The Competition and Consumer (Consumer Data Right) Amendment (2025 Measures No. 1) Rules 2025 have been registered. Its purpose is to extend the CDR to the non-bank lending sector and narrow the scope of CDR data for the banking and non-bank lending sectors.

The Amending Rules apply the following to non-bank lenders:

• eligibility requirements for consumers seeking to make requests for CDR data;
• criteria setting out the scope of non-bank lenders subject to CDR data sharing obligations;
• the process for additional non-bank lenders to choose to participate in the CDR;
• provisions specifying in-scope products and data sets that may, or must, be provided on request;
• requirements for internal and external dispute resolution.

A ‘covered product’ will be subject to data sharing if it is a retail product publicly offered by banks and non-bank lenders under a standard form contract.

Buy now, pay later (‘BNPL’) products are specified as covered products for both bank and non-bank sectors. This creates new data sharing obligations for ADIs.

To reduce compliance costs for data holders, the Amending Rules exclude certain data that relates to covered products from being required product data.

These products are foreign currency accounts, consumer leases, reverse mortgages, margin loans, and asset finance that is non-standard vehicle finance. Non-standard vehicle finance is intended to include products such as novated leases and fleet finance. For completeness, data about standard vehicle finance
products will continue to be required data.

The Amending Rules largely preserve the existing circumstances in which data is not required consumer data but could be voluntary consumer data, and apply these exclusions to the non-bank lenders sector. These exclusions cover the following:
• historical data relating to transactions occurring more than 2 years before the time a data request is made, where the relevant account is an open account (down from the previous 7-year rule);
• direct debit deductions that occurred more than 13 months before the time a data request is made, where the relevant account is an open account; and
• data that relates to a relevant account that is a closed account

If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.

Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.