Review a Consumer Data Right participation agreement and API terms
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Line up data-holder, accredited-recipient and API obligations in the agreement against the CDR Rules and OAIC CDR Privacy Safeguards the lawyer has named, marking gaps.
- What the lawyer must review
- Check the CDR Rules and Data Standards (e.g. FAPI 1.0 Advanced) on consumerdatastandards.au
- Check the CDR Register
- Do not treat outsourcing as shifting the data holder's duties (Privacy Safeguard 11)
- Note the OAIC's Regional Australia Bank determination (May 2025)
- Check Treasury's timeline for non-bank lenders
- Confirm Privacy Safeguard 12 deletion duties
- Written for / version
- Commonwealth versionCth
Rules that apply
The document starts from the task name. Change it if this piece of work is different.
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Review operative clauses in the complete document, including definitions, cross-references, schedules and inconsistencies with the instructions.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Obtain and inspect the relevant current official register or search result. Confirm identities, interests and the date and scope of the search.
- Verify dates, people and sequence against contemporaneous records. Preserve uncertainty and identify gaps or conflicting accounts.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.