Who must comply with CDR Energy sector — phased?

Energy retailers + distributors must share data via CDR.

The Consumer Data Right (Energy Sector) Designation 2020 brings energy data in the National Electricity Market into the CDR, so a consumer can direct their electricity retailer to share their data with an accredited data recipient such as a comparison service. Product data sharing (electricity, gas and dual fuel plans) began on 1 October 2022 and consumer data sharing on 15 November 2022. The retailer is the primary data holder for customer, account, billing and tailored tariff data; AEMO is a secondary data holder for metering, National Metering Identifier standing data and distributed energy resources register data; the AER and the Victorian government are designated holders of product data. Obligations under Part 4 of the CDR Rules were phased in by retailer size, with later dates for complex requests made for large customers, secondary users or joint accounts.

Applies only if you are a designated CDR data holder for energy (the phase that covers your retailer tier has commenced). Whether it applies turns on a fact that no industry, structure or size settles on its own.

How the regulator frames it: Authorised or licensed electricity retailers operating in the NEM that had 10,000 or more small customers on 16 November 2021, or at all times during a later financial year (larger retailers keep that status even if numbers fall). The initial retailers named in the Rules are the AGL, Origin Energy and EnergyAustralia groups. Retailers below 10,000 small customers have no data holder obligations unless they become accredited data recipients or opt in voluntarily.

What triggers it: Retailing electricity to NEM connection points and crossing the 10,000 small customer threshold, becoming an accredited data recipient, or electing to participate as a data holder.

Threshold: 10,000 or more small customers (larger retailer).

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a trigger outside this questionnaire.

The engine shows this obligation as "check whether this applies" when a business has energy retailing. It then applies only if you are a designated CDR data holder for energy (the phase that covers your retailer tier has commenced). That fact is not something Rules Mate can infer from industry, structure or size.

When due

Initial retailers: non-complex requests from 15 November 2022, complex from 15 May 2023. Larger retailers: 1 November 2023 and 1 May 2024. Accredited small retailers: 12 months after accreditation for non-complex requests and 18 months for complex requests. Data holders report to the ACCC and OAIC twice a year.

Frequency

Ongoing

Evidence to keep

Product data and consumer data request endpoints passing the Conformance Test Suite; CDR policy prepared under OAIC guidance; consent, IT, security and privacy safeguard procedures; twice-yearly reports in the approved format counting product data requests, consumer data requests and refusals with the rule or standard relied on; records supporting each refusal.

Status

Current

Priority

High

Maximum penalty: The ACCC and OAIC jointly monitor compliance and may take enforcement action under their joint CDR Compliance and Enforcement Policy. The CDR is established under the Competition and Consumer Act 2010; penalty amounts were not restated here.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• Major banks must provide CDR Banking + Action Initiation (2026): CDR Action Initiation lets accredited recipients initiate payments + actions on consumer behalf.
• Comply with CDR Banking (Open Banking) — major + non-major ADIs: Banking data holders must share consumer data with accredited recipients on consumer consent.

Rules Mate tracks 4 published obligations tagged "cdr", 1 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Australian Competition and Consumer Commission and Office of the Australian Information Commissioner.

ACCC: Competition and consumer regulator administering the Competition and Consumer Act 2010 and Australian Consumer Law, plus industry codes and infrastructure access regimes.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Australian Competition and Consumer Commission
• Office of the Australian Information Commissioner

CCA: Australia's competition + consumer protection law.

• Competition and Consumer Act 2010

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)