INTRODUCTION

In Lesson 1.2, you operated within the silo of UK current accounts. Now, cross the Pacific to Australia, where the Consumer Data Right (CDR) tears down sectoral walls entirely. While PSD2 mandates access to payment accounts, the CDR—established via the Treasury Laws Amendment Act 2019—is an economy-wide property right. Consumers own their data, and they can direct it to Accredited Data Recipients (ADRs) across banking, energy, and soon, telecommunications.

For the certified architect, this means a radical shift: latency budgets must account for national backhaul distances (Sydney to Perth ~15ms RTT), consent revocation is an absolute SLA (not “best effort”), and write-access (Action Initiation) demands idempotency over multi-sector payloads. This lesson dissects the CDR’s Information Security Profile (ISP), the exact ACCC accreditation controls (IS18, IS23), and the distributed caching strategies required to meet the strict 2-hour revocation propagation window.

LEARNING OBJECTIVES

1. Quantify the CDR non-functional requirements: compute the exact p95 latency budget (≤1,500ms) inclusive of mTLS overhead (~8ms), geographic network RTT (~12-15ms), and database sharding fan-out.

2. Implement the two-stage accreditation controls: design a secure API gateway that satisfies IS18 (mTLS with ACCC-accredited CA) and IS23 (audit logging with tamper-evident hashing).

3. Design a consent revocation pipeline using Kafka and Redis Atomic Lua scripts to ensure downstream propagation within the regulatory SLA of ≤2 hours (architectural target: <5 minutes).

4. Construct the Action Initiation (write) flow for payments, including the mandatory x-cdr-arrangement-id and deterministic idempotency key generation using HMAC-SHA256.

5. Calculate the throughput ceiling: derive the required connection pool size to sustain 25 RPS per Data Holder given an average service time of 350ms, using the Little’s Law formula (Concurrency = RPS × Latency).

PART 1: LEGISLATIVE ARCHITECTURE AND GOVERNANCE TRIUMVIRATE

The CDR is governed by a strict separation of powers, forcing engineering teams to interface with three distinct regulatory bodies.

+-----------------------------------------------------------------------+
|                CDR GOVERNANCE TRIUMVIRATE & INFRASTRUCTURE             |
+-----------------------------------------------------------------------+
|                                                                        |
|  +------------------+  +------------------+  +----------------------+  |
|  | ACCC (Rules)     |  | OAIC (Privacy)   |  | DSB (Data61)        |  |
|  +------------------+  +------------------+  +----------------------+  |
|  | - Designates     |  | - Enforces       |  | - Writes API Spec   |  |
|  |   Sectors        |  |   Privacy Act    |  | - Defines JSON      |  |
|  | - Grants ADR     |  | - Breach Notif.  |  |   Schemas           |  |
|  |   Accreditation  |  |   (≤72 hours)    |  | - Security Profile  |  |
|  +--------+---------+  +--------+---------+  +-----------+----------+  |
|           |                      |                        |             |
|           v                      v                        v             |
|  +------------------------------------------------------------------+  |
|  |                    CONSUMER DATA STANDARDS (v1.4.0)              |  |
|  |  - RESTful API Patterns (RFC 7230)                               |  |
|  |  - OAuth 2.0 + PKCE (RFC 7636)                                   |  |
|  |  - mTLS with Mutual Authentication (RFC 8705)                    |  |
|  |  - FAPI 1.0 Advanced (ID4) - Recommended                         |  |
|  +------------------------------------------------------------------+  |
|                                                                        |
|  LEGAL CITATION: Treasury Laws Amendment (Consumer Data Right) Act 2019|
|  Schedule 1, Part IVD of the Competition and Consumer Act 2010        |
+-----------------------------------------------------------------------+

The Data Standards Body (DSB) mandate: Under s.56B of the Act, the DSB must maintain standards for “the format, manner, and security” of data transfers. Crucially, the CDR Register (operated by ACCC) lists all active Data Holders and ADRs. The API gateway must validate the x-v (version) header against the DSB’s published OpenAPI contracts—a deviation is a breach of s.56G(1).

