New Zealand's Consumer Data Right (CDR) comes into force 1 December 2025.
Our five-part video podcast series is designed to help you understand the CDR, its phased implementation and what it means for your sector. No matter your industry, understanding these roles is crucial as the CDR regime takes shape.
Welcome to episode one of our Consumer Data Right Quick-Fire Updates! A five-part daily podcast of short one-to-two-minute updates with everything you need to know about the CDR (and without all the filler). We've had some fun using AI to produce these videos, including our brand-new life-like avatars!
New Zealand’s CDR goes live on the 1st of December when the Customer and Product Data Act 2025 comes into force, as well as most of the provisions of the four sets of regulations which dropped last month. The CDR gives customers the power to securely share data about them held by organisations; and to require those organisations to take certain actions on their behalf. The banking sector is up first with electricity, insurance, and telecommunications, expected to follow after that.
The CDR regime is sector‐neutral by design. Certain sectors, and organisations within those sectors, will then be designated in-scope of the CDR from time to time. Once an organisation is in-scope, customers have the right to request that organisation to provide information and perform actions mandated under the CDR. That will look different for every sector. The CDR supports customers making these requests directly or asking accredited third parties to make the requests for them. Although, for the banking sector initially, only requests via accredited third parties are designated. We'll look at the accreditation requirements in more detail in tomorrow's podcast.
The CDR works alongside the Privacy Act and thought has been given to this in the CDR's design. A CDR request for information is not a personal information access request under the Privacy Act, but certain CDR failures (such as inadequate security) can constitute privacy breaches, triggering remedies under the Privacy Act.
The CDR is administered by MBIE and enforced by MBIE and the Office of the Privacy Commissioner. Penalties for breach scale with risk, with only some defences available: infringement notices and minor offences can incur fines up to $20,000; but serious breaches for companies can result in fines of up to $2.5 million; and for egregious conduct (like knowingly misleading to obtain CDR data), criminal penalties of up to five years’ imprisonment or $1 million for individuals, and up to $5 million for companies.
There's lots of opportunity for organisations to become accredited and develop value-added services for customers which leverage data not traditionally readily accessible.
Now is the time to review governance frameworks, assess readiness, understand the CDR requirements, and identify strategic opportunities as the CDR expands. We'll discuss this in more detail in the coming episodes.
Next time, we'll cover who must share data, who can request it, accreditation and how to get there with confidence. See you tomorrow.
Welcome back. Today, we're looking at who must share data, who can request it, and the accreditation process. No matter your sector or how you interface with the CDR, understanding these roles is critical. We'll also have a look at fees and levies. As with yesterday, these videos have been published using AI (including our new avatar friends)! Right, let's kick off!
Data holders are organisations, such as banks or electricity retailers, which are designated under regulations and are required to share customer data with the customer or an accredited third-party requestor at the customer's direction.
Data holders are also required to publish product data, and take certain actions on customer instructions (like transferring funds, or switching a customer to a new provider). Data holder obligations focus on lawful disclosure, security, and governance.
The key responsibilities of data holders are: to comply with data sharing or designated action requests; to maintain a secure system that meets technical and performance standards for complying with CDR requests; to implement robust consent tools allowing customers to grant, monitor, and revoke consents; to maintain a complaints process; and to grant systems access to accredited requestors as required under the CDR. Data holders are only permitted to refuse requests in exceptional circumstances.
Accredited requestors are entities, such as fintechs, that have been formally accredited to access CDR data from data holders, or request mandated actions, on behalf of customers.
Data may only ever be accessed, or actions requested, with explicit customer consent.
Once accredited, you’ll appear on a public register; and data holders must promptly grant you system access on request. You'll also need to meet ongoing compliance obligations, such as sending consent reminders to customers every 12 months, and having a complaints process.
Intermediaries are also permitted to seek accreditation to participate. These are organisations that stand in between data holders and a third party who is not an accredited requestor, providing connectivity and operational services. Accreditation for intermediaries includes added controls for identity verification, deception risk, and Privacy Act alignment.
