Consumer Data Right explained
Plain-language guide to Australia's regulated open banking framework: how consents work, who can access your data, and why CDR is fundamentally safer than screen-scraping.
Share your data with BankSync
Fiskil (ADRBNK000246) is the accredited data recipient; BankSync is its CDR Representative.
Data to share
- Account name, type and balance(shared)
- Transaction details(shared)
- Direct debits and scheduled payments(not shared)
Share for
The Consumer Data Right (CDR) is an Australian regulatory framework that gives you a legal right to share your bank data with accredited third parties. You authorise a scoped, time-bound consent directly with your bank; your credentials never leave the bank's site. Supervised by the ACCC and Treasury, CDR replaces the old practice of screen-scraping with a regulated, revocable, audited data flow.
How CDR works in practice.
When you connect a bank to BankSync, you are redirected to your bank's secure CDR authorisation page. You log in, choose what data to share (transactions, balances, etc.) and for how long (7 days, 90 days, or 12 months), and approve. Your bank issues a scoped access token to an Accredited Data Recipient (ADR). BankSync operates as a CDR Representative under Fiskil (ADR accreditation ADRBNK000246).
What data is shared
Only the scopes you authorise. Common ones include account details, balances, transactions, regular payments, and account-holder name. Sensitive data like credit reports is out of scope. You see exactly what is being shared at consent time and can review or revoke it anytime in your bank's CDR dashboard.
Which banks are covered
CDR is mandated for the entire Australian Authorised Deposit-taking Institution (ADI) sector: Big 4 banks, regional banks, neobanks, mutuals, credit unions, and brokerages with banking licences. The full register is at cdr.gov.au.
CDR vs screen-scraping.
- Credentials
- CDR never sees your password; screen-scraping requires you to share it.
- Scope
- CDR consents are scoped to specific data types and durations; screen-scraping has unrestricted login access.
- Revocation
- CDR consents are revocable from your bank or BankSync at any time; screen-scraping access ends only when you change your password.
- Regulation
- CDR is supervised by the ACCC and Treasury; screen-scraping is not.
Consumer Data Right, in short.
- Regulator
- ACCC & Treasury
- How it works
- Australia's Consumer Data Right (CDR) is the regulated open banking framework letting you securely share your bank data with accredited recipients. BankSync routes through Fiskil, an accredited Data Recipient (ADR).
- Connection
- Routed via Fiskil (Accredited Data Recipient, ADRBNK000246).
Deep dives on CDR.
- CDR vs screen-scraping Why password-sharing is on the way out, and how CDR replaces it with regulated, scoped, revocable consents.
- Accredited Data Recipients What ADR accreditation requires, the role of CDR Representatives, and how to verify any provider.
- Consent duration The three durations (7 days, 90 days, 12 months), what happens at expiry, and how to renew or revoke.
- Data scopes The Australian account data BankSync currently supports through Fiskil CDR (transactions and balances) and what remains outside that connection.
- Use CDR data over an API Read your own Australian transactions and balances as JSON over REST or MCP, through the same CDR connection.
Questions, answered.
What is the Consumer Data Right (CDR)?
The Consumer Data Right is an Australian regulatory framework, introduced in 2020 and overseen by the ACCC and Treasury, that gives consumers a legal right to share their bank data with accredited third parties. It was the world's first economy-wide data-portability regime and now covers banking, with energy and telecommunications rolling out.
How is CDR different from screen-scraping?
Screen-scraping requires sharing your banking username and password with a third party so they can log in as you. CDR replaces that with a regulated, scoped consent: your bank issues an access token to an Accredited Data Recipient (ADR) for a duration you choose, and you can revoke it at any time. CDR is supervised by the ACCC; screen-scraping is not.
Who can access my CDR data?
Only Accredited Data Recipients (ADRs) and CDR Representatives can access CDR data, after you authenticate with your bank and consent to specific data scopes (e.g. transactions, balances) for a specific duration. The full list of accredited providers is published at cdr.gov.au.
How long does CDR consent last?
CDR consents are time-bound: you can choose 7 days, 90 days, or 12 months (the maximum permitted under CDR rules). The consent expires automatically; you can revoke it earlier from your bank or from BankSync.
What data is shared under CDR?
Only what you authorise. Common scopes include account details, balances, transactions, regular payments, and account-holder name. Sensitive data (e.g. credit reports) is out of scope. You see exactly what is being shared at consent time.
Is CDR data shared offshore?
CDR rules tightly restrict offshore disclosure. ADRs must keep CDR data within accredited infrastructure and disclose any offshore service providers in their CDR policy. BankSync operates under Fiskil (ADRBNK000246) within Australia.
Which Australian banks support CDR?
CDR is mandated for the entire Australian Authorised Deposit-taking Institution (ADI) sector, every Big 4 bank, regional banks, neobanks, mutuals, credit unions, and brokerages with banking licences must expose CDR-compliant APIs.
How does BankSync use CDR?
BankSync acts as a CDR Representative under Fiskil's accreditation. When you connect a bank, you are redirected to the bank's secure CDR consent page; once you authorise, the bank issues a token to Fiskil who passes the consented data to BankSync for the duration you chose.