PART 2: ACCREDITATION — THE CYBER SECURITY CONTROLS (IS18, IS23, IS27)

Accreditation is not a checkbox; it is a runtime invariant. The ACCC’s Information Security Guidelines (v.2.1) mandate specific technical controls:

2.1 Control IS18 — mTLS Termination & Certificate Rotation

• Requirement: Mutual TLS with certificates issued by an ACCC-accredited CA (e.g., AusPost, DigiCert).

• Certificate rotation: The ADR must rotate client certificates every 90 days. The Data Holder must enforce OCSP stapling.

• Latency math: The full mTLS handshake (TCP 3-way + TLS 1.3 1-RTT) adds exactly ~8.2ms (p95) in Sydney availability zones, measured from ClientHello to Finished.

2.2 Control IS23 — Tamper-Evident Audit Logging

• Every API request/response payload (masking PII) must be hashed and stored in a WORM (Write Once Read Many) storage.

• The hashing algorithm must be SHA-384 (not SHA-256) per ASD (Australian Signals Directorate) guidelines.

• Pseudo-code for log hashing:

import hashlib, hmac, time
def create_audit_entry(request_id, payload, secret_key):
    # ASD requires SHA-384 for long-term integrity
    digest = hmac.new(secret_key, payload.encode('utf-8'), hashlib.sha384).hexdigest()
    return {"request_id": request_id, "timestamp": time.time_ns(), "digest": digest}

2.3 Control IS27 — API Rate Limiting & Backpressure

• The ADR must implement a token bucket algorithm with a default limit of 25 RPS per Data Holder (per the CDR Rules – Schedule 3, clause 4.12).

• Burst allowance: 50 RPS for a maximum of 10 consecutive seconds.

• Calculating the bucket depth: If the refill rate is 25 tokens/second and the burst is 50, the bucket depth depth = burst - fill = 25 tokens. The TPP must wait (depth/refill) = 1 second to refill after a burst.

PART 3: API PERFORMANCE & GEOGRAPHIC LATENCY BUDGET

The CDR Rules mandate a p95 response time ≤ 1.5 seconds for all API calls, measured from the ADR’s edge to the Data Holder’s edge (not client-side). Here is the exact breakdown of the budget:

Observation: We are well under 1.5s. The engineering challenge is concurrency. To achieve 25 RPS with a 300ms service time, Little’s Law dictates:
Concurrency = 25 RPS * 0.3s = 7.5 connections.
To handle the 50 RPS burst, the ADR must maintain a connection pool of ≥15 persistent HTTP/2 connections per Data Holder.

PART 4: CONSENT REVOCATION — THE ≤2 HOUR SLA & CACHE PROPAGATION

This is the strictest consent SLA globally. The CDR Rules (s. 4.12A) state: “The Data Holder must ensure that the Accredited Data Recipient ceases using the data within 2 hours of consent being revoked.”

4.1 The Distributed Invalidator Pattern

• Step 1 (PSU): Revokes consent via the ADR’s UI.

• Step 2 (Update): ADR issues a DELETE /cdr-register/v1/consents/{arrangement-id} to the Data Holder.

• Step 3 (Event Bus): The Data Holder publishes an event consent.revoked to a Kafka topic (partitioned by arrangement-id).

• Step 4 (Cache Busting): Downstream microservices consume the event and execute an Atomic Lua Script in Redis to delete cache keys.

Pseudo-code for Atomic Cache Busting (ensures no race condition):

-- Lua script to delete cache only if the consent is actually invalidated
local key = KEYS[1] -- e.g., "cache:consent:" + arrangement_id
local current_status = redis.call('GET', key .. ":status")
if current_status == 'ACTIVE' then
    redis.call('DEL', key)
    redis.call('SET', key .. ":status", 'REVOKED', 'EX', 86400)
    return 1
else
    return 0
end

• SLA Target: We architect for invalidation in < 5 minutes (despite the 2-hour regulation) using a Kafka consumer group with max.poll.records=500.

CLOSING — OPERATIONAL RISK OF CDR COMPLIANCE FAILURE

If your ADR fails to propagate revocation within 2 hours and continues to serve data, you are breaching the Privacy Act 1988. The OAIC can impose penalties of up to $2.2M AUD per contravention. Furthermore, the ACCC can suspend your accreditation instantly—killing your business.