Customer and Product Data Act 2025
Summary of changes
These summaries explain recent changes to the law. They are generated by AI comparing versions of the legislation, so they might oversimplify, miss details, or get things wrong. Learn more about how we track these changes.


24 January 2026
- Updated the Act's title to reflect the new year
- Changed the commencement date of the Act
- Amended the purpose of the Act to focus on the value of data for customers and society
- Updated definitions in section 5 to reference new section numbers
- Added a new transitional provision to Schedule 1
- Updated provision numbers for authorisation and related sections
- Clarified the requirements for data holders and accredited requestors
- Updated the accreditation process and requirements
- Introduced changes to the register of participants in the customer and product data system
- Updated the provisions related to fees, charges, and levies
- Amended the provisions related to civil liability remedies and penalties
- Updated the provisions related to the chief executive's functions and powers
- Introduced changes to the provisions related to data security and privacy
- Updated the provisions related to dispute resolution and complaints
- Made minor changes to various provisions, including formatting and wording updates
Affected provisions
- 1: Title Updated the Act's title to reflect the new year
- 1: Transitional, savings, and related provisions Added a new transitional provision to Schedule 1
- 2: Commencement Changed the commencement date of the Act
- 3: Purpose Amended the purpose of the Act to focus on the value of data for customers and society
- 5: Interpretation Updated definitions in section 5 to reference new section numbers
- 6: Data holder Made minor changes to various provisions, including formatting and wording updates
- 14: Data holder must provide customer data to customer Clarified the requirements for data holders and accredited requestors
- 15: Data holder must provide customer data to accredited requestor if customer’s authorisation is confirmed Clarified the requirements for data holders and accredited requestors
- 16: Data holder may or must refuse request for data in certain circumstances Updated the provisions related to dispute resolution and complaints
- 18: Data holder must perform certain actions on customer’s request Clarified the requirements for data holders and accredited requestors
- 19: Data holder must perform certain actions on accredited requestor’s request if customer’s authorisation is confirmed Clarified the requirements for data holders and accredited requestors
- 20: Data holder may or must refuse to perform actions in certain circumstances Updated the provisions related to dispute resolution and complaints
- 21: How data holders and accredited requestors must deal with joint customers Introduced changes to the provisions related to data security and privacy; Made minor changes to various provisions, including formatting and wording updates
- 22: Data holder must provide product data to any person Clarified the requirements for data holders and accredited requestors
- 23: Data holder may refuse request for data in certain circumstances Made minor changes to various provisions, including formatting and wording updates
- 29: Chief executive may require data holder to test electronic system Updated the provisions related to the chief executive's functions and powers
- 33: Accredited requestors must comply with requirements for making information available Introduced changes to the provisions related to data security and privacy
- 35: Contravention of specified disclosure requirement is infringement offence Introduced changes to the provisions related to data security and privacy
- 37: Giving authorisation Updated provision numbers for authorisation and related sections
- 38: Ending authorisation Updated provision numbers for authorisation and related sections
- 39: Authorisation must be confirmed Updated provision numbers for authorisation and related sections
- 40: Customer or secondary user must be able to control authorisation Updated provision numbers for authorisation and related sections
- 41: Accredited requestor must comply with prescribed duties in respect of authorisation Updated the provisions related to dispute resolution and complaints
- 42: Authorisation must not be required as condition of providing product Updated provision numbers for authorisation and related sections
- 43: Only customer, secondary user, or accredited requestor may request regulated data service Updated the accreditation process and requirements
- 49: Data holder or accredited requestor must be member of dispute resolution scheme (if scheme has been prescribed) Updated the provisions related to dispute resolution and complaints
- 50: Rules of scheme may be changed to provide for complaints about regulated data services Updated the provisions related to dispute resolution and complaints
- 51: Access request not IPP 6 request but contravention is interference with privacy Introduced changes to the provisions related to data security and privacy