To get accredited, you'll need to apply to MBIE and meet specified accreditation criteria.
For example, you'll need to demonstrate that you have robust security safeguards in place, your leadership team is fit and proper and of good character, you are capable of complying with your CDR obligations, and you are of acceptable financial standing (including via having insurance or other financial coverage in place).
Accredited requestor application fees range from $1,500 to $2,000 plus GST (depending on whether you are acting as an intermediary). Slightly lower fees apply to renewals. Levies are also payable.
For accredited requestors, the levy scales with annual revenue, ranging from $1,300 to $85,000, plus GST. For data holders, it is determined by total asset value and ranges from $63,400 to over $1.2 million plus GST. If you're both a data holder and an accredited requester, you'll only pay the higher of the two levies.
In the next episode, we unpack what the CDR will look like for the banking sector, which goes live in just under two weeks! See you then.
Today, we dive into the first sector to be officially designated under the CDR, Banking. Consumer-directed API-based data sharing and transactions are not new for this sector, with the Payments NZ API Centre framework and other bespoke arrangements having been in operation for some time. However, from December, banking will be the first sector to go live under the government-mandated Consumer Data Right framework.
As with all podcasts in this series, this video has been published using AI (including our new avatars)! Right, let's look at what's ahead.
The Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025 bring banking in-scope of the CDR as a designated sector.
From the 1st of December, ANZ, ASB, BNZ, and Westpac must comply with the CDR rules, and Kiwibank joins them from the 1st of June 2026. Other licensed deposit takers can opt in from the 1st of December this year with notice.
Under the Banking Regulations, banks can share eligible NZD electronic account data at the request of accredited requestors, but not directly on a customer's request (at least at this stage). Think account identifiers, balances, transactions, and statement data. Accredited requestors can also initiate NZD payments from a bank on behalf of a customer under strict conditions.
MBIE is currently finalising a set of Banking Standards. The draft standards leveraged some of the work done previously by the banks via the Payments NZ API Centre framework. These standards set out the more technical details about how exactly the CDR will work in the banking context. This includes things like access interfaces, consent flows and security. Together, the Banking Standards and the Banking Regulations form the complete set of rules for how the CDR works in the banking sector specifically. These rules will no doubt form the blueprint for how other sectors designated later will be regulated.
Under the new CDR rules, banks must share data such as account balances, transactions, and statements with accredited third parties. These accredited requestors could include providers of budgeting apps, comparison tools, and other services that help consumers make smarter financial decisions.
Overseas, similar open banking regimes power apps like Frollo in Australia, helping users track spending and set budgets; Venmo in the USA, for easy money transfers; and Chip in the UK, which automates savings. MoneyWiz is another example of an open banking product that centralizes spending, budgets, and accounts across 40,000 banks in 50+ countries, giving users full financial visibility and control.
Local innovations are already emerging, such as Volley, which enables quick, secure payments without sharing account details. It will be exciting to see further developments in this space in the coming months.
In our next episode, we're diving into how the CDR could impact the electricity sector. See you tomorrow!
Welcome to episode four of our Consumer Data Right Quick-Fire Updates! Today, we're exploring how the CDR framework is expected to apply to the electricity sector. As with all podcasts in this series, this video has been published using AI (including our new avatars)! Right, let's get into it.
In late 2024, the Government consulted on whether, and how to designate the electricity sector under the CDR regime.
The Government sought feedback on data scope, participants, and actions (like switching and energy management). It also asked about the pros and cons of designating the electricity sector, and other considerations such as accreditation, fees, consent, and how the CDR interacts with the Electricity Participation Code 2010.
Submissions on that consultation closed in October 2024 and the Government is currently reviewing the feedback to inform further analysis of an electricity designation.
In parallel, the Electricity Authority is advancing regulatory work aimed at improving access to product data, helping consumers choose optimal power plans and switch providers more easily.
