---
title: "Consumer Data Right: data holder obligations on the CDR site"
url: "https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/cdr-data-holder-obligations"
type: "precedent"
site: "AI Law Framework"
id: "a24-cdr-data-holder-obligations"
area_id: "A24"
kind: "checklist"
ai_level: "yellow"
version: 1
task_ids: ["A24-T1-R12"]
law_stated_as_at: "2026-10-22"
---

# Consumer Data Right: data holder obligations on the CDR site

> Checklist of data holder obligations as the Consumer Data Right site states them, including authorisation, the 12-month maximum, withdrawal within two business days, and twice-yearly reports. The Rules were not opened.…

Canonical page: https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/cdr-data-holder-obligations  
Law stated as at: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

Checklist of data holder obligations as the Consumer Data Right site states them, including authorisation, the 12-month maximum, withdrawal within two business days, and twice-yearly reports. The Rules were not opened. The page says it is general guidance.

## Key facts

- Kind: Checklist. Steps or checks to work through and tick off.
- Practice area: [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts.md)
- Jurisdictions: Australia, Commonwealth
- AI level: Yellow. You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at: 2026-10-22
- Status: Maintained. Checked on 2026-10-22 against the authority it cites, for Australia and Commonwealth.

## When to use it

Use when reviewing a data holder's Consumer Data Right participation, including banking or energy. It is not an accredited data recipient agreement and it is not a privacy-policy draft.

## Used for these tasks

- [Review an open-banking or consumer-data-sharing participation agreement](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/review-an-open-banking-or-consumer-data-sharing-participation-agreement.md)

## How AI may be used

AI may list the obligations the CDR page names and note which internal document the lawyer points to. The lawyer decides whether the data holder complies.

**AI may:**

- Build a row for each obligation on the page and name the policy or log the lawyer identifies
- Flag a row with no document
- Record that an authorisation states a period no longer than 12 months, if the screen shows a period

**AI must not:**

- Must not say the data holder complies with the Rules
- Must not treat this page as a statement of the law. The page says it is general guidance
- Must not draft the Consumer Data Right policy. The OAIC guide was not opened

**The lawyer checks:**

- The entity is a data holder, and any exemption is on the ACCC register. That register was not opened
- Withdrawal of authorisation is actioned within two business days, and the accredited data recipient is notified
- The twice-yearly report includes the counts the page lists

## Authorities

- [Consumer Data Right, Compliance requirements for data holders (authorisation contents, withdrawal within two business days, records, and twice-yearly reports to the ACCC and the OAIC)](https://www.cdr.gov.au/for-providers/compliance-requirements-data-holders)

## Full text and drafting notes

The full text and the drafting notes are not part of this public page. Signed-in firm accounts can read them at https://ailawframework.com/precedents/technology-media-and-telecommunications-it-contracts/cdr-data-holder-obligations and through the signed-in MCP connector https://ailawframework.com/mcp/firm.

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*