- 52: Certain contraventions relating to storage and security treated as breaching information privacy principle 5 Introduced changes to the provisions related to data security and privacy
- 53: Chief executive may require person to supply information or produce documents Introduced changes to the register of participants in the customer and product data system
- 54: Person has privileges of witness in court Made minor changes to various provisions, including formatting and wording updates
- 55: Effect of proceedings Made minor changes to various provisions, including formatting and wording updates
- 56: Effect of final decision that exercise of powers under section 53 unlawful Made minor changes to various provisions, including formatting and wording updates
- 57: Offence for failing to comply with notice to supply information or produce documents Made minor changes to various provisions, including formatting and wording updates
- 60: Other remedies or powers not limited Updated the accreditation process and requirements
- 62: Infringement offences Amended the provisions related to civil liability remedies and penalties
- 63: When infringement notice may be issued Amended the provisions related to civil liability remedies and penalties
- 64: Revocation of infringement notice before payment made Amended the provisions related to civil liability remedies and penalties
- 65: What infringement notice must contain Amended the provisions related to civil liability remedies and penalties
- 66: How infringement notice may be served Amended the provisions related to civil liability remedies and penalties
- 67: Payment of infringement fees Amended the provisions related to civil liability remedies and penalties
- 68: Reminder notices Amended the provisions related to civil liability remedies and penalties
- 69: Civil liability remedies available under this subpart Amended the provisions related to civil liability remedies and penalties
- 70: When High Court may make pecuniary penalty order Amended the provisions related to civil liability remedies and penalties
- 71: Maximum penalty (Tier 1) Amended the provisions related to civil liability remedies and penalties
- 72: Maximum penalty (Tier 2) Amended the provisions related to civil liability remedies and penalties
- 73: Considerations for court in determining pecuniary penalty Amended the provisions related to civil liability remedies and penalties
- 75: Declaration of contravention Amended the provisions related to civil liability remedies and penalties
- 76: Purpose and effect of declaration of contravention Amended the provisions related to civil liability remedies and penalties
- 77: What declaration of contravention must state Amended the provisions related to civil liability remedies and penalties
- 78: When court or Disputes Tribunal may make compensatory orders Amended the provisions related to civil liability remedies and penalties
- 79: Terms of compensatory orders Amended the provisions related to civil liability remedies and penalties
- 80: Court may grant injunctions Amended the provisions related to civil liability remedies and penalties
- 81: When court may grant restraining injunctions Amended the provisions related to civil liability remedies and penalties
- 82: When court may grant performance injunctions Amended the provisions related to civil liability remedies and penalties
- 83: Chief executive's undertaking as to damages not required Amended the provisions related to civil liability remedies and penalties
- 84: Rules of civil procedure and civil standard of proof apply Amended the provisions related to civil liability remedies and penalties
- 85: Limit on proceedings Amended the provisions related to civil liability remedies and penalties
- 86: More than 1 civil liability remedy may be given for same conduct Amended the provisions related to civil liability remedies and penalties
- 87: Only 1 pecuniary penalty order may be made for same conduct Amended the provisions related to civil liability remedies and penalties
- 88: No pecuniary penalty and criminal penalty for same conduct Amended the provisions related to civil liability remedies and penalties
- 89: General defences for person in contravention Made minor changes to various provisions, including formatting and wording updates
- 90: Defence for contraventions due to technical fault Made minor changes to various provisions, including formatting and wording updates
- 92: Jurisdiction of High Court Made minor changes to various provisions, including formatting and wording updates
- 94: Jurisdiction of Disputes Tribunal Made minor changes to various provisions, including formatting and wording updates
- 95: Chief executive’s functions Updated the provisions related to the chief executive's functions and powers
- 105: Minister must have regard to certain matters when recommending designation regulations Made minor changes to various provisions, including formatting and wording updates
- 106: Minister must consult on proposed designation Made minor changes to various provisions, including formatting and wording updates
- 108: Application for accreditation Updated the accreditation process and requirements
- 110: Application may be made before designation regulations fully in force Updated the provisions related to the chief executive's functions and powers
- 111: Chief executive must verify applicant’s identity Updated the accreditation process and requirements
- 112: Decision by chief executive Updated the accreditation process and requirements
- 118: When chief executive may suspend or cancel accreditation Updated the accreditation process and requirements
- 120: Crown organisations may be customer, data holder, or accredited requestor Made minor changes to various provisions, including formatting and wording updates
- 121: Register of participants in customer and product data system Introduced changes to the register of participants in the customer and product data system
- 122: Purposes of register Introduced changes to the register of participants in the customer and product data system
- 125: Other data holders must provide information to chief executive Introduced changes to the register of participants in the customer and product data system
- 126: Contents of register that is publicly available Introduced changes to the register of participants in the customer and product data system
- 127: Contents of register that is available to data holders and accredited requestors (other than information publicly available under section 126) Introduced changes to the register of participants in the customer and product data system
- 133: Regulations relating to fees and charges Updated the provisions related to fees, charges, and levies
- 134: Miscellaneous provisions relating to fees and charges Updated the provisions related to fees, charges, and levies
- 135: Levies payable by data holders and accredited requestors Updated the provisions related to fees, charges, and levies
- 136: Miscellaneous provisions relating to levies Updated the provisions related to fees, charges, and levies
- 137: Minister must consult on proposed regulations Updated the provisions related to fees, charges, and levies
- 139: Chief executive must comply with requirements before making standard Updated the provisions related to the chief executive's functions and powers
- 140: Chief executive’s consultation on proposed standards Made minor changes to various provisions, including formatting and wording updates
- 144: Chief executive’s warnings, reports, guidelines, or comments protected by qualified privilege Updated the provisions related to the chief executive's functions and powers
- 145: Notices Made minor changes to various provisions, including formatting and wording updates
- 146: Service of notices Made minor changes to various provisions, including formatting and wording updates
- 147: Principal Act Made minor changes to various provisions, including formatting and wording updates
- 148: Schedule 1 amended Made minor changes to various provisions, including formatting and wording updates
- 149: Principal Act Made minor changes to various provisions, including formatting and wording updates
- 150: Section 75 amended (Referral of complaint to another person) Made minor changes to various provisions, including formatting and wording updates
- 151: Section 208 amended (Consultation) Made minor changes to various provisions, including formatting and wording updates
- 152: Principal Act Made minor changes to various provisions, including formatting and wording updates
- 153: Section 2 amended (Interpretation) Amended the provisions related to civil liability remedies and penalties
14 May 2025
- Updated the Act's title to reflect the new year
- Changed the commencement date of the Act
- Amended the purpose of the Act to focus on the value of data for customers and society
- Updated various definitions in section 5 to reference new section numbers
- Added a new transitional provision to Schedule 1
- Updated provision numbers and references throughout the Act
- Clarified the territorial application of the Act
- Updated the definition of 'Customer' and 'Designated customer data'
- Introduced new requirements for data holders to verify the identity of requestors
- Updated the requirements for accredited requestors to keep records
- Introduced new provisions for the chief executive to verify applicant identities and impose conditions on accreditation
- Updated the provisions for exemptions, levies, and fees
- Introduced new provisions for civil liability remedies and pecuniary penalties
- Updated the provisions for infringement notices and reminder notices
- Introduced new provisions for the chief executive's functions and warnings
- Updated the provisions for appeals against accreditation decisions and the operation of the register
- Introduced new provisions for the sharing of information with law enforcement or regulatory agencies
- Updated the provisions for general defences and technical faults
Affected provisions
- 1: Title Updated the Act's title to reflect the new year
- 1: Transitional, savings, and related provisions Added a new transitional provision to Schedule 1
- 2: Commencement Changed the commencement date of the Act
- 3: Purpose Amended the purpose of the Act to focus on the value of data for customers and society
- 5: Interpretation Updated various definitions in section 5 to reference new section numbers
- 8: Customer, customer data, and designated customer data Updated the definition of 'Customer' and 'Designated customer data'
- 9: Product, product data, and designated product data Updated the definition of 'Customer' and 'Designated customer data'
- 11: Territorial application of Act Clarified the territorial application of the Act
- 14: Data holder must provide customer data to customer Introduced new requirements for data holders to verify the identity of requestors
- 15: Data holder must provide customer data to accredited requestor if customer’s authorisation is confirmed Introduced new requirements for data holders to verify the identity of requestors
- 16: Data holder may or must refuse request for data in certain circumstances Updated provision numbers and references throughout the Act; Updated the provisions for exemptions, levies, and fees
- 18: Data holder must perform certain actions on customer’s request Introduced new requirements for data holders to verify the identity of requestors
- 19: Data holder must perform certain actions on accredited requestor’s request if customer’s authorisation is confirmed Introduced new requirements for data holders to verify the identity of requestors
- 20: Data holder may or must refuse to perform actions in certain circumstances Updated provision numbers and references throughout the Act
- 21: How data holders and accredited requestors must deal with joint customers Updated provision numbers and references throughout the Act
- 23: Data holder may refuse request for data in certain circumstances Updated provision numbers and references throughout the Act
- 28: Electronic system must comply with prescribed technical or performance requirements Updated provision numbers and references throughout the Act
- 29: Chief executive may require data holder to test electronic system Updated provision numbers and references throughout the Act; Introduced new provisions for the chief executive's functions and warnings
- 32: Requirements for data holders in regulations or standards Updated provision numbers and references throughout the Act
- 33: Accredited requestors must comply with requirements for making information available Updated provision numbers and references throughout the Act
- 35: Contravention of specified disclosure requirement is infringement offence Updated provision numbers and references throughout the Act
- 37: Giving authorisation Updated provision numbers and references throughout the Act
- 38: Ending authorisation Updated provision numbers and references throughout the Act
- 39: Authorisation must be confirmed Updated provision numbers and references throughout the Act
- 40: Customer or secondary user must be able to control authorisation Updated provision numbers and references throughout the Act
- 41: Accredited requestor must comply with prescribed duties in respect of authorisation Updated provision numbers and references throughout the Act
- 42: Authorisation must not be required as condition of providing product Updated provision numbers and references throughout the Act
- 43: Only customer, secondary user, or accredited requestor may request regulated data service Updated provision numbers and references throughout the Act; Introduced new provisions for the chief executive to verify applicant identities and impose conditions on accreditation
- 44: Offence for contravention of request restriction Updated provision numbers and references throughout the Act
- 45: Verification of identity of person who makes request Updated provision numbers and references throughout the Act
- 46: Data holder must keep records about regulated data service Updated provision numbers and references throughout the Act; Updated the requirements for accredited requestors to keep records
- 47: Accredited requestor must keep records about regulated data service Updated the requirements for accredited requestors to keep records
- 48: Data holders and accredited requestors must have customer complaints process Updated provision numbers and references throughout the Act
- 49: Data holder or accredited requestor must be member of dispute resolution scheme (if scheme has been prescribed) Updated provision numbers and references throughout the Act
- 50: Rules of scheme may be changed to provide for complaints about regulated data services Updated provision numbers and references throughout the Act
- 53: Chief executive may require person to supply information or produce documents Updated provision numbers and references throughout the Act; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 54: Person has privileges of witness in court Updated provision numbers and references throughout the Act
- 55: Effect of proceedings Updated provision numbers and references throughout the Act
- 56: Effect of final decision that exercise of powers under section 53 unlawful Updated provision numbers and references throughout the Act
- 57: Offence for failing to comply with notice to supply information or produce documents Updated provision numbers and references throughout the Act
