Data Mobility Framework in Consumer-Driven Banking: Cybersecurity & Data Impacts

Historical context: written in January 2026, this article discusses measures proposed in Bill C-15, introduced on November 18, 2025. The bill received royal assent on March 26, 2026. The obligations below describe the framework proposed in January; implementation depends on applicable commencement provisions, regulations and accreditation.

Canada’s consumer-driven banking framework was proposed through the Budget Implementation Act introduced in November 2025, including a proposed Consumer-Driven Banking Act (“CDBA”) and the establishment of the Consumer-Driven Banking System (“CDBS”). Together, these measures would create a regulated data mobility framework that enables consumers to direct the secure sharing of their financial data within a defined and supervised ecosystem.

How the Consumer-Driven Banking Framework Operates

At its core, the framework operates on a participation and accreditation model. Only entities that are formally accredited may participate in the CDBS and engage in regulated data sharing. Once accredited, a participating entity must, subject to limited exemptions, share a consumer’s data with other participating entities at the consumer’s direction.

The Act empowers the Bank of Canada, through regulation and designated mechanisms, to accredit banks, financial institutions, registered payment service providers, and fintechs that meet the prescribed requirements. Accreditation is not automatic. It may only be granted where the Bank is satisfied that an entity complies with applicable technical standards, governance expectations, and security safeguards.

This structure makes clear that data mobility under the CDBA is not an open-ended portability right. Instead, it functions within a controlled system in which access, interoperability, and data sharing are conditioned on ongoing compliance, oversight, and accountability.

Interaction with Federal Privacy Law

In parallel, the Budget Implementation Act proposed a new data mobility right under section 10.4 of the Personal Information Protection and Electronic Documents Act (“PIPEDA”). This amendment would provide the privacy law foundation that allows an individual to require an organization to disclose their personal information to another designated organization, where both entities are subject to an approved data mobility framework.

In practice, PIPEDA supplies the legal “railway” that enables consumer-driven banking by supporting lawful interoperability, standardized data transfers, and the adoption of minimum cybersecurity requirements across participating entities.

As of January 2026, these measures remain proposed, and the consumer-driven banking system will be operationalized on a phased basis through regulation and accreditation. Organizations intending to participate must therefore understand how cybersecurity, data governance, and incident response capabilities will be assessed as part of the accreditation process.

Data Security Obligations

The CDBA establishes a prescriptive security framework that directly ties accreditation to an organization’s technical, governance, and cybersecurity posture. For participating entities, security safeguards are not merely baseline compliance requirements but ongoing conditions of market access.

Accreditation under the Act is conditional on compliance with technical standards and security safeguards set out in regulation. The Bank may only accredit an institution if these requirements are met, positioning cybersecurity readiness as a prerequisite for participation.

Prior to any data sharing, participating entities must verify the consumer’s authentication information, reinforcing strong identity and access management controls.

Participating entities must implement prescribed security safeguards and proactively notify the Bank of any change that could significantly affect compliance, introducing a forward-looking notification obligation that extends beyond traditional breach reporting.

Each participating entity must designate an internal officer or employee responsible for implementing and overseeing security safeguards, signaling a clear expectation of internal accountability.

Data sharing must be architected to prevent receiving entities from editing or altering data on the systems of the providing entity, reinforcing data integrity and control.

Failure to comply with these requirements may result in revocation of accreditation, triggering mandatory consumer notifications and potential disruption to business operations.

Incident Response & Breach Management

The consumer-driven banking framework imposes specific requirements on how participating entities must manage, investigate, and report security incidents involving shared consumer data. These obligations apply at both the consumer and system levels.

Participating entities must implement policies and procedures to mitigate harm to consumers following a breach of security safeguards, including escalation, remediation, communications, and post-incident processes.

Article 82 requires notification to consumers where a breach creates a real risk of significant harm. This obligation applies to a broader category of data than “personal information” under PIPEDA, creating potential overlap with existing breach notification regimes.

Independently of consumer notification, any breach of security safeguards must be reported to the Bank of Canada, regardless of whether significant harm has been identified.

