Consumer Data Right takes effect
The Consumer and Product Data Act 2025 (Act) was enacted on 29 March 2025.
The Act establishes a Consumer Data Right (CDR) framework in New Zealand, designed to:
- give customers (both individuals and entities) greater control over their data and allow for secure sharing between businesses;
- promote innovation and competition; and
- facilitate secure, efficient and standardised data sharing.
What is the consumer data right?
The CDR gives customers the right to control who can access and use their data. It enables the secure and efficient sharing of standardised customer and product data between accredited entities in designated sectors, but only at the customer’s request.
With this increased control, it is easier for customers to make informed decisions about how and where they use their data.
A few examples of how CDR could be used include:
- A consumer could ask their bank to share transaction and product data with a third-party budgeting app to improve spending insights and financial advice.
- A consumer could ask their energy provider to share their usage data with another provider to compare plans.
- A consumer could switch banks more easily by requesting their new bank to obtain relevant data from their current bank.
Who does the Act apply to?
The Act provides a framework and will be implemented one sector at a time through a designation process. Customers will be able to access CDR-related services only once sector-specific regulations are in place.
The banking and electricity sectors have been identified as priorities due to the large volumes of customer data they manage and the potential benefits of improved data sharing in these industries.
The banking sector is set to be the first designated sector under the new regime. The electricity sector is expected to follow, with telecommunications and insurance likely to be included later.
The Act categorises entities within designated sectors based on their role in the CDR framework:
- Data Holders (e.g. Banks and electricity companies): These are organisations that collect, store and manage customer and product data. They are required to provide customer data to either the customer or an accredited requestor on request.
- Accredited Requestors (e.g. Fintechs): These are businesses accredited to request and receive customer data from Data Holders. Accreditation ensures that they meet strict data security and privacy standards.
Next Steps
With the Act now in place, sector-specific regulations will be rolled out.
Banking sector regulations are undergoing industry consultation and are proposed to commence on 1 December 2025. Minister Scott Thompson (Commerce and Consumer Affairs) has committed to make open banking fully operational by the end of the year.
Once regulations are issued, the four major banks (ASB, ANZ, BNZ, and Westpac) are expected to be designated as Data Holders, with Kiwibank to follow in 2026.
Regulations for the electricity sector, if designated, are proposed to roll out in 2026.
What this means for businesses?
All businesses intending to become “accredited requesters” or “data holders” under the new regime, should start preparing for compliance now by familiarising themselves with the requirements of the Act.
While sector-specific regulations are yet to be finalised, businesses can expect they will need to have appropriate security measures in place to protect customer data.
To maximise the opportunities under the CDR regime, businesses, particularly those in the banking and electricity sectors, should start aligning their policies and systems with the framework in anticipation of regulatory requirements.
If you have any questions about what the CDR means for your organisation, please feel free to get in touch with Amy Douglas, Ron Arieli or Matt Yates.
This article was co-authored by Ayokunle Adeyinka, a graduate in our Corporate/Commercial team.
Disclaimer: The content of this article is general in nature and not intended as a substitute for specific professional advice on any matter and should not be relied upon for that purpose.