CDR nominated representatives (Australia)

What a nominated representative is under the Consumer Data Right, when one is required, and how businesses appoint one.

Under Australia's Consumer Data Right (CDR), a nominated representative is an individual authorised to manage and share CDR data on behalf of a non-individual account holder — a company, trust, or partnership. Some institutions call this role a delegate or authorised user for data sharing, but the function is the same: until one is in place, the business's accounts can't be shared.

When one is required

Whenever the account holder is a business entity rather than a person. Sole traders sharing accounts held in their own name generally don't need one, but accounts held by a company, trust, or partnership almost always do. If a user authenticates at their institution and sees no business accounts (or a "no eligible accounts" message), a missing nominated representative is the most common cause.

Who can appoint one

Someone with existing authority over the business's banking or energy account — typically a director, account owner, administrator of the online banking facility, or an authorised signatory. The appointed representative can be anyone the business chooses, including someone outside the business (see Preparing your business customers).

How appointment works

The route varies by institution:

  • Online or in-app — some banks let an administrator flag a user for data sharing directly in online banking (for example Westpac and ANZ).
  • Paper or digital form — others require a signed form submitted by email, post, or at a branch (for example NAB, Macquarie Bank, and ING Australia).
  • Phone or branch — some institutions, and most energy retailers, handle the appointment through their contact centre or a relationship manager.

Timeframes range from immediate (online routes) to several business days (form-based routes — Macquarie, for instance, quotes up to five business days).

After the appointment

Once the institution has processed the appointment, the nominated representative can authenticate in the consent flow and approve data sharing for the business's accounts, just as an individual does for personal accounts.

One appointment, many consents

The appointment is made once per business per institution. After that, the representative can create, renew, and revoke consents without repeating the setup.