Updated November 9, 2023

These guidelines provide examples for how to implement collection and use consents for common scenarios.

On this page

Overview

In accordance with Rule 4.11(1)(Note 1), an accredited person cannot infer consent, or seek to rely on an implied consent. Consent must be voluntary, express, informed, specific as to purpose, time limited, and easily withdrawn.

When asking a CDR consumer to give consent, a data recipient must:

• accord with the data standards;
• have regard to any consumer experience guidelines developed by the Data Standards Body
• be as easy to understand as practicable, including by use of concise language and, where appropriate, visual aids;

Data recipients should make the consent process as easy to understand as possible by using appropriate interventions to mitigate cognitive overload, facilitate comprehension, and provide transparency and consumer control.

This section provides examples illustrating how the guidelines may be implemented.

Consent is the first stage of ‣.

These types of consents contain several steps, which may include:

• Provider selection At this step, the consumer selects who they want to share data from, such as their data holder.
• Terms of consent At this step, the consumer is asked for their consent and can do so by choosing the types of CDR data they will allow the ADR to access, the access period, and the specific uses of their data.

A high level example of the provider selection and terms of consent steps