- 61: Prohibition against holding out Introduced new provisions for civil liability remedies and pecuniary penalties
- 62: Infringement offences Introduced new provisions for civil liability remedies and pecuniary penalties
- 63: When infringement notice may be issued Introduced new provisions for civil liability remedies and pecuniary penalties; Updated the provisions for infringement notices and reminder notices
- 64: Revocation of infringement notice before payment made Introduced new provisions for civil liability remedies and pecuniary penalties; Updated the provisions for infringement notices and reminder notices
- 65: What infringement notice must contain Introduced new provisions for civil liability remedies and pecuniary penalties; Updated the provisions for infringement notices and reminder notices
- 66: How infringement notice may be served Introduced new provisions for civil liability remedies and pecuniary penalties; Updated the provisions for infringement notices and reminder notices
- 67: Payment of infringement fees Introduced new provisions for civil liability remedies and pecuniary penalties; Updated the provisions for infringement notices and reminder notices
- 68: Reminder notices Introduced new provisions for civil liability remedies and pecuniary penalties; Updated the provisions for infringement notices and reminder notices
- 69: Civil liability remedies available under this subpart Introduced new provisions for civil liability remedies and pecuniary penalties
- 70: When High Court may make pecuniary penalty order Introduced new provisions for civil liability remedies and pecuniary penalties
- 71: Maximum penalty (Tier 1) Introduced new provisions for civil liability remedies and pecuniary penalties
- 72: Maximum penalty (Tier 2) Introduced new provisions for civil liability remedies and pecuniary penalties
- 73: Considerations for court in determining pecuniary penalty Introduced new provisions for civil liability remedies and pecuniary penalties
- 75: Declaration of contravention Introduced new provisions for civil liability remedies and pecuniary penalties
- 76: Purpose and effect of declaration of contravention Introduced new provisions for civil liability remedies and pecuniary penalties
- 77: What declaration of contravention must state Introduced new provisions for civil liability remedies and pecuniary penalties
- 78: When court or Disputes Tribunal may make compensatory orders Introduced new provisions for civil liability remedies and pecuniary penalties
- 79: Terms of compensatory orders Introduced new provisions for civil liability remedies and pecuniary penalties
- 80: Court may grant injunctions Introduced new provisions for civil liability remedies and pecuniary penalties
- 81: When court may grant restraining injunctions Introduced new provisions for civil liability remedies and pecuniary penalties
- 82: When court may grant performance injunctions Introduced new provisions for civil liability remedies and pecuniary penalties
- 83: Chief executive's undertaking as to damages not required Introduced new provisions for civil liability remedies and pecuniary penalties
- 84: Rules of civil procedure and civil standard of proof apply Introduced new provisions for civil liability remedies and pecuniary penalties
- 85: Limit on proceedings Introduced new provisions for civil liability remedies and pecuniary penalties
- 86: More than 1 civil liability remedy may be given for same conduct Introduced new provisions for civil liability remedies and pecuniary penalties
- 87: Only 1 pecuniary penalty order may be made for same conduct Introduced new provisions for civil liability remedies and pecuniary penalties
- 88: No pecuniary penalty and criminal penalty for same conduct Introduced new provisions for civil liability remedies and pecuniary penalties
- 89: General defences for person in contravention Updated provision numbers and references throughout the Act; Updated the provisions for general defences and technical faults
- 90: Defence for contraventions due to technical fault Updated provision numbers and references throughout the Act; Updated the provisions for general defences and technical faults
- 92: Jurisdiction of High Court Updated provision numbers and references throughout the Act
- 93: Jurisdiction of District Court Updated provision numbers and references throughout the Act
- 94: Jurisdiction of Disputes Tribunal Updated provision numbers and references throughout the Act
- 95: Chief executive’s functions Updated provision numbers and references throughout the Act; Introduced new provisions for the chief executive's functions and warnings
- 106: Minister must consult on proposed designation Updated provision numbers and references throughout the Act
- 107: Contents of designation regulations Updated provision numbers and references throughout the Act
- 108: Application for accreditation Updated provision numbers and references throughout the Act
- 109: How application is made Updated provision numbers and references throughout the Act
- 110: Application may be made before designation regulations fully in force Updated provision numbers and references throughout the Act
