National Australia Bank (NAB) has paid $751,200 in penalties after the ACCC issued four infringement notices for alleged breaches of the Consumer Data Right (CDR) rules.

The breaches relate to NAB’s failure to disclose, or accurately disclose, credit limit data in response to requests made by accredited CDR providers acting on behalf of consumers.

The inaccurate data reportedly impacted fintech services, including mortgage broking tools that rely on accurate consumer data to offer faster and more tailored loan options.

ACCC Deputy Chair Catriona Lowe said poor data quality undermines the benefits of the CDR system: “When banks don’t provide accurate data, consumers can’t properly compare products or access services that help them manage their finances.”

In response, NAB Chief Digital Officer Sujeet Rana said the bank remains committed to the CDR framework.

“NAB has long been an active participant in the consultation and development of the Consumer Data Right (CDR), including as an accredited data recipient,” Rana said.

“We have fully cooperated with the ACCC’s review and have resolved the data quality error identified. We appreciate and recognise the importance of ensuring we are meeting the standards necessary and expected under the regulations.”

Rana added that NAB continues to invest significantly in CDR compliance and innovation, calling the program a “safe and secure way” for customers to share their data.

The CDR, introduced to improve data transparency and consumer empowerment, allows Australians to share their data securely with accredited third parties to access better deals on products and services.

NAB’s payment is the highest to date for alleged breaches of the CDR Rules. The bank has since cooperated with the ACCC and resolved the data quality issues.

The ACCC has flagged data quality as a top enforcement priority as the CDR expands.

Over 530,000 consumers used CDR-enabled services in banking and energy in the second half of 2024, which is up 135% from the previous period.

“All CDR participants should expect close scrutiny and enforcement action if they fail to meet their obligations,” Lowe added.

While the penalty does not represent an admission of guilt, it serves as a strong reminder that data holders must comply with CDR rules or face consequences.