Updated @May 1, 2024
These guidelines provide examples for how to implement the data recipient consumer dashboards related to disclosure consents.
On this page
Overview
This page includes consumer dashboard scenarios where the data recipient discloses data to specified persons, who may or may not be accredited. The consumer dashboard allows a consumer to review and manage their consents. In consumer-facing designs, ‘consents’ are sometimes referred to as sharing arrangements.
For guidance about where a consumer could use their dashboard to manage their collection and use consents, see
Wireframes and guidelines
Accredited persons disclosure consents
The following wireframes show examples of the data recipient consumer dashboard, when CDR data has been disclosed from one accredited person to other accredited person(s) for an ongoing basis.
Wireframe ref | Type | Requirement level | Statement | Reference | Checklist ref | Focus area |
---|---|---|---|---|---|---|
01 | CDR Rule | MUST | (1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:
(a) can be used by the CDR consumer to manage:
(i) such requests; and
(ii) associated consents; and
(b) contains the details of each consent specified in subrule (3) and the information specified in subrule (3A); | CDR Rule 1.14(1)(a)(b) | 4CM1.01.01 | |
02 | CDR Rule | MUST | (2) Such a service is the accredited person’s consumer dashboard for that consumer. | CDR Rule 1.14(2) | 4CM1.01.02 | |
03 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(g) if the consent is not current—when it expired; | CDR Rule 1.14(3)(g) | 4CM1.01.03 | |
04 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(c) when the CDR consumer gave the consent; | CDR Rule 1.14(3)(c) | 4CM1.01.04 | |
05 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(f) if the consent is current—when it is scheduled to expire;
Note 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c). | CDR Rule 1.14(3)(f) | 4CM1.01.05 | |
06 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent: (e) if a collection consent or disclosure consent applies over a period of time:
(i) what that period is; and
(ii) how often data has been, and is expected to be, collected or disclosed over that period; | CDR Rule 1.14(3)(e) | 4CM1.01.06 | |
07 | CDR Rule | MUST | (5) A copy of the CDR receipt may be included in the CDR consumer’s consumer dashboard. | CDR Rule 4.18(5) | 4CM1.01.07 | |
08 | CDR Rule | MUST | (8) For paragraph 56ED(7)(b) of the Act, the CDR entity must make its CDR policy readily available through each online service by means of which the CDR entity, or a CDR representative of the CDR entity, ordinarily deals with CDR consumers.
(9) For subsection 56ED(8) of the Act, if a copy of the CDR entity’s policy is requested by a CDR consumer, the CDR entity must give the CDR consumer a copy:
(a) electronically; or
(b) in hard copy;
as directed by the consumer. | CDR Rule 7.2(8), (9) | 4CM1.01.08 | |
09 | CDR Rule | MUST | (1) Subject to subrule (5), an accredited person must provide each eligible CDR consumer on whose behalf the accredited person makes a consumer data request with an online service that:
(c) has a functionality that:
(i) allows a CDR consumer, at any time, to:
(A) withdraw current consents; and
(B) elect that redundant data be deleted in accordance with these rules and withdraw such an election; and
(ii) is simple and straightforward to use; and
(iii) is prominently displayed. | CDR Rule 1.14(1)(c) | 4CM1.01.09 | |
10 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following:
(a) details of the CDR data to which the consent relates; | CDR Rule 1.14(3)(a) | 4CM1.01.10 | |
11 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(h) information relating to CDR data that was collected or disclosed pursuant to the consent (see rules 7.4 and 7.9); | CDR Rule 1.14(3)(h) | 4CM1.01.11 | |
12 | CDR Rule | MUST | (2) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to an accredited person must, as soon as practicable, update each
consumer dashboard that relates to the request to indicate:
(a) what CDR data was disclosed; and
(b) when the CDR data was disclosed; and
(c) the accredited person, identified in accordance with any entry on the Register of Accredited Persons specified as being for that purpose. | CDR Rule 7.9(2) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 | 4CM1.01.12 | |
13 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(d) whether the consent applies:
(i) on a single occasion; or
(ii) over a period of time; | CDR Rule 1.14(3)(d) | 4CM1.01.13 | |
14 | CX Standard | MUST | In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:
1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from;
2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with.
