Meet your data retention obligations

In Australia (CDR), if your product operates under Fiskil's accreditation as a CDR representative, you have specific obligations around how you store, secure, and delete consumer data. This page summarises the key points.

How long you can store CDR data

Retention is bounded by the duration of the active consent. You may store consumer data only for as long as the consumer has an active consent arrangement. Once a consent expires or is revoked, you must promptly delete all CDR data received under it — you cannot retain transaction history or other CDR data beyond the consent period.

What must be deleted

On consent withdrawal or expiry, deletion covers:

• Raw data returned from the Data API
• Copies stored in your own databases or data warehouses
• Derived or transformed data created from CDR data (for example, enriched transactions or aggregations)
• Backups containing CDR data

Derived records — spending categorisations, budget summaries, reward triggers — remain CDR data and carry the same deletion obligations. The exception is outcome records that are sufficiently de-identified and no longer traceable to the original data; discuss with Fiskil before relying on this exception.

Cryptographic deletion: destroying per-consumer encryption keys so that all copies (including backups) become unreadable is generally accepted as satisfying the deletion obligation, provided you retain evidence that the keys were destroyed and can demonstrate it to Fiskil on request.

Security requirements while data is held

Under Schedule 2 of the CDR Rules, you must apply these controls for the full period data is held, up to and including deletion:

• Encryption at rest — AES-256 or an equivalent industry standard, across databases, file systems, backups, and portable media.
• Encryption in transit — TLS 1.2 or later (TLS 1.3 preferred) for all transmissions, internal and external. Unencrypted HTTP is not acceptable.
• Access controls — multi-factor authentication for personnel accessing CDR data.
• Logging — critical access events, administrative actions, exports, and security events must be logged, protected against alteration, and regularly reviewed.
• Environment isolation — CDR data segregated from other customer data and masked before use in non-production environments.

Triggering deletion from consent events

When a consent expires or is revoked, Fiskil fires the consent.revoked webhook event. Use it to trigger your deletion workflow:

1. Subscribe to consent events — see the webhooks guide.
2. On consent.revoked, start deletion of all data held under that consent ID.
3. If you need to confirm a consent's status, look it up via the API using the consent ID.