What is the Consumer Data Right? 

The Consumer Data Right (CDR) was introduced to provide consumers with greater control over their information, the products and services they use or wish to use, and their use of those products and services, called CDR data.

Using the CDR framework, consumers can request access to CDR data about them held by designated organisations called data holders, and authorise it to be shared with accredited third parties called accredited data recipients (ADRs). The ADRs can use this CDR data to provide richer products and services. 

Application of the CDR to NAB

National Australia Bank Limited (ABN 12 004 044 937) (NAB, we, our or us) has been designated as a data holder (provider number DHBNK000003). Separately, NAB has received accreditation as an accredited data recipient (accreditation number ADRBNK000262).

Therefore this policy applies to NAB in its capacity as both a data holder and an accredited data recipient. 

What is in this policy?

This policy describes your rights under the CDR laws and explains how you can: 

  • request that we (as a data holder) share your CDR data with ADRs; 
  • ask us (as an accredited data recipient) to collect your CDR data from another data holder or accredited data recipient so we can deliver a product, service or feature to you;
  • seek access to and correction of CDR data that we hold about you; and
  • make a complaint about how we handle your CDR data. 

We'll provide a copy of this policy to you electronically or in hard copy at your request.

For more information about how we handle your personal information at NAB, please see our Privacy Policy.

What CDR data does NAB share?

This section applies to NAB as a data holder.

At the moment, the CDR applies to:

  • Required Data: information that we are legally required to share under CDR laws; and
  • Voluntary Data: other information that we may choose to share.

Required Data

We share the following types of Required Data 

  • Customer Data which includes your name, contact details and details you have provided to us and if you operate a business certain information about your business. 
  • Product Use Data which includes: 

(a) account data, such as your account number, account name, balances and authorisations (including direct debits, scheduled payments and payees); and

(b) transaction data, such as dates, description, counterparty information and amounts debited or credited for transactions. 

  • Product Data which includes data identifying or describing the characteristics of a product, such as terms and conditions, pricing, eligibility and key features. Some Product Data is public information, and is available via our Developer Portal, opens in new window in machine-readable format. 

We will update this policy if there is a change to the Required Data that we share.

Voluntary Data

NAB accepts requests for some types of voluntary Product Data. As NAB increases the breadth of products and services it provides, and as the CDR framework expands, NAB may accept requests from consumers to share some other types of Voluntary Data. If we offer access to Voluntary Data, we may charge a small fee to cover our costs when sharing the Voluntary Data, but we’ll always notify you of the fee before you commit to receiving the Voluntary Data and before the fee is charged. 

Accessing CDR data held by us

This section applies to NAB as a data holder.

Accessing your consumer data

You can access your consumer data held by NAB by providing an accredited data recipient with consent to collect the data via our online service. 

We will share your consumer data with an accredited data recipient if: 

  • you have provided your consent to share the data requested; 
  • a valid request has been made to us by the accredited data recipient; and
  • the sharing has been authorised by NAB,

unless there is a legal reason why we can’t do so. 

When we share your CDR data with an accredited data recipient, we will notify you by updating your consumer dashboard which is provided within your Internet Banking. The ‘data sharing permissions’ tab within your Internet Banking settings provides a list of the consents you have provided to accredited third parties to access your CDR data held by us. You can change or withdraw your consents on the ‘data sharing permissions’ tab. You can also change or withdraw your consents by going to the accredited data recipient’s website or app.

Accessing your CDR data that is also personal information

If you’re an individual, you may be able to access and correct personal information held by NAB that is also CDR data. Our Privacy Policy sets out further information on how to seek access to your personal information that we hold. We‘ll always give you access to your personal information unless there are certain legal reasons why we can’t. You can ask us to access your personal information that we hold by filling out the Personal Information Access form (PDF, 514KB), opens in new window. In some cases, we may be able to deal with your request over the phone or in a branch.

Sharing your CDR data with us

This section applies to NAB as an accredited data recipient.

We will collect your CDR data held by other data holders (with your consent) to provide you with products, services or features that you request.