Australia designated electricity as in-scope of its CDR in 2020, with phased data sharing from late 2022. This enabled apps like EnergyFlex, which uses smart-meter data to rate electricity use against renewable availability and provide personalised insights and plan recommendations, helping consumers choose options that fit their needs, as well as their budget.
The UK's 2025 Data (Use and Access) Act introduced a cross-sector "smart data" scheme. Planning, design, and costing work is now underway to bring energy within its scope, following the July 2025 evidence response.
In New Zealand, the Electricity Authority is collaborating with daylight to launch a new energy comparison and switching service by late 2025.
This initiative aims to standardise data and accelerate services that the CDR would further enable.
We also expect the Government to decide on the electricity CDR designation in 2026, followed by further consultation on sector‐specific regulations and technical standards (including accreditation criteria, security and consent requirements, and API and data formats).
So, what should you do now?
First, audit and map your data assets to identify types, locations, and access protocols. Second, stress-test consent and revocation processes against likely CDR rules, potentially using the banking sector rules as a proxy. Third, engage legal and technical advisors early to understand potential compliance and security obligations, and inform the direction of travel of ongoing technology and operational change. Finally, where necessary, review and update internal systems to securely handle, share, and manage customer data.
In our final episode, we'll break down the CDR's proposed application to insurance and telecommunications. See you then.
Welcome to our final episode in our five-part Quick-Fire Updates series on New Zealand's Consumer Data Right. The Government has indicated that insurance and telecommunications are the other two sectors in line for designation under the CDR. While details are still to come, today we'll explore what this could mean for these sectors and what you should prioritise now. As with every podcast in this series, we've used AI to produce these videos, including our video and audio avatars. Alright - last update in the series, here we go!
Telecommunications already has a foundation to build off in this space. Number portability and existing product disclosure requirements make switching providers easier and support transparency. But the CDR would take this further, enabling secure, customer-directed data sharing with accredited third parties.
In its feedback on the CDR regime, the New Zealand Telecommunications Forum supported greater transparency of product and customer information for consumers but called for a thorough sector analysis first to avoid any unnecessary implementation costs, low uptake, and unintended pressure on smaller providers.
The Insurance Council of New Zealand's feedback on the CDR regime to date has supported the CDR's consumer-control principles but warned of several risks for the general insurance industry. Complex plans, the bespoke nature of underwriting, and layered data ecosystems raise accuracy and IP concerns, while data errors could lead to mispricing, disputes, and liability.
Introducing the CDR to insurance will require careful planning.
Australia has paused a CDR roll-out for these two industries. Given their complexities, New Zealand will also need to carefully consider and engage in deep consultation with sector participants before designating them in-scope of the CDR.
Similarly, the UK has adopted open data initiatives in banking and energy, but not yet in telecommunications or insurance. New Zealand will need calibration, proper consultation, and careful risk mitigation before designating these sectors.
This is your chance to get ahead and be ready to harness opportunities, and manage complexities, when the CDR arrives. So, what should you prioritise now?
First, track regulatory changes and engage early in consultations.
Second, review your data quality, security, and interoperability, ensure your direction of travel is consistent with CDR principles in areas likely to be regulated under any later designation or accreditation.
Third, where workable, ensure any changes to your consents, audit, and complaints processes are CDR-aligned to future-proof for CDR participation requirements.
Finally, join industry working groups to ensure your concerns are heard.
Legal teams helping to shape standards now will enable their organisations to move faster and achieve better outcomes when the CDR arrives.
That wraps up our CDR Quick-Fire Updates series! We have had so much fun experimenting with AI to create these videos and our new avatars!
We hope you have found the updates useful. We will keep you updated as New Zealand's Consumer Data Right evolves, and as new sectors are designated under the CDR. See you next time!
This content is intended only to provide a summary of the subject covered. It does not purport to be comprehensive or to provide legal advice. No person should act in reliance on any statement contained in this publication without first obtaining specific professional advice. If you require any advice or further information on the subject matter, please contact a Russell McVeagh partner/solicitor.
