Navigating the CDR: Consumer Data Right Policy Essentials

A CDR policy is required for data holders, and if your business is or will be a data holder under the CDR regime, now is an important time to act in the development of such a policy. According to Privacy Safeguard 1 and CDR Rule 7.2, all CDR entities must have a clearly expressed and up-to-date policy about how they manage CDR data (CDR policy). The policy must be provided free of charge and made available in accordance with the CDR Rules.

What needs to be included in a CDR Policy?

The CDR policy must include information about how a CDR consumer can access and seek correction of their CDR data, how they may complain, and how the entity will deal with a complaint. It must also:

1. Indicate how the data holder will respond to consumer data requests;
2. Specify the classes of CDR data they held or may hold in the future;
3. Address the purposes for which they may collect, hold, use or disclose CDR data (each being explained separately);
4. Indicate how the data holder will authorise access to CDR data;
5. Indicate how the data holder will disclose CDR data;
6. Set out the data holder’s privacy obligations;
7. Set out the records the data holder must keep and maintain; and
8. Set out the reporting requirements the data holder must comply with.

Data holders must also ensure that their CDR policy is distinct from any existing privacy or information security policy. The policy needs to be available to consumers free of charge and in their preferred format (hard copy / electronic).

What are the recommended steps in developing the policy?

To ensure compliance with Privacy Safeguard 1 and CDR Rule 7.2, data holders should:

1. Develop and maintain a clearly expressed and up-to-date CDR policy;
2. Make the policy available to consumers free of charge and in their preferred format;
3. Ensure the policy is distinct from any existing privacy or information security policy;
4. Include information about how a CDR consumer can access and seek correction of their CDR data, how they may complain, and how the entity will deal with a complaint;
5. Include information about how the data holder will respond to consumer data requests, authorise access to CDR data, disclose CDR data, and their privacy obligations;
6. Include information about the records the data holder must keep and maintain, and the reporting requirements the data holder must comply with; and
7. Refer to the OAIC’s Guide to developing a CDR policy for further information and discussion about the requirements for a CDR policy.

For further information on the required format and contents for a CDR Policy, data holders should refer to the OAIC’s Guide to developing a CDR policy. This guide provides further information and discussion about the requirements for a CDR policy.

Conclusion

In summary, a CDR policy is required for data holders. Data holders must ensure that their CDR policy is distinct from any existing privacy or information security policy, and includes information about how a CDR consumer can access and seek correction of their CDR data, how they may complain, and how the entity will deal with a complaint. They must also include information about how the data holder will respond to consumer data requests, authorise access to CDR data, disclose CDR data, and their privacy obligations, as well as the records the data holder must keep and maintain, and the reporting requirements the data holder must comply with. Data holders should refer to the OAIC’s Guide to developing a CDR policy for further information and discussion about the requirements for a CDR policy.

If you would like assistance in developing the policy or confirmation that it is compliant, contact us.