We will only collect and use CDR data that is needed, and only for the specific time period required (or that you request), to provide you with the products, services and features you have requested from us. Products, services and features that we may use CDR data for include personalised insights and services to help you understand your CDR data, support you with your financial goals, or assist you with home loan or other product applications. 

In the future, we may introduce more products, services or features that require the use of CDR data – when this happens, we will update this policy with more information. 

What CDR data do we collect?

We may ask you to share a few types of CDR data with us which will vary depending on the product, service or feature we are offering. Examples of the types of CDR we may collect are in the table below: 

 

Data Category Examples
Personal information
  • Name
  • Email address
  • Phone number
  • Mail or residential address
  • Occupation
Account information
  • Name of account
  • Type of account
Account balances and details 
  • Account name, number and mail address
  • Type of account
  • Account balance
  • Interest rates
  • Discounts
  • Fees
  • Account terms
Transaction details
  • Incoming and outgoing transactions
  • Dates
  • Amounts
  • Descriptions of transactions
  • Who you have sent money to and received money from (name, BSB, account number)
Direct debits or scheduled transactions you have set up, or the names and details of accounts you have saved.  

We will update this policy if there is a change to the types of CDR data that we may collect on your behalf. Though we will be clear about the CDR data that we will collect on your behalf when we ask for your consent. 

How can you consent to us collecting your CDR data?

You can make a request and consent to share your CDR data with us by using the online dashboard that we provide you with. A link to this will be sent to you at the time you share your data with us. You can also make a request and consent to share your CDR data with us by going to your data holder’s website or app. We will tell you which consents we require and for which purposes.

You can give a consent for a single use or for use over a specified period of time. Single use will allow the transfer of information one time for a particular reason (e.g. an application for a home loan). Specified period use will allow us to receive your data regularly for a maximum period of 12 months.

You may amend or withdraw your consent at any time by using the online dashboard that we provide you with. A link to this will be sent to you at the time you share your data with us. You can also request that we stop collecting and using your CDR Data by going to your data holder’s website or app. However, without your consent we may not be able to offer or provide certain products, services or features to you that require access to your CDR data.

How will we handle your CDR data?

We will tell you the purpose for collecting your CDR data and how we intend to use, hold or disclose it when we ask for your consent. You do not need to be a NAB customer to share your CDR data with us. 

If you consent, we may use your de-identified CDR data for the purposes of research, analysis, product development and innovation (see the “When will we de-identify your CDR data” section below).

We encrypt your CDR data that we hold and store it safely in Australia. 

Our outsourced service providers

So that we can deliver better products, services and features to you, we sometimes use services from third parties called “outsourced service providers” (OSPs). 

We only use OSPs based in Australia who have entered into written agreements with us. They are not permitted to share or sell any CDR data we provide to them. They will delete your CDR data (and any data that is derived from your CDR data) once your consent expires or you withdraw your consent (unless they’re legally required or permitted to keep it).

We only use OSPs based in Australia who have entered into written agreements with us. They are not permitted to share or sell any CDR data we provide to them or that they collect on our behalf. They will delete your CDR data (and any data that is derived from your CDR data) once your consent expires or you withdraw your consent (unless they’re legally required or permitted to keep it).

See a list of our OSPs, including the sort of CDR data we disclose to them or they collect for us, the services they provide to us and whether they are accredited.

When we may send you notifications

We will notify you:

  • when you give consent for us to collect and use your CDR data;
  • when we collect your CDR data;
  • when you amend or withdraw consent;
  • when we are required to give ongoing notifications about your consent;
  • in the event of an eligible data breaches affecting your CDR data under the Notifiable Data Breach Scheme in the Privacy Act 1988 (Cth) where we are required to notify you in our capacity as a data holder, or an accredited data recipient; and
  • if our accreditation under the CDR laws is surrendered, suspended or revoked.

When will we delete your CDR data?

If you ask us to stop collecting and using your CDR data, if your consent expires and/or if the data becomes redundant, we’ll delete the CDR data we collected (and any data derived from it, including by our OSPs), unless we’re legally required or permitted to keep it or if you have consented to us using it in de-identified form (see below). 

