The Commonwealth Bank of Australia (CBA) has paid penalties totalling $792,000 after the Australian Competition & Consumer Commission (ACCC) issued it with four infringement notices for alleged breaches of the Consumer Data Right (CDR) Rules.

The ACCC alleges that CBA did not comply with the rules by failing to enable data sharing for certain accounts for business consumers and partnerships.

This meant affected consumers were unable to share their data to access CDR-enabled products and services, such as those used for business accounting. The ACCC received complaints from consumers reporting difficulties accessing CDR and impacted customers had to either perform manual workarounds or revert to less secure methods of data sharing.

CDR is an economy-wide data sharing reform that empowers Australians to use the data businesses hold about them for their own benefit. Since November 2021, the four major banks, including CBA, have been required to enable consumer data sharing of in-scope products for non-individual CDR consumers.

Earlier this year, National Australia Bank Limited paid penalties totalling $751,200 for alleged contraventions of the CDR Rules relating to data quality issues.

CBA cooperated with the investigation and has made several commitments as part of an administrative resolution with the ACCC, including enabling consumer data sharing for remaining Trading Entity Business Name (TEBN) accounts by 19 December 2025 and providing remediation to customers and accredited data recipients affected by the conduct.

The remediation includes a goodwill payment to affected business customers who meet the relevant eligibility criteria, and additional payments to business customers who can substantiate further financial and non-financial loss.

The remediation program will begin in the week commencing 19 January 2026 and CBA will email affected customers and publish a notice on its website outlining how affected customers can submit remediation claims.