Note:
• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s);
• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data;
• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified. | 4CM1.01.14 | ||
15 | CX Standard | MUST | If:
1. An accredited person is seeking a collection consent to collect CDR data from a particular accredited data recipient; or
2. An accredited data recipient is seeking a disclosure consent from a consumer to disclose CDR data;
and the data subject to the disclosure or collection is not within the data language standards as it does not relate to a relevant data cluster, then that data MUST be described in language that is as easy to understand as practicable. | 4CM1.01.15 | ||
16 | CX Guideline | MAY | Data recipients should prioritise information that is important to consumers. This may include using tabs (e.g. active, pending, archived), or presenting key details up front, such as when consent was granted. | 4CM1.01.16 | ||
17 | CX Guideline | MAY | Data recipients should allow consumers to search, sort, and filter their data sharing arrangements in a way that is aligned to the outcomes consumers are seeking.
For example, a consumer may want to sort by data recipient, data cluster, or by a user-defined tag. | 4CM1.01.17 | ||
18 | CX Guideline | MAY | Data recipients should organise disclosures to accredited persons using the brand and software product name. The logo held at the brand level should also be presented in relation to the consent to aid recognition and management. | 4CM1.01.18 | ||
19 | CX Guideline | MAY | Data recipients should surface the legal entity of the ADR being disclosed to for the AP Disclosure. | 4CM1.01.19 | ||
20 | CX Guideline | MAY | Data recipients should provide a link for consumers to verify a data recipient's accreditation via the CDR website. The following link could be used for this purpose: https://www.cdr.gov.au/find-a-provider | 4CM1.01.20 | ||
21 | CX Guideline | MAY | Data recipients should show the status of the consent, which may refer to it being 'active', 'cancelled', 'expired', or relating to a 'once-off’ instance of sharing. | 4CM1.01.21 | ||
22 | CX Guideline | MAY | Data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the data recipient for additional information. | 4CM1.01.22 | ||
23 | CX Guideline | MAY | Data recipients should prioritise information that is important to consumers and structure the presentation in a way that reduces cognitive overload.
This may include progressive disclosure design patterns (e.g. accordion menus), UX writing (e.g. microcopy), and visual aids (e.g. to display time-based qualities of consent). | 4CM1.01.23 | ||
24 | CX Guideline | MAY | Data recipients should allow consumers to download and/or request a copy of their CDR Receipt(s). | 4CM1.01.24 | ||
25 | CX Guideline | MAY | Consumers may be allowing a data recipient to collect, use, and disclosure their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.
Data recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.
If a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term. | 4CM1.01.25 | ||
26 | CX Guideline | MAY | The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards. | 4CM1.01.26 | ||
27 | CX Guideline | MAY | Privacy Safeguard 10
For ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure).
For single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure).
If a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.
Note 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance. | CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 | 4CM1.01.27 | |
28 | CX Guideline | MAY | Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent. | 4CM1.01.28 | ||
29 | CDR Rule | MAY | (2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:
(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and
(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);
that relates to the CDR consumer. | CDR Rule 9.5(2) | 4CM1.01.29 |
Note: Some interactions and screens have been omitted for simplicity.
Trusted adviser disclosure consents
The following wireframes show examples of the data recipient consumer dashboard, when data has been disclosed outside of the CDR system to a trusted adviser and when disclosure is once off.
