Consumer Data Right expansion, data portability is coming to lending
CDR is expanding into non-bank lending from mid-2026. The competitive dynamics of financial services marketing change when customer switching friction drops.
The Consumer Data Right is expanding into non-bank lending. Product data sharing obligations commence 13 July 2026. Consumer data sharing obligations follow from 9 November 2026. Buy Now, Pay Later products are included. The data retention period drops from seven years to two.
This is not a marketing regulation. It is a data infrastructure regulation with direct implications for how financial services marketing operates.
What CDR expansion means
CDR gives consumers the right to direct their financial data to be shared with accredited third parties. The expansion to non-bank lending brings a significant volume of new data, including BNPL transactions, into a structured, consent-based sharing framework.
The rules were amended on 4 March 2025. The rollout follows a phased timeline (product data first, consumer data second), with large providers facing earlier deadlines.
Two implications for marketing
Competitive dynamics shift. When customers can port their data between institutions in a few clicks, acquisition and retention strategies have to account for lower switching friction. The value proposition has to be strong enough that customers choose to stay, not strong enough to lock them in by data inertia. Marketing economics change when the switching cost drops, and CAC/LTV models built on the old assumptions stop holding.
CDR establishes a precedent. The infrastructure being built (consent-based, machine-readable, regulated data sharing) is a model that may extend beyond financial services. Organisations in other sectors should be watching CDR not as a financial services issue but as an early signal of how data portability will work across the economy.
What to do
For financial services organisations, assess the compliance timeline, understand which products are in scope, and model the impact of customer data portability on your acquisition and retention economics. The data sharing obligations are fixed dates with no ambiguity (and IMO no realistic prospect of further delay).
For organisations outside financial services, watch CDR as a leading indicator. The consent infrastructure and data sharing protocols being developed here will likely inform regulation in other sectors. Energy is next in the rollout pipeline; telco is on the policy horizon.