Consumer Data Right in Aotearoa New Zealand

The Consumer Data Right (CDR) gives you more choice and control over your own data. It makes sharing certain information with trusted organisations easier and safer, so you can access better services, insights, and deals.

What is a Consumer Data Right

Consumer Data Right is a legal framework that lets you decide who can access and use your data and for what purpose. When you use services, companies collect data about you – for example, your account or transaction history. Until now, that data has mostly stayed with them. The burden of getting data from one organisation to another falls on consumers and can be a lot of effort.

The CDR changes that by letting you decide who can access and use your data, and for what purpose. In some sectors you may also be able to instruct actions that can be undertaken on your behalf.

The goal is simple: empower consumers and boost competition.

What can be done under the Consumer Data Right

When a sector is designated, organisations and consumers in that sector can share data and carry out actions securely under CDR rules.

• Data sharing: data holders must provide two types of data -
  • Customer data: consumers leveraging their own data to access products or services
  • Product data: organisations sharing market data to drive competition
• Designated action/s: things that must or can be done under a customer’s instruction -
  • Nominated by sector: as sectors are designated, regulations for that sector can specify actions that can be performed with a customer authorisation

Which sectors are included?

Banking is first, enabling open banking from 1 December 2025.  The regulations for the banking sector include customer data only, and allow payments as designated actions.

How Consumer Data Right helps you

Banking is the first sector to join the CDR. Here’s some examples of what this could mean for you:

• Smarter budgeting: share your transaction data with a budgeting app to manage spending and set savings goals
• Easier switching: compare mortgage or loan offers by sharing your financial profile with multiple providers
• Faster payments: authorise a trusted organisation to make secure payments directly from your account

In the future, the CDR could make life easier in other sectors such as sharing electricity usage data to find a cheaper or greener plan.

Learn more about the benefits and possibilities of the CDR framework

The legal framework

CDR is enabled by the Customer and Product Data Act 2025, which:

• Creates your legal right to access and share data
• Sets rules for data holders and accredited third parties
  Data holders
• Requires strong security and authorisation protections

Supporting legislation includes:

• Regulations: both general and those that apply the framework to specific sectors
• Standards: set technical and operational requirements for safe, standardised sharing

MBIE and the Office of the Privacy Commission – working together

Whilst the CDR is enabled by the Customer and Product Data Act 2025, as with all activity, organisations must also fulfil their obligations under the Privacy Act 2020. The CDR specifies how organisations must meet their storage and security obligations under the Privacy Act, and how organisations should treat requests for customer data, which can include personal information.

The Ministry of Business, Innovation and Employment (MBIE) is responsible for sector designation, accreditation of data recipients and oversight of regulated data services. The Office of the Privacy Commissioner (OPC) regulates breaches of the CDR regime that involve personal information.

We work closely together to monitor compliance, support participants, and take action if any rules are broken.

The journey to establishing the CDR in Aotearoa New Zealand

The Consumer Data Right didn’t happen overnight - it’s the result of years of consultation, policy development, industry engagement and legislative work. Beginning with public engagement in 2020, the Government explored how data portability could boost competition and innovation while protecting privacy. This journey led to the Customer and Product Data Act 2025, which sets the legal foundation for CDR and enables sector-specific designations, starting with banking. 

Here you can explore the key milestones, decisions, and documents that shaped CDR in Aotearoa.

• Customer and Product Data (Designations for Banking and Other Deposit Taking) Regulations 2025(external link) — New Zealand Legislation
• Designation of the banking sector - Open banking
• Electricity is expected to be the next sector to be designated
• Designation of the electricity sector - Open electricity
• Other sectors like telecommunications and insurance may follow in the future.
• Timeline and key documents for the Customer and Product Data Act