Wireframe ref | Type | Requirement level | Statement | Reference | Checklist ref | Focus area |
---|---|---|---|---|---|---|
01 | CDR Rule | MUST | (3A) For paragraph (1)(b), the other information is:
(a) a statement that the CDR consumer is entitled to request further records in accordance with rule 9.5; and
(b) information about how to make such a request. | CDR Rule 1.14(3A) | 4CM1.04.01 | |
02 | CDR Rule | MAY | (2) A CDR consumer may request an accredited data recipient for copies of records relating to the information referred to in:
(a) paragraphs 9.3(2)(a), (b), (c), (d), (da), (e), (ea), (eb), (ec), (ed), (ee), (ef), (eg), (f) and (m); and
(b) paragraphs 9.3(2A)(d), (e), (f), (g), (ga), (h), (ha), (hb), (hc), (i) and (o);
that relates to the CDR consumer. | CDR Rule 9.5(2) | 4CM1.04.02 | |
03 | CDR Rule | MUST | (3) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to a trusted adviser must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:
(a) what CDR data was disclosed; and
(b) when the CDR data was disclosed; and
(c) the trusted adviser. | CDR Rule 7.9(3) | CDR Privacy Safeguard Guidelines: Privacy Safeguard 10 | 4CM1.04.03 | |
04 | CX Standard | MUST | In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:
1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from
2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with
Note:
• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s)
• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data
• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified | 4CM1.04.04 | ||
05 | CX Standard | MUST | Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. | 4CM1.04.05 | ||
06 | CX Guideline | MAY | Data recipients should organise consents by referring to the use case/purpose to aid consent management. | 4CM1.04.06 | ||
07 | CX Guideline | MAY | In addition to the CX standards requirements, data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the Trusted Adviser for more information. | 4CM1.04.07 | ||
08 | CX Guideline | MAY | Consumers may be allowing a data recipient to collect, use, and disclosure their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.
Data recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.
If a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term. | 4CM1.04.08 | ||
09 | CX Guideline | MAY | The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards. | 4CM1.04.09 | ||
10 | CX Guideline | MAY | Privacy Safeguard 10
For ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure).
For single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure).
If a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.
Note 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance. | CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 | 4CM1.04.10 | |
11 | CX Guideline | MAY | Privacy Safeguard 5
For ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection.
For single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection).
Note: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance. | CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 | 4CM1.04.11 | |
12 | CX Guideline | MAY | Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent. | 4CM1.04.12 |
Note: Some interactions and screens have been omitted for simplicity.
Business consumer disclosure consents
The following wireframes show examples of the data recipient consumer dashboard, when:
- a business consumer statement has been made;
- data has been disclosed outside of the CDR system;
- disclosure is on an ongoing basis.
Wireframe ref | Type | Requirement level | Statement | Reference | Checklist ref | Focus area |
---|---|---|---|---|---|---|
01 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(f) if the consent is current—when it is scheduled to expire;
Note 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c). | CDR Rule 1.14(3)(f), Note 1 | 4CM1.05.01 | |
02 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(eb) if a business consumer statement has been given in relation to the consent—that fact; | CDR Rule 1.14(3)(eb) | 4CM1.05.02 | |
03 | CDR Rule | MUST | (3A) For subsection 56EM(2) of the Act, an accredited data recipient that discloses CDR data to a person in accordance with a business consumer disclosure consent must, as soon as practicable, update each consumer dashboard that relates to the request to indicate:
(a) what CDR data was disclosed; and
(b) when the CDR data was disclosed; and
(c) the person to whom it was disclosed. | CDR Rule 7.9(3A) | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 | 4CM1.05.03 | |
04 | CX Standard | MUST | In the course of seeking a consumer’s consent to disclose data as part of a disclosure consent:
1. Data Recipients MUST specify which CDR Participant(s) they collected the associated CDR data from
2. Data Recipients SHOULD specify the sector(s) the data was collected from or associated with
Note:
• Point (1) only requires the Data Recipient to refer to the CDR Participant(s) immediately preceding them in the disclosure chain, which may not always include a consumer’s Data Holder(s)
• This standard is proposed to apply to all data to be disclosed by a Data Recipient, including unmodified, aggregated, derived, and transformed CDR data
• Where applicable, the existing data language standards apply to descriptions of CDR data that have not been modified | 4CM1.05.04 | ||
05 | CX Standard | MUST | Data recipients MUST provide the information contained in the disclosure notification otherwise than in the consent flow. This SHOULD be contained in the consumer’s CDR Receipt. This SHOULD also be accessible in the consumer dashboard as part of the data sharing arrangement details. | 4CM1.05.05 | ||
06 | CX Guideline | MAY | In addition to the CX standards requirements, data recipients should communicate that certain information may not be available on their consumer dashboard and should advise consumers to check with the non-AP for more information. | 4CM1.05.06 | ||
07 | CX Guideline | MAY | If a business consumer statement has been given, it should be clearly visible in the related consent arrangement on the consumer dashboard. | 4CM1.05.07 | ||
08 | CX Guideline | MAY | Consumers may be allowing a data recipient to collect, use, and disclosure their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.
