published by the DSB.

05

Build consent management into your device firmware and companion app. Your consent flow must be CDR-compliant — specific data clusters, clear duration, easy withdrawal, and a real-time dashboard. Do not bundle CDR consent with device activation or general terms acceptance. Test the withdrawal and deletion flows rigorously before applying for accreditation.

06

Submit your accreditation application to the ACCC. The application includes an Information Security Policy, CDR Policy (public-facing), evidence of conformant API implementation, insurance certificate, and director/officer declarations. The ACCC may request additional evidence or a technical interview — budget 3 to 6 months from submission to approval.

07

Maintain ongoing compliance with CDR audit and reporting requirements. Accredited Data Recipients must submit annual self-assessments, notify the ACCC of material changes to their systems or business, and maintain audit logs of all CDR data access events. Conduct internal reviews each time the DSB publishes a new version of the Data Standards to assess whether your implementation requires updates.

## Frequently asked questions

### Does the Consumer Data Right apply to IoT device manufacturers?

It depends on whether your device operates within a designated CDR sector and whether you receive or transmit CDR data. Currently, banking, energy, and telecommunications are designated sectors. A connected energy monitor that receives smart meter data shared under CDR, or a fintech device that aggregates banking transaction data, could fall squarely within CDR scope. Manufacturers outside designated sectors are not directly bound today but should monitor the Treasury's CDR expansion roadmap — new sector designations can impose compliance obligations with as little as 12 months' notice.

### What is a CDR Data Recipient and do I need to be one?

A CDR Data Recipient is an ACCC-accredited entity that receives consumer data shared by a Data Holder (such as a bank or energy retailer) under a consumer's CDR consent. If your product or service relies on receiving this shared data — rather than data the consumer enters directly — you must be accredited. Accreditation is not optional: receiving CDR data without accreditation is a breach of the CDR Rules and attracts civil penalties. The ACCC publishes the CDR Register listing all current accredited entities.

### What security standards are required under the CDR framework?

The CDR Data Standards mandate OAuth 2.0 with PKCE, the FAPI (Financial-grade API) security profile, TLS 1.2 minimum for all API transport, and a 90-second timeout on authorisation code flows. Mutual TLS (mTLS) certificate binding is required for client authentication in certain flows. All of these requirements are tested against the DSB's conformance test suite before accreditation is granted. The standards are versioned and the DSB publishes a transition schedule when new versions introduce breaking changes.

### What are the penalties for non-compliance with CDR obligations?

Civil penalties for breaching CDR Rules can reach AUD $10 million per contravention for Data Recipients. Ongoing breaches attract additional daily penalties of AUD $50,000 per day while the contravention continues. The OAIC can separately enforce CDR Privacy Safeguard breaches, with penalties that mirror those in the Privacy Act 1988 — potentially including additional compensation orders. Beyond financial penalties, the ACCC can suspend or revoke accreditation, which would prevent the entity from receiving any CDR data — a potentially existential outcome for data-dependent products.

**Disclaimer:** Educational resource only. Regulatory requirements change. Consult a qualified compliance specialist before making decisions.

🇦🇺 Australia roadmap for your product

Every standard, document, and test that applies — free, no account required.

See your free roadmap

Learn this properly

In-depth course that teaches the full process, not just this one answer.

[Start the course — $149](/courses/44-australia-rcm-marking-electronics-cabling)[Prefer to read? Get the book — $24.99](/books/44-australia-rcm-marking-electronics-cabling)

Related guides

*   [Australia Privacy Act for Connected DevicesAustralia Privacy Act 1988 for connected devices: the 13 APPs, NDB 30-day breach notification, and 2024 reform obligations for IoT product makers.](/guides/australia-privacy-act-connected-devices)
*   [Australia Notifiable Data BreachesAustralia Notifiable Data Breaches (NDB) scheme under Privacy Act 1988 for connected hardware: eligible data breach criteria, 30-day OAIC notification, Privacy Act reform removing small business exemption, and penalties up to AUD $50M or 30% of turnover for serious violations.](/guides/australia-notifiable-data-breaches)
*   [Australia Digital Platform Services ActThe Treasury Laws Amendment (Digital Platform Services) Act 2022 for hardware ecosystems: ACCC designation thresholds, app marketplace obligations, interoperability codes, and when a connected device OEM running its own app store gets captured.](/guides/australia-digital-platform-services-act)
*   [Australia Telecommunications Act ComplianceTelecommunications Act 1997 compliance for hardware companies in Australia: carrier/carriage service provider licensing triggers, ACMA technical standards, and when a connected-device maker crosses into telecoms-regulated territory.](/guides/australia-telecommunications-act-compliance)
*   [Australia Compliance OverviewThe RCM mark, EESS electrical safety, ACMA radiocommunications, TGA medical devices, and the ACL safety net in Australia.](/guides/australia-compliance-overview)