How to stop sharing open banking data after a loan application (and get it deleted)

Open banking sharing has two ends, and you switch it off at both. At your bank, you stop the authorisation that lets the bank send data. At the recipient, the accredited business that received it for the lender, you withdraw your consent and choose deletion. Do one without the other and you’ve only half-closed the door. The whole job takes about 15 minutes.

You shared your business bank data to get a fast answer, and that was a sensible choice. Tidying up afterwards is the other half of sharing safely, whether the answer was yes, no or “not yet”.

Step 1 of 4: Find every arrangement that’s still live

Start with a list, not a click. Most owners have more sharing arrangements than they remember: a lender’s application, an accounting app’s bank feed, a budgeting tool someone trialled last year.

Check these places:

Where to look	What you’ll find	Who it covers
Your bank’s online banking, under data sharing, open banking or security settings	Every recipient your bank is currently sending data to, and when each arrangement ends	Each bank separately. Check every bank you use
Emails titled something like “data sharing confirmation” or “CDR receipt”	The recipient’s name and a link to its dashboard	Each arrangement you approved
Your accounting software’s bank connections	Live bank feeds, which may or may not run through open banking	That software only
Your lender or broker’s paperwork	Which data service they used, and whether it was open banking or a login-based link	That application

The OAIC says each business taking part in the Consumer Data Right must give you an online consumer dashboard. On it you can withdraw or amend your consent, and ask for your data to be deleted once it’s no longer needed (OAIC — how the opt-in process works).

Step 2 of 4: Stop it at your bank

Your bank’s dashboard controls the authorisation, which is your permission for the bank to disclose data. The OAIC’s business guidance says withdrawing must be “simple and straightforward to use”, must be prominently displayed, and can’t be harder than giving the authorisation in the first place. Before you confirm, the bank must also show you a message explaining what withdrawing will mean (OAIC — consent, authorisation and dashboards).

In practice:

1. Log in to online banking, ideally on a computer so you can see the full list.
2. Open the data-sharing section and pick the arrangement.
3. Read the consequences message. If it’s an accounting feed you still rely on, this is where you’ll find out.
4. Confirm, then screenshot the “stopped” status with the date.

Company and partnership accounts: only a nominated representative can manage sharing for the business. If the person who approved sharing has since left, another nominee can still see and stop it. Our guide to setting up a nominated representative explains how that role works, and the CDR fact sheet sets out the rules.

Step 3 of 4: Withdraw consent and ask for deletion at the recipient

The recipient’s dashboard controls your consent, which is your permission for that business to collect and use the data. Under the OAIC guidance, this dashboard must let you withdraw consent and “elect” deletion of redundant data at any time.

That deletion election is the step most owners miss. Under the CDR rules, once data is no longer needed, the recipient generally has to delete or de-identify it. Its CDR policy has to say which it usually does, or whether it decides case by case. If you’d rather it was deleted than de-identified, say so. You can do that on the dashboard or by telling the business in writing (OAIC — CDR privacy and security).

A short written request works when you can’t find the dashboard:

“I withdraw my consent for [business name] to collect and use CDR data from [bank] accounts held by [entity name, ABN]. Please delete all redundant CDR data relating to these accounts and confirm in writing.”

Send it to the privacy contact listed in the recipient’s CDR policy, and keep a copy.

Stopping data sharing won’t hurt your credit file, and neither did starting it. If you’re weighing up finance again, check your options here. Enquiring doesn’t touch your credit file.

Step 4 of 4: Close the connections no dashboard shows

Not every bank-statement tool runs on the Consumer Data Right. Some services ask for your internet banking username and password and collect your statements that way. Those arrangements won’t appear on any CDR dashboard, because they’re outside it.

If you used one:

• Change your internet banking password. That ends any stored-login access straight away.
• Check the provider’s terms for ongoing or “refresh” access, and write to cancel it.
• Ask for deletion in writing using the provider’s privacy contact.
• Next time, ask the lender whether an open banking option is available. Our guide on whether it’s safe to give a lender your bank login compares the two methods.

Not sure which kind you used? Our bank-statement link page explains how to tell them apart.

What happens to a copy the lender already has?

This is where expectations need adjusting. CDR deletion rules apply to CDR data held by the accredited recipient. A lender often receives a report or summary built from that data. Once it’s in the lender’s credit file for your application, that copy generally falls under the lender’s own privacy and record-keeping obligations, not your CDR dashboard.

So:

• Live or settled loan: the lender will keep its assessment records. Withdrawing CDR consent stops new data from flowing to the recipient. It doesn’t erase the lender’s file, and it doesn’t cancel or change your loan.
• Declined or withdrawn application: ask the lender what it retains and why. If the no came from an automated system, our guide to what an instant decline usually means covers the next steps.
• Application still being assessed: don’t stop sharing yet. Cutting the data off mid-assessment is one of the quickest ways to stall a fast file.

Timing: when should you tidy up?

Your situation	When to stop sharing
Loan settled, no further drawdowns	Straight after settlement
Line of credit or facility with annual reviews	Ask the lender. Some prefer a fresh consent at review time over a 12-month rolling one
Declined	Once you’ve decided not to appeal or re-submit with that lender
Accounting app bank feed	Only if you’re replacing it with another feed. Otherwise your bookkeeping breaks
Old trial or tool you don’t recognise	Now

The OAIC notes that consent expires after 12 months regardless. Recipients can also only ask for the period “reasonably needed” for the service. Often that’s far shorter for a loan assessment, so some arrangements will already have ended on their own.

Why this matters more from November 2026

Open banking is spreading beyond banks. Under the Consumer Data Right rollout to the non-bank lending sector, non-bank lenders began sharing product data in July 2026, and consumer data sharing is being phased in from November 2026 (CDR — non-bank lenders rollout). Over time, your loan accounts with non-bank lenders become shareable data too, and that means more arrangements to keep track of.

The owners who move fastest on their next loan are usually the ones who know exactly what they’ve shared, with whom and until when. A quick tidy-up twice a year keeps that list short and accurate.

An illustrative example

Illustrative only. A salon owner in Ballarat runs her business through a Pty Ltd with two accounts at one bank. In March she shared both through open banking for a $40k unsecured fit-out loan, and the loan settled within the week.

In October, getting ready for a busy Christmas, she logs in and finds three live arrangements: the lender’s data partner, her accounting software’s feed, and a cash flow app she tried for a fortnight. She keeps the accounting feed, and stops the other two at the bank as the company’s nominated representative. On the lender partner’s dashboard she withdraws consent and chooses deletion. The trial app has no dashboard link she can find, so she emails its privacy contact using the request above. It takes 15 minutes, and her loan carries on exactly as before.

Data tidied? Now find out what’s possible

Owners who look after their data this carefully usually have the rest of their file in good order too, and that makes finance quicker when the next opportunity, bill or big order lands. If something’s coming up, now is a good time to find out where you stand.

The enquiry takes about 60 seconds. Asking leaves your credit file exactly as it is, because there’s no credit check when you first enquire. And in keeping with everything above, we don’t send your details to a pile of lenders, so your phone won’t light up with strangers. A real person reads your enquiry, looks at your business and calls you with a realistic pathway. They can also tell you which data-sharing route will be quickest for your bank.

Please fill the form in accurately: entity type, real turnover, time trading and roughly how much you need. Accurate details mean the first option we match is the right one, and any data you share later simply confirms what you told us. To see where the gaps are first, try the Speed Readiness Check, or read more about how open banking consent works.

Find out where you stand →