Data recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.
If a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term. | 4CM1.05.08 | ||
09 | CX Guideline | MAY | Accredited persons should have processes in place to ensure that a CDR consumer continues to meet the business consumer criteria for the full period in which they are treated as a CDR business consumer. This may include monitoring the CDR business consumer’s ABN to ensure it remains active at regular intervals. | 4CM1.05.09 | ||
10 | CX Guideline | MAY | The details of CDR data associated with the disclosure consent should include the collection source, sector reference, and any other data descriptions presented to the consumer as outlined in the disclosure consent standards. | 4CM1.05.10 | ||
11 | CX Guideline | MAY | Privacy Safeguard 10
For ongoing data sharing: Data recipients may include the date range between which CDR data will be disclosed (dates of initial and final disclosure).
For single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was disclosed (date of initial disclosure).
If a data recipient is unsure of the date of final disclosure they may put the date consent expires. This date of final disclosure should be updated as soon as practicable after it becomes known.
Note 1: The example provided is context dependent. Please refer to Privacy Safeguard 10 for more guidance. | CDR Rule 7.9 | CDR Privacy Safeguards Guidelines: Privacy Safeguard 10 | 4CM1.05.11 | |
12 | CX Guideline | MAY | Privacy Safeguard 5
For ongoing data sharing: Data recipients may include the date range between which CDR data will be collected (dates of initial and final collection), as well as frequency of data collection.
For single or ‘once-off’ disclosure: Data recipients may include the date on which the CDR data was collected (date of initial collection).
Note: The example provided is context dependent. Please refer to Privacy Safeguard 5 for more guidance. | CDR Rule 7.4 | CDR Privacy Safeguard Guidelines: Privacy Safeguard 5 | 4CM1.05.12 | |
13 | CX Guideline | MAY | Data recipients should state the extent of historical data that was disclosed as part of the disclosure consent. | 4CM1.05.13 |
Note: Some interactions and screens have been omitted for simplicity.
Download open source asset
Open sources design assets are created in Figma for the purposes of assisting implementation. This Figma file contains annotated wireframes and working prototypes for Consent Management - Disclosure consents, including:
- Accredited persons disclosure consents
- Trusted adviser disclosure consents
- Business consumer disclosure consents
Item | File | Date released | Version introduced |
---|---|---|---|
May 1, 2024 | 1.30.0 |
For past versions, refer to
Open sources design assets are provided in the form of version-controlled Figma files. These assets contain the annotated wireframe and working prototype published on this page, and have been reviewed for accessibility compliance. Assets are partially conformant to Web Content Accessibility Guidelines (WCAG) 2.1 level AA. These assets do not tend to accessible code and instead focus on visual presentation and readability.
The assets use the GOLD Design System; component rationale, accessibility support, and code documentation is available in the GOLD Design System website.
For more details, see
References
These CX Guidelines were informed by consultations and research conducted in 2019 to 2022, including the following:
- Consultations
- DSB 2019, CX Workshop: Manage and withdraw
- DSB 2021, Decision Proposal 187 - CX Standards | Disclosure Consents
- DSB 2023, Decision Proposal 276 - July 2023 Rules | Standards Impacts
- DSB 2023, Decision Proposal 333 - Business Consumer Provisions
- CX research
- Tobias 2019, Phase 1 CX report
- GippsTech 2019, Phase 2, Stream 1 report
- Tobias 2019, Phase 2, Stream 3 report
- Other
- Nielsen Norman Group 2019, 10 Usability Heuristics for User Interface Design (Flexibility and efficiency of use)
- OAIC 2022, OAIC: Privacy Safeguard 5
- OAIC 2022, Privacy Safeguard 10
Quick links to CX Guidelines: