Updated @March 6, 2024
These guidelines provide examples for how to implement the data recipient withdrawal process.
On this page
Overview
The withdrawal journey for a consumer contains several steps, including:
- Identifying a data sharing arrangement they wish to withdraw
- Reviewing the implications and confirming withdrawal
- Receiving a final notification of success
The consumer must be able to review their data sharing arrangement from the consumer dashboard.
The consumer will be advised of potential consequences of withdrawal before they stop sharing. This should nudge the consumer to review how withdrawal may impact their service and the handling of their data.
The consumer may receive confirmation that they have successfully withdrawn their consent, and be provided with an updated view of their expired consent on their dashboard.
Wireframes and guidelines
Default example
The following wireframes show a basic example of the consent withdrawal process. Variations can be found in the below sections.
Wireframe ref | Type | Requirement level | Statement | Reference | Checklist ref | Focus area |
---|---|---|---|---|---|---|
01 | CDR Rule | MAY | (1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:
(a) by using the accredited person’s consumer dashboard; | CDR Rule 4.13(1)(a) | 4CM2.00.01 | |
02 | CDR Rule | MUST | (3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant. | CDR Rule 4.13(3) | 4CM2.00.02 | |
04 | CDR Rule | MUST | (1) An accredited person must give the CDR consumer a notice that complies with this rule (a CDR receipt) as soon as practicable after:
(b) the CDR consumer withdraws such a consent in accordance with rule 4.13 | CDR Rule 4.18(1)(b) | CX Research 20 | 4CM2.00.04 | |
05 | CDR Rule | MUST | (2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:
(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and
(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and
(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and
(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11). | CDR Rule 4.18(2) | CX Research 20 | 4CM2.00.05 | |
06 | CDR Rule | MUST | (3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired. | CDR Rule 4.18(3) | CX Research 20 | 4CM2.00.06 | |
07 | CDR Rule | MUST | (4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard. | CDR Rule 4.18(4) | CX Research 20 | 4CM2.00.07 | |
08 | CDR Rule | MUST | (1) A consent given under this Division expires at the earliest of the following:
(a) if the consent is withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following:
(i) when the accredited person gave effect to the withdrawal;
(ii) 2 business days after the accredited person received the communication;
(b) if the consent is withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn; | CDR Rule 4.14(1)(a), (b) | 4CM2.00.08 | |
09 | CDR Rule | MUST | (1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes.
(2) Where a CDR representative provides the consumer dashboard on behalf of a CDR representative principal (see subrule 1.14(5)), the CDR representative principal may arrange for the CDR representative to update the consumer dashboard on the CDR representative principal’s behalf. | CDR Rule 4.19 | 4CM2.00.09 | |
10 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(f) if the consent is current—when it is scheduled to expire;
(g) if the consent is not current—when it expired;
Note 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c). | CDR Rule 1.14(3)(f), (g) | 4CM2.00.10 | |
11 | CX Guideline | MAY | Consumers may be allowing a data recipient to collect, use, and disclosure their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.
Data recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.
If a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term. | 4CM2.00.11 | ||
12 | CX Guideline | MAY | Data recipients should include information on consequences of withdrawal during the consent withdrawal process. Refer to CDR ule 7.2(4) and 4.11(3)(g)(iii). | 4CM2.00.12 | ||
13 | CX Guideline | MAY | Data recipients should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences. | 4CM2.00.13 | ||
14 | CX Guideline | MAY | Data recipients should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place. | 4CM2.00.14 | ||
15 | CX Guideline | MAY | When a consent is withdrawn, data recipients should notify the consumer:
• Of the status of their consent, including the updated duration and withdrawal date;
• That the data recipient is no longer collecting, using, and/or disclosing their data (depending on the type of consent withdrawn);
• Of how their redundant data will be handled, and when this will come into effect if it will not be immediate (such as when the data will need to be held for legal reasons). | 4CM2.00.15 | ||
16 | CX Guideline | MAY | Data recipients can refer to accounts using recognised nicknames, icons, account numbers, and account type. They can also include any known information on other elements the account may refer to such as any related plans, services, properties, numbers, and products. | 4CM2.00.16 | ||
17 | CDR Rule | MUST | (2) An accredited data recipient must keep and maintain records that record and explain the following:
(b) amendments to or withdrawals of consents by CDR consumers | CDR Rule 9.3(2)(b) | 4CM2.00.17 | |
18 | CX Guideline | MAY | Data recipients are expected to record how the withdrawal was requested by the consumer in relation to CDR Rule 9.3(2)(b), but the rules do not require the method of withdrawal to be shown on the dashboard.
However, data recipients may wish to do this on the dashboard and/or in any CDR Receipt they choose to provide. | 4CM2.00.18 | ||
19 | CDR Rule | MUST | (1) This rule applies if:
(a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and
(b) the request has not been completely resolved; and
(c) the consent expires for any reason.
(2) The accredited person must notify:
(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and
(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired. | CDR Rule 4.18AA | 4CM2.00.19 |
Note: Some interactions and screens have been omitted for simplicity.
AP Disclosure consent withdrawal
The following wireframes show examples of the AP disclosure consent withdrawal process.
Wireframe ref | Type | Requirement level | Statement | Reference | Checklist ref | Focus area |
---|---|---|---|---|---|---|
01 | CDR Rule | MAY | (1) A CDR consumer who has given a consent to an accredited person for the purposes of this Division may withdraw the consent at any time:
(a) by using the accredited person’s consumer dashboard; | CDR Rule 4.13(1)(a) | 4CM2.01.01 | |
02 | CDR Rule | MUST | (3) Withdrawal of a consent does not affect an election under rule 4.16 that the CDR consumer’s collected CDR data be deleted once it becomes redundant. | CDR Rule 4.13(3) | 4CM2.01.02 | |
04 | CDR Rule | MUST | (4) If:
(a) an accredited person has a collection consent given under this Division to collect particular CDR data from a particular accredited data recipient; and
(b) the accredited data recipient has an AP disclosure consent to disclose that CDR data to that accredited person;
then if one of those consents expires, the other expires when the accredited person or accredited data recipient is notified of the first‑mentioned expiry.
Note: The notification is required by rule 4.18B. | CDR Rule 4.14(4) | 4CM2.01.04 | |
05 | CDR Rule | MUST | (1) An accredited person must give the CDR consumer a notice that complies with this rule (a CDR receipt) as soon as practicable after:
(b) the CDR consumer withdraws such a consent in accordance with rule 4.13 | CDR Rule 4.18(1)(b) | CX Research 20 | 4CM2.01.05 | |
06 | CDR Rule | MUST | (2) A CDR receipt given for the purposes of paragraph (1)(a) must set out:
(a) the details that relate to the consent that are listed in paragraphs 1.14(3)(a) to (f); and
(b) in the case of a collection consent―the name of each CDR participant the CDR consumer has consented to the collection of CDR data from; and
(ba) in the case of a disclosure consent―the name of the person the CDR consumer has consented to the disclosure of CDR data to; and
(c) any other information the accredited person provided to the CDR consumer when obtaining the consent (see rule 4.11). | CDR Rule 4.18(2) | CX Research 20 | 4CM2.01.06 | |
07 | CDR Rule | MUST | (3) A CDR receipt given for the purposes of paragraph (1)(b) must set out when the consent expired. | CDR Rule 4.18(3) | CX Research 20 | 4CM2.01.07 | |
08 | CDR Rule | MUST | (4) A CDR receipt must be given in writing otherwise than through the CDR consumer’s consumer dashboard. | CDR Rule 4.18(4) | CX Research 20 | 4CM2.01.08 | |
09 | CDR Rule | MUST | (1) A consent given under this Division expires at the earliest of the following:
(a) if the consent is withdrawn in accordance with paragraph 4.13(1)(b)―the earlier of the following:
(i) when the accredited person gave effect to the withdrawal;
(ii) 2 business days after the accredited person received the communication;
(b) if the consent is withdrawn in accordance with paragraph 4.13(1)(a)―when the consent was withdrawn; | CDR Rule 4.14(1)(a), (b) | 4CM2.01.09 | |
10 | CDR Rule | MUST | (1) An accredited person must update a CDR consumer’s consumer dashboard as soon as practicable after the information required to be contained on the dashboard changes. | CDR Rule 4.19(1) | 4CM2.01.10 | |
11 | CDR Rule | MUST | (3) For paragraph (1)(b), the information is the following for each consent:
(f) if the consent is current—when it is scheduled to expire;
(g) if the consent is not current—when it expired;
Note 1: For paragraph (f), consents expire at the latest 12 months (or 7 years for certain consents by a CDR business consumer) after they are given or, in some circumstances, amended: see paragraph 4.14(1)(c). | CDR Rule 1.14(3)(f), (g) | 4CM2.01.11 | |
12 | CX Standard | MUST | As part of the disclosure consent withdrawal process, Data Recipients MUST advise the consumer to review, with the recipient that the data was disclosed to:
1. How their data will be handled; and
2. The consequences of withdrawing the disclosure consent
Note: The precise wording of the withdrawal message is at the discretion of the ADR | 4CM2.01.12 | ||
13 | CX Guideline | MAY | Consumers may be allowing a data recipient to collect, use, and disclosure their data according to the varying types of consents. This means 'sharing' may not always be the most appropriate or flexible language to use.
Data recipients should tailor language to the consent type, but may consider using generic terms such as 'access' to apply to the range of consent types. CX research suggested this language was comprehensible.
If a generic term is used to apply to an array of consent types or actions, data recipients should provide additional explanations to clarify what the precise consent types or actions mean in the context of that term. | 4CM2.01.13 | ||
14 | CX Guideline | MAY | Data recipients should include information on consequences of withdrawal during the consent withdrawal process. Refer to CDR Rule 7.2(4) and 4.11(3)(g)(iii). | 4CM2.01.14 | ||
15 | CX Guideline | MAY | Data recipients should introduce positive friction to the withdrawal flow to mitigate user error and unintended consequences. | 4CM2.01.15 | ||
16 | CX Guideline | MAY | Data recipients should provide a message to consumers that withdrawal was successful. This message should be clearly visible on the dashboard and shown as soon as withdrawal has taken place. | 4CM2.01.16 | ||
17 | CX Guideline | MAY | When a consent is withdrawn, data recipients should notify the consumer:
• Of the status of their consent, including the updated duration and withdrawal date;
• That the data recipient is no longer collecting, using, and/or disclosing their data (depending on the type of consent withdrawn);
• Of how their redundant data will be handled, and when this will come into effect if it will not be immediate (such as when the data will need to be held for legal reasons). | 4CM2.01.17 | ||
18 | CDR Rule | MUST | (1) This rule applies if:
(a) an accredited person has made a consumer data request to a CDR participant, based on a collection consent given under this Division relating to particular CDR data and that CDR participant; and
(b) the request has not been completely resolved; and
(c) the consent expires for any reason.
(2) The accredited person must notify:
(a) if the CDR participant is a data holder―the data holder, in accordance with the data standards, that the consent has expired; and
(b) if the CDR participant is an accredited data recipient―the accredited data recipient as soon as practicable that the consent has expired. | CDR Rule 4.18AA | 4CM2.01.18 | |
19 | CDR Rule | MUST | (1) This rule applies if:
(a) an accredited person has made a consumer data request to an accredited data recipient on behalf of a CDR representative, based on a collection consent given under this Division relating to particular CDR data and that accredited data recipient; and
(b) the accredited data recipient has an AP disclosure consent relating to that CDR data; and
(c) the request has not been completely resolved.
(3) If the AP disclosure consent expires in accordance with these rules, the accredited data recipient must notify the accredited person as soon as practicable of the expiry.
Note 1: This subrule is a civil penalty provision (see rule 9.8).
Note 2: The collection consent that the accredited person has expires when the notification is received—see subrule 4.14(4). | CDR Rule 4.18B(1), (3) | 4CM2.01.19 |
Download open source asset
Open sources design assets are created in Figma for the purposes of assisting implementation. This Figma file contains annotated wireframes and working prototypes for Withdrawal, including:
- Default example
- AP Disclosure consent withdrawal
Item | File | Date released | Version introduced |
---|---|---|---|
March 6, 2024 | 1.29.1 |
For past versions, refer to
Open sources design assets are provided in the form of version-controlled Figma files. These assets contain the annotated wireframe and working prototype published on this page, and have been reviewed for accessibility compliance. Assets are partially conformant to Web Content Accessibility Guidelines (WCAG) 2.1 level AA. These assets do not tend to accessible code and instead focus on visual presentation and readability.
The assets use the GOLD Design System; component rationale, accessibility support, and code documentation is available in the GOLD Design System website.
For more details, see
References
These CX Guidelines were informed by consultations and research conducted in 2019 and 2021, including the following:
- Consultations
- DSB 2021, Decision Proposal 168 - Separate Consents | Authorisation Withdrawal
- DSB 2021, Decision Proposal 187 - CX Standards | Disclosure Consents
- CX research
- GippsTech 2019, Phase 2, Stream 1 report
- Greater than X 2019, Phase 2, Stream 2 report
- Tobias 2019, Phase 2, Stream 3 report
- Other
- Nielsen Norman Group 2019, 10 Usability Heuristics for User Interface Design (Error prevention)
- Nielsen Norman Group 2019, 10 Usability Heuristics for User Interface Design (Visibility of system status)
Quick links to CX Guidelines: