The Third-Party Disclosure Consent: The CDR Reform Australia Needs
Australia’s Consumer Data Right (CDR) has reached a turning point.
In October, 2025 Treasury released a targeted consultation proposing a third-party disclosure consent — a major step toward unlocking real utilisation, participation and innovation in the CDR ecosystem.
What is being proposed?
Today, only accredited data recipients or companies with specific access models can access and use CDR data. This tight control was essential for trust and privacy in the regime’s early years, but it has also limited innovation and uptake.
The new proposal simplifies the current eight-consent model into a single framework that lets accredited participants share data - with the consumer’s permission - to any third party.
Once disclosed, that data would be treated under the Privacy Act, rather than the more restrictive CDR rules.
In practice, this means:
- Businesses can build real-world use cases faster and cheaper – without any eligibility restrictions on who can participate.
- Consumers can choose who to share data with — beyond the small pool of accredited participants.
- Industry can finally retire insecure screen-scraping and deliver modern, API-driven solutions.
Why Does It Matter?
CDR’s biggest challenge has always been utilisation.
The infrastructure exists, but the rules made participation complex and commercially unappealing.
This reform shifts CDR from theory to practice — turning it into a data-enablement framework, not just a compliance burden.
Treasury’s focus on outcomes — innovation, competition, and consumer empowerment — is exactly what’s needed for CDR 2.0.
Fat Zebra’s View
At Fat Zebra, we strongly support this reform.
We believe:
- Consumer choice should determine where their data goes, not accreditation bottlenecks.
- Simplified consents will encourage participation and product innovation.
- Responsible governance and Privacy Act safeguards still provide an appropriate safety net.
This change doesn’t weaken CDR; it makes it work.
It opens the door to a modern, dynamic, data-driven economy that benefits both consumers and fintechs.
The Third-Party Disclosure Consent is the bridge between regulation and innovation — the spark that can finally make the Consumer Data Right live up to its name.
