clovaYour banking data
Open banking in Australia: what the Consumer Data Right means for you
Understand an Australian bank-data consent request, what you can refuse, and how to stop sharing under the Consumer Data Right.
By MarnixPublished Sources
A “connect your bank” button can look like a quick setup step, but it decides who sees your transactions. Before you tap it, you can check who's asking, what they'll see and how to switch it off later.
In Australia this sharing runs through a government system called the Consumer Data Right, or CDR. The service never gets your banking password; you confirm with your bank directly.
What is open banking in Australia?
Open banking is the everyday name for letting your bank send your account details to another service you choose, such as a budgeting app or a comparison site, so you don't have to type them in yourself. The government's CDR overview explains how it works.
Using CDR is optional. You don't have to connect a bank account to start understanding your money: statements and a written plan are useful too. If you say no, that feature won't work, but you can usually do the same job another way, such as uploading a statement.
Check the information and the recipient
Banking data goes beyond a balance. The data that can be shared includes account details and transactions, and may also include contact information and payment instructions. These can include saved payees (people or businesses you have saved to pay again), direct debits (permission for a business to take payments from your account) and payments you have scheduled for later. A request should tell you which categories and history it needs, rather than leaving you to assume that “connect” means everything.
Your transaction descriptions say a lot about you, down to where you shop and who you pay. Check two different things: how far back the transactions go, and how long the service can keep collecting new ones. A short permission can still come with a long history.
The bank is the data holder. An accredited data recipient is a business approved by the Australian Competition and Consumer Commission (ACCC) to receive CDR data. Look for the CDR accredited logo, then check the exact legal name and role in the government's Current providers directory. The logo alone won't tell you who's getting your data.
Sometimes the app you see works under another business's accreditation. The directory lists those arrangements too.
If the app works under someone else's accreditation
The app you're using may not be accredited itself. It can work under an accredited business that takes responsibility for it. The directory lists both names; check both.
The figure below shows a direct arrangement between your bank and an accredited recipient. The bank keeps its own records, while the service receives a copy of the information you agreed to share. Sharing one account does not automatically share your other accounts.
The request should also list any other companies that will handle your data for the service. Read that list too. Accreditation brings privacy and security obligations; it doesn't remove every risk or tell you whether a service is worth using.
How to read a consent request
Consent means your permission for a stated purpose. Check what the service will collect (take from your bank), how it will use it, and whether it will pass it on to anyone. Before agreeing, check that you understand which business is asking, what information it needs and when the permission ends. If the purpose is vague, ask what the information will be used for.
The service can only ask for the data it needs for the job, and it must tell you why it needs each part. “It might be useful later” isn't a good enough reason.
The request below is for a spending review using a selected everyday account. It asks for balances and 90 days of past transactions, with permission to collect and use data for 90 days. Those are two different periods: one describes how far back the records go, and the other describes how long the permission lasts. Marketing and de-identification are declined in this example.
De-identification means removing anything that identifies you, so the business can use the data in other ways. Read any separate request for that permission before agreeing.
Match it in the government's Current providers list. A logo alone doesn't prove who's receiving.
Check the job, the data categories and how far back the history goes. Ask why each is needed.
Marketing and other extra uses are separate choices you can refuse. You may not be able to untick parts of the main request.
This can be up to 12 months, and many are shorter.
Find the controls on both sides before agreeing.
A permission to analyse transactions for your spending review isn't a general permission to use that information however the business likes.
You can refuse the whole request. Where a service seeks additional consents for direct marketing or de-identification, those are separate choices, and those boxes can't be ticked for you in advance. Read what the business proposes to do with that information before agreeing.
You may not be able to untick individual data fields. If a required one bothers you, decline the whole request.
Keep the CDR receipt provided after consent. It records the arrangement and how to review or withdraw it. Screenshot it or save the email. You won't remember the name on the last screen in six months.
Why your bank asks you to confirm as well
After giving the service consent, you verify your identity with your bank. This is called authentication. You then review the bank's authorisation, which is your permission for it to send the specified information. These are separate parts of the CDR process: the service asks to collect and use information, while the bank asks for permission to send it.
Check the intended accounts and the authorisation details before confirming. Confirming at your bank doesn't let the service do anything more than you agreed. Later, you'll have controls on both sides. Each has a dashboard, a page in its app or website where you can review and manage the arrangement.
How is that different from screen scraping?
In CDR, the receiving service doesn't need your banking password. You authenticate with your bank, and data travels through a standardised electronic connection called an API.
Screen scraping is different: the app asks for your online banking login and uses it to read your account. A “connect your bank” button doesn't tell you which kind you're using. If an app asks for your banking password, stop. That isn't CDR, and handing your password to another business may break your bank's terms. Ask the app and your bank how the connection works first.
