Consumer Data Right expansion, data portability is coming to lending

The Consumer Data Right is expanding into non-bank lending. Product data sharing obligations commence 13 July 2026. Consumer data sharing obligations follow from 9 November 2026 for initial providers and 10 May 2027 for large providers, under the published sector timetable. Buy Now, Pay Later products are included. The historical window for specified data to be shared is reduced to two years; this is not a blanket two-year retention rule for every record.

This is not a marketing regulation. It is a data infrastructure regulation with direct implications for how financial services marketing operates.

What CDR expansion means

CDR gives consumers the right to direct their financial data to be shared with accredited third parties. The expansion to non-bank lending brings a significant volume of new data, including BNPL transactions, into a structured, consent-based sharing framework.

The rules were amended on 4 March 2025. The rollout follows a phased timeline (product data first, consumer data second), with deadlines depending on the provider cohort.

Two implications for marketing

Competitive dynamics shift. When customers can port their data between institutions in a few clicks, acquisition and retention strategies have to account for lower switching friction. The value proposition has to be strong enough that customers choose to stay, not strong enough to lock them in by data inertia. Marketing economics change when the switching cost drops, and CAC/LTV models built on the old assumptions stop holding.

CDR establishes a precedent. The infrastructure being built (consent-based, machine-readable, regulated data sharing) is a model that may extend beyond financial services. Organisations in other sectors should be watching CDR not as a financial services issue but as an early signal of how data portability will work across the economy.

What to do

For financial services organisations, assess the compliance timeline, understand which products are in scope, and model the impact of customer data portability on your acquisition and retention economics. The data sharing obligations are fixed dates with no ambiguity (and IMO no realistic prospect of further delay).

For organisations outside financial services, watch CDR as a leading indicator. The consent infrastructure and data sharing protocols being developed here will likely inform regulation in other sectors. Energy data sharing began in November 2022. Further sector expansion remains a policy question.