See the section above entitled “How can you consent to us collecting your CDR data?” for information about how to manage your consents. 

When will we de-identify your CDR data?

If you consent, we may use your CDR data that we have de-identified for research such as analysis, product development and innovation, so that we can offer you better or more personalised products, services and features. We will obtain your consent if we intend to disclose your de-identified data to any third party.

We de-identify data by removing information that allows the data to be linked to you (e.g. your name, date of birth, address, account numbers, etc) or combined with other datasets to be linked to you. 

Correcting or amending your CDR data

This section applies to NAB as a data holder and an accredited data recipient.

How to correct or amend your CDR data

You have the right to correct any of your CDR data held by us if it is inaccurate, out-of-date, incomplete, irrelevant or contains misleading information. You can do this free of charge. 

Please contact us if you think there is something wrong with your CDR data we hold about you. We’ll acknowledge receipt of your request as soon as possible, investigate the issue and come back to you within 10 business days of receiving your request. 

For CDR data that we’ve collected for you as an accredited data recipient, we may need to refer you to the data holder to have the source data corrected. We can then collect the correct CDR data if we have your consent. 

If you are an individual, you also have the right to access and correct personal information NAB holds about you. Refer to our Privacy Policy for more information, and also the section above (“Accessing your CDR data that is also personal information”).

What if we don’t correct your CDR data?

If we don’t correct CDR data, we’ll provide reasons, which may be because we consider the CDR data to be accurate, up to date, complete and not misleading. If your concerns haven't been resolved to your satisfaction, you can lodge a complaint with us. Please see below on how to do this.

How can you make a complaint or report an issue?

This section applies to NAB as a data holder and an accredited data recipient.

If you have a complaint about how we handle your CDR data, we want to hear from you. To contact us, use the contact details set out below (see ‘Contact Us’). You are always welcome to get in touch.

When you make a complaint we ask that you provide us with certain details including your full name, preferred contact details and a short description of your complaint. We’ll acknowledge that we’ve received your complaint within five business days. We may also request further information to make sure we are able to promptly resolve your complaint. 

Once we’ve received your complaint (and any further information, if we have requested it from you) we will investigate your complaint. We’re committed to resolving your complaint and doing the right thing by our customers. Most complaints are resolved quickly.

If we can’t fix things within 30 days of your request to do so, we’ll let you know why and how long we think it will take. We will also ask you for an extension of time to fix the matter if this is the case.

The kind of resolution we provide will depend upon the nature of your issue or complaint, for example investigating and resolving concerns you may have in relation to your CDR data, or addressing issues with you accessing your CDR dashboard. In some circumstances we may ask you to choose from a number of options for how you’d like your complaint to be redressed.  

If you still feel your issue hasn’t been resolved to your satisfaction, then you can escalate your concern with the Australian Financial Complaints Authority (AFCA) or with the Office of the Australian Information Commissioner (OAIC). Their contact details are given below.

Contact us

We care about what you think. Please contact us if you have any questions or comments about this Policy. We welcome your feedback.

You can contact us by:

If you have contacted us by phone or in person and feel your issue still hasn’t been resolved, the next step is to contact our NAB Resolve team.

  • Call NAB Resolve, Monday to Friday, 8:00am to 7:00pm (AEST/AEDT) on 1800 152 015.
  • Go online: Complete our online feedback form, send us a secure message through your NAB Internet Banking, or email us at feedback@nab.com.au
  • Write to us: National Australia Bank, NAB Resolve, General Manager, Reply Paid 2870,  Melbourne, VIC, 8060

Contact details for escalating complaints

We are a member of the Australian Financial Complaints Authority (AFCA). You can contact AFCA or the Office of the Australian Information Commissioner as follows:

Australian Financial Complaints Authority (AFCA):

Australian Information Commissioner (OAIC):

Changes to this policy

This policy may change from time to time, so please visit this page regularly for the most up-to-date version. You can also ask us to send you a copy of the latest version. 

Important information