Sharing your data doesn't let the service cancel a direct debit or move money. Stopping the sharing doesn't cancel a subscription either; you still cancel that with the business.
If the account is shared with someone else
On a joint account, the usual setting lets either of you share the account's data without asking the other. Either of you can switch sharing off for the account, but turning it back on needs you both. The other holder may be told about changes, so if that could put you at risk, ask your bank about its safety process first.
Check the expiry and stop sharing
A permission can last up to 12 months. Many are shorter, or for one time only. Check the end date on your request instead of assuming a full year.
You can withdraw before then. To stop your bank sending new data under an arrangement, open your bank's app or online banking yourself and find its data-sharing controls. The label varies by bank. Choose the arrangement, check the recipient name and withdraw that authorisation. If you can't find it, ask your bank for its CDR or open-banking controls.
Stopping at your bank stops new data straight away. It doesn't stop the service using what it already has. To stop that too, withdraw permission in the service's own dashboard and ask it to delete your data.
The figure below follows one arrangement from agreement through withdrawal. It separates new information arriving from the bank from information the service already holds.
Agree to sharing
New transactions keep arriving.
The service uses it for the job you agreed to.
Stop at your bank
Nothing new arrives.
The service may still use what it has. Withdraw there too.
Stop at the service too
Nothing new arrives.
Ask the service to delete it.
Old transactions may still appear in the app after cancellation. Check when they were collected to tell whether new data is arriving.
Before completing withdrawal, review what happens to the data already held. Once the service no longer needs your data, it generally has to delete it or remove anything that identifies you.
Don't rely on uninstalling an app to do those jobs. Keep the withdrawal receipt or confirmation and ask the recipient what it still holds and why if anything remains unclear.
Deletion choices, retained records and withdrawal timing
Some records can be kept for legal reasons; ask which ones and for how long. If you contact a business by phone or email instead of its dashboard, it has two business days to act on your withdrawal.
Reading the request with your adult child
If you're helping your adult child, sit alongside them while they read the request and ask them to explain the purpose in their own words. Let them make the choice and handle the bank authentication themselves. You don't need their login details to help them work out whether the requested information seems relevant.
Finding the cancellation controls together is a useful part of setup. If the account is joint, check its sharing settings as well, so you both know who has agreed to what.
Turning the information into a plan
Whether or not you connect, the next step is the same: give your next pay a plan. A $700 pay might go $420 to rent and bills, $180 to everyday spending and $100 to a goal. Our guide to making a budget helps you choose amounts that reflect your own costs.
If something goes wrong with your data
If you see an arrangement you don't recognise, contact your bank and the named recipient through their official channels promptly. Stop unwanted access through the available controls. Save the arrangement name, dates and confirmations, but don't include passwords in a complaint.
For mishandled CDR data, complain to the business first. Say what happened and what you want put right. Its CDR policy, which explains how it handles your data, must set out how to complain and identify an external dispute resolution scheme. That scheme is an independent service that can consider unresolved complaints.
If it doesn't respond within a reasonable time, generally 30 days, or you're unhappy with its response, the official guidance points to the relevant scheme or the complaints process run by the Office of the Australian Information Commissioner (OAIC), the government's privacy regulator. For banking and accredited data recipients, the listed scheme is the Australian Financial Complaints Authority (AFCA). Check the business's policy for its details.
You can also report misconduct to the ACCC or OAIC. That helps the regulator act, but it won't resolve your own complaint. You don't need to keep unwanted sharing running while a complaint is considered.
A note from me
I want money tools to feel understandable before anyone is asked to trust them. With a bank-data request, I'd rather you take the time to read the permission and know where the exit is. Deciding to leave a connection off is a perfectly reasonable outcome too.
How I worked this out
I checked Australian Government CDR guidance, the OAIC's consumer explanations and the current Rules for this guide on 28 October 2026. The Rules displayed compilation 10, dated 4 March 2025; the relevant Act text was compilation 167, dated 16 September 2026. The Consumer Data Standards were version 1.36.0. Current law takes priority where an older consumer explanation simplifies representative or joint-account arrangements.
The diagrams explain a hypothetical individual using a service directly as an accredited recipient. The selected account, 90-day history and 90-day collection/use periods are illustrative choices, not universal screen options. They make no claim about a real business's accreditation or behaviour. No money moves, and the Clova planning sample doesn't depict bank access.
The planning sample allocates $420 to rent and bills, $180 to everyday spending and $100 to a goal: $420 + $180 + $100 = $700. Those are invented AUD amounts, with no recommended split. The two-day withdrawal limit is not a deletion timetable. Business-consumer exceptions, detailed technical implementation and app comparisons are outside this guide.