“Significant harm” includes financial loss, identity theft, adverse credit effects, damage to property or reputation, and loss of employment or professional opportunities.

Article 83 requires investigation of every breach related to consumer data sharing, including identification of recurrent or systemic issues and reporting of investigation outcomes to the Bank.

Article 84 further requires notification to the Bank of any recurrent or systemic issue that could affect the integrity of the consumer-driven banking system.

Where multiple legal frameworks apply, clear data mapping and incident classification will be essential to meet overlapping investigation and reporting obligations.

Third-Party Risk Management

Articles 31 to 42 establish an accreditation regime for third-party service providers and prohibit participating entities from using non-accredited providers for certain core activities, including:

• Obtaining or managing consumer consent on behalf of a participating entity
• Confirming or managing consumer authentication
• Providing or receiving consumer data on behalf of a participating entity

Third-party service providers must be accredited by the Bank in accordance with regulations to be issued, and a registry of approved providers will be maintained. Accreditation decisions may be reviewed or revoked, including on national security grounds. Where accreditation is revoked, service providers are required to notify consumers.

Data Sharing Requirements

Consent is a central control mechanism under the CDBA and a prerequisite to lawful data sharing within the system.

Article 85(1) requires explicit consumer consent before requesting data from another participating entity. Mere use of a product or service does not constitute valid consent.

Participating entities must provide user-friendly mechanisms to grant, renew, withdraw, and manage consent, including requests to cease data sharing.

Organizations must maintain a single consolidated location containing up-to-date information on data recipients, data scope, and consent duration.

Public-facing disclosures, including website notices, must inform consumers of consumer-driven banking measures.

Article 92(2) prohibits conditioning data sharing on consent to receive products or services.

Upon withdrawal or expiration of consent, participating entities must cease data sharing and delete data for which renewed consent has not been obtained.

In addition, Article 76(2) requires compliance with applicable technical standards. Article 125(1) authorizes the adoption of regulatory standards, including through delegation to designated bodies. While these standards remain forthcoming, the Act requires them to address security, efficiency, fairness, accessibility, transparency, and governance.

Liability Framework

The CDBA establishes a liability regime based on control of data, rather than contractual delegation.

Consumers are not liable for financial losses resulting from unauthorized access or use of their data unless they have demonstrated gross negligence (or, in Quebec, gross fault).

Where the consumer is not at fault, liability rests with the participating entity that controlled the data at the time of the incident. Use of a third-party service provider does not, by itself, transfer control.

A controlling participating entity is liable for financial losses caused by a breach of its security safeguards during data sharing.

The Act does not expressly address unauthorized disclosure or non-safeguard-related incidents, leaving these risks to be addressed contractually.

This liability model is expected to increase due diligence, contractual assurances, and insurance requirements across the consumer-driven banking ecosystem. Article 133(1) further provides that prescribed information disclosed for supervisory purposes is privileged and cannot be used as evidence in civil proceedings.

Preparing for Consumer-Driven Banking Implementation

As the consumer-driven banking framework is operationalized through regulation, accreditation, and technical standards, organizations will need to assess their readiness across cybersecurity, data governance, incident response, and third-party risk management. Many of the most consequential requirements—particularly those relating to security safeguards, accreditation conditions, and system-level incident reporting—will apply before data sharing begins in practice.

We support financial institutions, fintechs, and service providers in preparing for participation in the consumer-driven banking system by conducting regulatory readiness assessments, reviewing security and incident response frameworks, and identifying gaps against anticipated accreditation and technical standards. This includes aligning governance structures, internal accountability, and vendor arrangements with emerging regulatory expectations.

Given the phased nature of implementation and the continued development of regulations and standards, ongoing monitoring will be critical. We regularly track legislative and regulatory developments affecting consumer-driven banking, data mobility, and cybersecurity, and share updates as the framework evolves.

To receive updates on consumer-driven banking regulations, accreditation requirements, and cybersecurity obligations, subscribe to our newsletter or contact us to discuss readiness planning.

This article provides general information and does not constitute legal advice.