- 111: Chief executive must verify applicant’s identity Introduced new provisions for the chief executive to verify applicant identities and impose conditions on accreditation
- 112: Decision by chief executive Introduced new provisions for the chief executive to verify applicant identities and impose conditions on accreditation
- 113: Notice of decision Updated provision numbers and references throughout the Act
- 114: Application to modify accreditation Updated provision numbers and references throughout the Act
- 116: Duration of accreditation Updated provision numbers and references throughout the Act
- 117: Renewal of accreditation Updated provision numbers and references throughout the Act
- 118: When chief executive may suspend or cancel accreditation Updated provision numbers and references throughout the Act
- 119: Appeals against accreditation decisions Updated the provisions for appeals against accreditation decisions and the operation of the register
- 120: Crown organisations may be customer, data holder, or accredited requestor Updated provision numbers and references throughout the Act
- 121: Register of participants in customer and product data system Updated provision numbers and references throughout the Act; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 122: Purposes of register Updated provision numbers and references throughout the Act; Updated the provisions for exemptions, levies, and fees; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 123: Operation of register Updated provision numbers and references throughout the Act; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 124: Persons that will become data holders when designation comes into force must provide information to chief executive Updated provision numbers and references throughout the Act
- 125: Other data holders must provide information to chief executive Updated provision numbers and references throughout the Act; Updated the provisions for exemptions, levies, and fees; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 126: Contents of register that is publicly available Updated provision numbers and references throughout the Act; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 127: Contents of register that is available to data holders and accredited requestors (other than information publicly available under section 126) Updated provision numbers and references throughout the Act; Updated the provisions for appeals against accreditation decisions and the operation of the register
- 128: Sharing of information with certain law enforcement or regulatory agencies Updated provision numbers and references throughout the Act; Introduced new provisions for the sharing of information with law enforcement or regulatory agencies
- 129: Conditions that may be imposed on providing information under this subpart Updated provision numbers and references throughout the Act
- 130: Restriction on publication, disclosure, or use Updated provision numbers and references throughout the Act
- 133: Regulations relating to fees and charges Updated provision numbers and references throughout the Act
- 134: Miscellaneous provisions relating to fees and charges Updated provision numbers and references throughout the Act
- 136: Miscellaneous provisions relating to levies Updated provision numbers and references throughout the Act; Updated the provisions for exemptions, levies, and fees
- 137: Minister must consult on proposed regulations Updated provision numbers and references throughout the Act; Updated the provisions for exemptions, levies, and fees
- 139: Chief executive must comply with requirements before making standard Updated provision numbers and references throughout the Act; Introduced new provisions for the chief executive's functions and warnings
- 141: Exemptions Updated provision numbers and references throughout the Act; Updated the provisions for exemptions, levies, and fees
- 142: Effect of breach of term or condition of exemption Updated provision numbers and references throughout the Act
- 144: Chief executive’s warnings, reports, guidelines, or comments protected by qualified privilege Updated provision numbers and references throughout the Act; Introduced new provisions for the chief executive's functions and warnings
- 145: Notices Updated provision numbers and references throughout the Act
- 146: Service of notices Updated provision numbers and references throughout the Act
- 147: Principal Act Updated provision numbers and references throughout the Act
- 148: Schedule 1 amended Updated provision numbers and references throughout the Act
- 149: Principal Act Updated provision numbers and references throughout the Act
- 150: Section 75 amended (Referral of complaint to another person) Updated provision numbers and references throughout the Act
- 151: Section 208 amended (Consultation) Updated provision numbers and references throughout the Act
- 152: Principal Act Updated provision numbers and references throughout the Act
- 153: Section 2 amended (Interpretation) Introduced new provisions for civil liability remedies and pecuniary penalties
