Consumer Data Right (CDR) accreditation carries a training obligation that many teams discover late: every user must complete mandatory security and privacy training before they interact with the CDR data environment, and refresher courses must follow at least annually. This guide explains what the rules require in 2026, what the training should cover, and how to build an annual cycle that survives an assurance review.
TL;DR
- Accredited persons must ensure all users complete security and privacy training before touching the CDR data environment, per Privacy Safeguard 12 and CDR Rule 5.12.
- Refresher courses must be provided at least once a year; the OAIC says regular staff training should happen at a minimum of once per year.
- Accredited persons report regularly on their information security obligations, including staff privacy and security training, so completion has to be evidenced.
- Monthly short courses with per-learner completion records make the annual refresher automatic and the evidence easy.
- Start with a gap assessment to see which obligations training covers and which need technical controls instead.
Why this matters in 2026
The CDR lets Australian consumers share their data with accredited providers. It started in banking and now reaches other sectors. If your organisation is accredited, or is applying, your staff are part of the control set, not just your systems.
The OAIC's CDR Privacy Safeguard Guidelines state the expectation directly: accredited persons and accredited data recipients must ensure all users undergo mandatory security and privacy training prior to interacting with the CDR data environment, with refresher courses provided at least annually. The requirement sits under Privacy Safeguard 12, CDR Rule 5.12 and Part 2 of Schedule 2 to the CDR Rules (OAIC, CDR Privacy Safeguard Guidelines, Chapter 1).
A note on currency: that chapter is Version 3.0, dated June 2021. The CDR Rules have been amended since, so confirm the current wording with the OAIC and your accreditation adviser before you rely on any clause number in an audit.
What the rules require, at a glance
| Obligation | Source in the OAIC guidance | What it means in practice |
|---|---|---|
| Training before access | Privacy Safeguard 12, CDR Rule 5.12 | No user touches CDR data until training is complete |
| Annual refresher | Part 2 of Schedule 2 to the CDR Rules | Everyone re-trains at least every 12 months |
| Induction integration | Suggested approach to Privacy Safeguard 1 | Privacy safeguards training sits inside onboarding |
| Regular reporting | CDR Rule 5.9 and Part 2 of Schedule 1 | Accredited persons report on information security obligations, including staff training |
| Record keeping | CDR Rule 9.3 | Certain records must be kept and maintained |
The OAIC also recommends integrating privacy safeguards training into induction and providing regular training to staff who deal with CDR data, at a minimum of once per year. That recommendation sits on top of the legal obligation rather than replacing it.
Who counts as a user
The wording is "all users", and that is deliberately broad. In a mid-sized accredited business it typically covers:
- Developers and platform staff who build or maintain CDR integrations
- Compliance and privacy officers who run consent, correction and complaint processes
- Customer-facing staff who discuss CDR data with consumers
- Contractors and outsourced service providers with any access to the environment
The OAIC notes that where an entity uses outsourced service providers, the reasonable steps it takes may differ. Treat any person who can reach the environment as a user until your adviser tells you otherwise.
What the training should cover
The rules do not prescribe a curriculum. A programme that holds up in review covers general awareness plus CDR specifics:
- Phishing and social engineering. Verizon's 2025 Data Breach Investigations Report analysed 12,195 confirmed breaches and found a human element in roughly 60 percent of them (Verizon DBIR 2025). CDR data is attractive because it is verified financial and identity data.
- Consent handling. What it means when consent is given, withdrawn or expires, and what each state means for the data you hold.
- Access discipline. Least privilege, credential hygiene and why shared logins threaten accreditation.
- Data handling. How CDR data is held, when it may be disclosed, and the deletion and de-identification requirements around it.
- Incident reporting. Who staff call, and how quickly, when something looks wrong.
Story-based security awareness training with a quiz after every lesson gives you the comprehension evidence a bare completion log lacks.
How to build the annual cycle
- Map the obligation first. Run a security gap assessment against the frameworks your accreditation touches. It shows which requirements training evidence satisfies and which need a technical control instead.
- Gate access on completion. Induction training is a gate, not an event. No completed course, no access to the CDR data environment, enforced through access provisioning rather than trust.
- Run monthly, not annually. The annual refresher is the legal floor. Monthly short courses mean every learner has trained within the last 30 days, so the refresher is covered without a scramble.
- Automate the evidence. An assurance review asks who was trained, when, and how they were assessed. Human risk reporting turns overdue courses, failed quizzes and phishing clicks into one score per learner, and the training reports export as branded PDFs.
- Test behaviour, not just attendance. Run phishing simulations monthly. Anyone who clicks is auto-enrolled in a short remediation course, which is both a corrective control and evidence the programme is live.
Common mistakes
- Treating the annual refresher as the whole programme. Eleven months of silence between refreshers is technically compliant and practically weak.
- Forgetting contractors. Outsourced service providers with access to the environment are users too.
- No induction gate. A mid-year starter who goes months untrained is the easiest finding for a reviewer to make.
- Completion without comprehension. A log with no assessment behind it invites the question of what it proves.
- No behavioural evidence. Without simulation results, the file shows attendance and nothing about whether staff changed what they do.
FAQ
Does CDR accreditation require security awareness training? Yes. Accredited persons must ensure all users complete mandatory security and privacy training before interacting with the CDR data environment, with refresher courses at least annually, under Privacy Safeguard 12 and CDR Rule 5.12.
How often must CDR users be retrained? At least annually. The OAIC also recommends regular training for staff who deal with CDR data at a minimum of once per year, built into induction. Monthly delivery exceeds both.
Do contractors need the training? Anyone with access to the CDR data environment is a user, so contractors and outsourced service providers with access should complete the same training before they start.
What evidence should I keep? Per-learner completion dates, assessment results and proof the annual refresher ran on schedule. CDR Rule 9.3 requires certain records to be kept, so confirm with your adviser exactly which ones apply to you.
Does training replace technical security controls? No. Training sits alongside the information security controls in Schedule 2 to the CDR Rules. A gap assessment shows where training covers a requirement and where a technical control is still needed.
One last thing
If you cannot produce, in five minutes, a list of every current user of your CDR data environment with the date each last completed training, you do not have an annual programme. You have a memory. Build that report first and the rest of the programme follows.