FAQs
We are here to help.
Get CDR-ready with Biza
Find Your Answers Here
All About Biza
-
What does Biza do?
Biza helps organisations navigate, comply and innovate within the CDR ecosystem. We build and deliver the technology, tools and expertise that make it simple for both Data Holders (like banks, energy providers and non-bank lenders) and Accredited Data Recipients (ADRs) (such as budgeting applications or utility comparison sites) to participate in the CDR safely and effectively.
As Australia’s premier CDR solutions provider, Biza offers a suite of fully managed CDR-compliant platforms designed for Data Holders and Data Recipients. Our products include:
-
Holder as a Service (HaaS) - A cloud-native Data Holder platform that delivers all required CDR APIs, consumer consent flows, dashboards, compliance reporting and security controls.
-
Open Gateway (OG) - A fully managed Data Recipient solution providing accredited data access, consent management, notifications, and branded dashboards.
-
Product Manager (PM) - A powerful tool for publishing and maintaining Product Reference Data, including bulk updates, multi-brand support, scheduling, and administrative APIs.
-
Verification Test Suite (VTS) - An automated end-to-end testing and conformance platform that simulates the CDR ecosystem and validates API behaviour, data quality, and consent flows in both non-production and production environments.
-
-
Why Biza and what sets us apart from competitors?
We have several unmatched differentiators that set us apart from our competitors:
-
Unmatched CDR Expertise: Since our inception in 2017, Biza has activated, and continues to support, more CDR participants than any other provider. We deliver unrivalled experience and reliability and are trusted by Australia’s leading banks, energy providers, and non-bank lenders. We stand behind our solution with enforceable warranties for Data Standards compliance, unlimited liability coverage for Privacy Act breaches, and CDR-specific cyber insurance protections - all unmatched by competitors.
-
Dual Ecosystem Participants: Biza is uniquely positioned as both a Data Holder and Data Recipient delivery partner. This dual role enables us to introduce advanced functionality through bi-lateral agreements and deliver seamless interoperability across the CDR ecosystem.
-
Relentless Innovation: As pure-play CDR specialists, we are passionate data geeks who constantly push boundaries to deliver practical, future-ready solutions that help businesses turn visionary ideas into real business advantage and empowered consumers. Biza is the only participant actively building beyond compliance, contributing to the evolution of CDR standards and future-proofing our clients.We offer flexible incentives and a transparent, scalable pricing model.
In short, Biza doesn’t just help businesses comply with the CDR, we help them turn data sharing into competitive advantage, unlocking new products, better customer experiences, and real innovation across the financial and energy sectors.
-
-
What is Biza’s role in the Consumer Data Right ecosystem?
Biza is a pure-play vendor with deep involvement in Australia’s regulatory and standards landscape. Our leadership team actively contributes to the development of the CDR standards and participates in key industry working groups. Our founder and CEO, Stuart Low, is one of the most prolific non-government contributors to the CDR standards, our Principal Engineer Ben Kolera helped author the original technical standards, and our COO Jessica Booth is the only vendor representative on the Data Standards Advisory Committee.
Further, our dual experience as both a Data Holder and Data Recipient delivery partner allows Biza to go beyond baseline compliance and drive meaningful innovation across the CDR ecosystem for the mutual benefit of Data Holders, Data Recipients and consumers.
-
How does Biza ensure our solutions are compliant with ACCC and Data Standards Body guidelines?
All Biza’s products and services are developed, implemented, and delivered in accordance with the CDR rules, standards and guidelines. It is crucial to note that ambiguities exist between the Standards, Rules and Guidelines, and both achieving and maintaining compliance if often complex. The Australian Government has provided guidance on the priority (highest to lowest) order as follows:
-
The Acts and Designation Instruments:
-
Competition and Consumer Act 2010 (Section 56) including CDR Privacy Safeguard
-
Privacy Act 1988
-
Consumer Data Right (Authorised Deposit-Taking Institutions) Designation 2019
-
Consumer Data Right (Energy Sector) Designation 2020
-
Consumer Data Right (Telecommunications Sector) Designation 2022
-
Consumer Data Right (Non-Bank Lenders) Designation 2022
-
-
Rules
-
Competition and Consumer (Consumer Data Right) Rules 2020
-
-
Standards:
-
Consumer Data Standards
-
Consumer Experience Standards
-
FAPI 1.0
-
OAUTH2 and many other IETF RFCs
-
-
Guidelines
-
Consumer Experience Guidelines
-
Biza designs, implements and operates its products and services in accordance with the CDR Rules and Standards, however Data Holders retain and cannot transfer their responsibilities to a third party.
-
-
What implementation experience does Biza have?
We are Australia’s largest independent, pure-play CDR provider for Data Holders, with a proven track record of solution delivery across banking, energy, and a rapidly growing portfolio in non-bank lending. Since 2020, Biza has delivered over 30 Data Holder implementations, with additional lenders in pre-production. Our experience spans the entire spectrum of CDR implementation complexity – from Australia's largest Energy retailers, Tier 1 mutual banks, and regional institutions, to specialist lenders and new market entrants.
