Terms & Policies

Consumer Data Right Policy

Download PDF

1. About this Policy

This is the Consumer Data Right policy (CDR Policy) of Revolut Payments Australia Pty Ltd t/a Revolut Bank Australia (ACN 634 823 180), AFSL and Australian Credit Licence Number 517589 and Revolut Credit Services Australia Pty Ltd (ABN 670 768 144) (collectively, Revolut, we, us and our). Our registered office is at Level 28, 161 Castlereagh Street, Sydney, NSW, 2000 Australia.


This CDR policy explains your rights under the Consumer Data Right (CDR) and how we manage your CDR data.


This CDR Policy applies in addition to our Privacy Policy, which explains how we handle all your personal information under the Privacy Act 1988. This policy is specific to data managed under the CDR system.


Revolut is currently an Accredited Data Holder (ADH). As an ADH, we will share your CDR data with other accredited providers (e.g., another bank or a budgeting app) when you authorise us to do so.


Revolut is not currently an Accredited Data Recipient (ADR) and as such, we will not be able to collect your data from another provider to use in the Revolut app.


This policy is available free of charge. You can find the most up-to-date version in our app and on our website. You can also ask us for a copy in electronic or hard copy format by contacting us.


2. What is the CDR?

The CDR is an Australian government initiative that gives you greater control over your data. It allows you to safely and securely share data that businesses hold about you with other accredited businesses (such as other banks, lenders or budgeting apps). You can verify whether a business is accredited to receive CDR data by checking the CDR Register at cdr.gov.au/find-a-provider.


The CDR is jointly regulated by the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC). The legislative framework includes the Competition and Consumer Act 2010 and the Competition and Consumer (Consumer Data Right) Rules 2020 (together, CDR legislation).


3. Your Privacy and Security

We comply with all applicable security and privacy obligations under the CDR legislation. As an ADH, Revolut is subject to Privacy Safeguard 1 (open and transparent management of CDR data) and Privacy Safeguard 10 (notifying of the disclosure of CDR data), as well as the Australian Privacy Principles under the Privacy Act 1988 in relation to CDR data that is also personal information.

Under the CDR framework, we are required to:

only share your CDR data when you have given a valid, informed consent;

implement security measures that meet the standards set by the ACCC and OAIC;

notify you of key events relating to your CDR data; and

report any eligible data breach affecting your CDR data in accordance with our obligations.


4. Revolut as an ADH (Sharing your Revolut Data)

This section applies when you choose to share the CDR data we hold about you with another accredited provider.

What Revolut data can you share?

As required by the CDR rules, you can ask us to share specific data (Required Data) about you and your Revolut products, including:

  • Customer Information: Your name, contact details, and occupation (and if you’re a business, information about your business).
  • Account Details: Your account balances, types of accounts, and product features.
  • Transaction Details: Information on transactions made on your accounts.
  • Payments: Information about direct debits and scheduled payments.
  • Payees: Saved payees from your Revolut account.


Voluntary Data and Fees

At present, Revolut only accepts requests for Required Data. We do not accept requests for Voluntary Data (data that is not required to be shared under the CDR Rules).


Revolut does not charge any fees for sharing your CDR data.


How to share your Revolut data

You will always start the process from the app or website of the accredited provider you want to share your data with.

  1. Consent: You give your consent to the accredited provider (the Recipient).
  2. Redirect: They will securely redirect you to Revolut.
  3. Authenticate: We will ask you to authenticate yourself (e.g., through the Revolut app) to prove it’s you.
  4. Select: We will show you what data the Recipient is asking for and which accounts you can share.
  5. Authorise: You confirm which accounts you want to share and for how long (up to a maximum of 12 months).
  6. Confirm: We will confirm your authorisation and securely send your data to the Recipient.


Your Security

We will never ask you to share your Revolut app PIN, password, or one-time passcodes with anyone, including an accredited provider.

The secure CDR process means you will always be redirected to the official Revolut app or website to provide your authorisation directly to us. Never give your Revolut login details to a third party.


Managing your data sharing

You are in full control. You can see all active data-sharing arrangements (consents) you've provided in your Revolut app. From your CDR dashboard, you can:

  • See who you are sharing data with.
  • See what data you are sharing and for what purpose.
  • See when the consent expires.
  • Stop sharing your data at any time.


Withdrawing a consent will immediately stop us from sharing further data under that arrangement. However, we do not have control over the data that has already been sent to the ADR - if you want your data deleted by the ADR, please contact them directly.


Business Accounts and Nominated Representatives

Businesses are able to appoint Authorised Team Members to share CDR data on behalf of the business within Revolut Business. These Authorised Team Members act as Nominated Representatives under the CDR Rules.


Once this permission is granted, the Nominated Representative can authorise the sharing of the business's CDR data with other accredited providers, following the process described in the 'How to share your Revolut data' section.


The Business is responsible for managing all Nominated Representatives and can add or remove these permissions at any time through the Revolut Business app or portal.


5. Your Rights

How to access your data

You can access your Revolut data at any time by logging into the Revolut app or by contacting us.


How to correct your data

We are committed to ensuring that the CDR data we disclose about you is accurate, up-to-date and complete at the time of disclosure.


If you believe your Revolut data (like your address or contact details) is incorrect, you can correct it directly in the app or by contacting us. If we have shared incorrect data with another provider, we will notify you and the recipient.


We will respond to your correction request within 10 business days.


Notifications about your data

We will notify you about key events related to your CDR data, including:

  • When you successfully authorise, amend, or withdraw a consent.
  • When your consent is about to expire (e.g., 90-day and 30-day reminders).
  • When we disclose your data to an accredited person (if applicable).
  • When you make a correction request or we respond to one.
  • In the event of an eligible data breach.
  • When we collect your data for the first time as an ADR after you have provided consent.


6. How to make a complaint

We are committed to resolving any issues you have. If you have a complaint about how we have handled your CDR data, please tell us first so we can make it right.


Step 1: Contact Revolut

If you have a complaint, please contact us through the Revolut app. Alternatively, you can submit a complaint using our online form or contact the Complaints team at complaints.au@revolut.com.


You’ll need to tell us:

  • Your name;
  • The phone number and email address associated with your account;
  • When the problem arose; and
  • How you’d like us to put the matter right.


We’ll look into your complaint and will aim to respond to you as soon as possible or within 30 days following receipt of the complaint.


Please read our Complaints Policy for more information.


Step 2: External Review

If you are not satisfied with our final response, you can escalate your complaint to our external dispute resolution (EDR) scheme, the Australian Financial Complaints Authority (AFCA), or to the OAIC.


Australian Financial Complaints Authority (AFCA)

  • Website: www.afca.org.au
  • Email: info@afca.org.au
  • Phone: 1800 931 678 (free call)
  • Mail: GPO Box 3, Melbourne VIC 3001


Office of the Australian Information Commissioner (OAIC)

  • Website: www.oaic.gov.au
  • Phone: 1300 363 992
  • Mail: GPO Box 5218, Sydney NSW 2001


7. How to contact us

For tech support, general questions about this policy or your CDR data, you can send an email to api-requests@revolut.com. You can also visit our website at www.revolut.com.au.