Are there any Data Sovereignty requirements for a Consumer Data Right (CDR) solution developed by a FinTech on behalf of a Data Holder to be hosted in Australian Data Centres (either Cloud Provider or Hosted Solution)? There doesn't appear to be any mention of this in the available CDR specifications.
Thank you for your question. There are currently no requirements in the CDR system for CDR data to be stored in Australian data centres. Where the entity is an accredited data recipient, they must not disclose CDR data to a recipient located overseas unless one of the exceptions in Privacy Safeguard 8 applies. We provide further guidance on these exceptions in Chapter 8 of the OAIC’s CDR Privacy Safeguard Guidelines.
In addition, where an accredited data recipient proposes to store CDR data outside of Australia or an external territory, it must specify the countries where it proposes to store the data in its CDR policy (due to the requirements in Privacy Safeguard 1 and CDR Rule 7.2(7)). We provide further information on these requirements in the OAIC’s Guide to developing a CDR policy.