General CDR FAQs
-
What is the CDR?
The Consumer Data Right is a legal framework introduced by the Australian government in 2019 to digitally transform the economy. It allows consumers, both individuals and businesses, to securely access and share their data which is held by Data Holders (e.g., financial institutions and utility providers) with accredited third parties (e.g., budgeting apps and comparison sites) to find better deals. The CDR has been rolled out sector-by-sector, starting with banking and energy. It enables greater consumer control, privacy, and competition through opt-in consent and secure data transfer.
Take the example of Michaela, a Melbourne based homeowner with rooftop solar, who was frustrated with her energy bills despite her panels. She downloaded the accredited data recipient Automised Energy app, logged in via the CDR, and granted 90 days of secure consent for her usage data to be pulled directly from her current electricity provider—no meters or manual uploads needed.
The Automised app instantly compared her solar generation patterns against 40+ plans, identifying a competitors solar-optimised tariff that cut her net bill by $420 per year through better export rates and off-peak imports.
This showcases the CDR-powered value of an accredited data recipient for an every day consumer: real-time, personalised energy plan matching for solar households, leveraging live data to drive competition as CDR intended since the rollout of energy.
-
Who are Data Holders and Data Recipients?
Data holders are organisations in government-designated sectors (e.g., banks, energy retailers and non-bank lenders) that hold consumer data and must share it upon consumer request.
A data holder is an organisation that is required to share consumer data under the CDR. An organisation is considered a data holder if it:
-
Operates in a sector mandated to participate by the Australian government
-
Holds consumer data that falls within the scope of the legislation, and
-
Is legally required to share that data when a consumer makes a valid CDR request.
An official list of data holders can be found here.
An accredited data recipient is an organisation that has been accredited by the ACCC to receive a consumer’s data from a CDR data holder after the consumer has given their explicit consent. ADRs can use that data for the specific purpose the consumer selected, such as product comparisons and budgeting, and must follow strict CDR privacy and security rules.
Data holders under the CDR can choose to become accredited data recipients, allowing them to access CDR data themselves.
An official list of ADRs can be found here.
-
-
What sectors are covered?
The CDR is being rolled out in stages:
-
Banking and energy are already active
-
Non-bank lenders are scheduled to come under the regime in phases, starting in 2026.
-
-
Who enforces the CDR?
-
What types of data can be shared under the CDR?
There are 2 key categories of CDR data:
-
Product Reference Data (PRD) - public details about products (e.g., fees, features, and terms)
-
Personal consumer data - information that is tied to you or your business, such as:
-
Customer data
-
Individual consumer: name, occupation, contact details
-
Business consumer: organisation profile, organisation contact details
-
-
Account data
-
account name and type
-
account numbers and features (e.g., fees, interest rates, account terms)
-
account balance and details
-
-
Transaction data
-
Transaction details (e.g., incoming and outgoing transactions, dates, etc.)
-
-
-
Who can share data under the CDR?
Consumers are eligible for sharing data within the context of the CDR if they are:
-
Individuals over the age of 18
-
Businesses and non-individuals (i.e., companies, partnerships and trusts)
-
Trusted advisors (i.e., professionals such as accountants and financial planners).
-
-
What is Open Banking?
Open Banking is how the CDR applies to the banking sector. It enables banking data to be shared securely through the CDR ecosystem.
As banking was the first industry to adopt the CDR, the terms Open Banking and Consumer Data Right are sometimes used interchangeably. However, Open Banking is just one part of the CDR framework.
-
What’s the difference between CDR and open data?
CDR data is expressly shared under Australia’s CDR framework. It applies to the specific sectors like banking, energy and non-bank lenders, and can only be shared when a consumer or eligible business gives explicit consent. This data is held by a data holder and shared with an accredited data recipient for agreed purposes.
Open data is data that is made publicly available for anyone to use and access. It is typically published using open standards and common technologies, and can include things such as transport timetables, climate data and public statistics. Open data does not require individual consent for sharing and is usually released under licenses that allow free reuse.
-
What are reciprocal data holders?
A reciprocal data holder is an accredited data recipient that also becomes a data holder for CDR data it generates and keeps itself. In other words, if a business that is approved to receive CDR data also holds its own CDR-relevant customer data (e.g., because it offers a bank-like product to consumers), it may be treated as a data holder and have to share that data in the same way other data holders do when the consumer requests it.
-
Where can I find official information about the CDR?
For authoritative guidance and detailed regulatory and technical information, you can visit:
-
What is action initiation in the CDR?
Action initiation is an upcoming extension of the CDR that goes beyond just securely sharing data. It will let a consumer authorise an accredited provider to initiate action on their behalf – for example, making a payment, switching to a new provider, and opening and closing accounts – all via the CDR framework.
Today’s CDR supports read-only access. With action initiation (sometimes called “write-access”), a consumer can give a third party permission to send instructions to a data holder, and the data holder must carry out those instructions as if the consumer gave them directly.
Can't find what you're looking for?
Reach out to us today