Consent Knowledge Base

About this page

This page applies to the following related entities, which operate under common ownership:

Achieve Corporation Pty Ltd, ABN 20 624 448 317
Pro Payroll Pty Ltd, ABN 68 629 399 328

In this page, “we”, “us” and “our” refer to whichever of those entities provides your services.

Each of these businesses operates its own separate data sharing connection. If you receive services from more than one of them, you will be asked to give consent separately for each, and each consent can be changed or withdrawn on its own without affecting the others.

This page explains how we collect and handle banking data shared with us under the Consumer Data Right, what you agreed to when you gave consent, and how you can change or withdraw that consent at any time.

It sits alongside, and does not replace, our Privacy Policy, which covers all other personal information we hold.

Effective date: 7 September 2026

1. Introduction to the Consumer Data Right

The Consumer Data Right (CDR) is an Australian law that gives you the right to share data that a bank or other business holds about you, with a business you choose, in a safe and controlled way. In banking, it is often called Open Banking.

The CDR is overseen by the Australian Competition and Consumer Commission (ACCC) and the Office of the Australian Information Commissioner (OAIC). It sets privacy safeguards and rules that:

ensure your data is collected, transferred and stored securely
give you control over what data is shared, who it is shared with, and what it is used for
require any business receiving your data to tell you plainly what it will do with it
give you the right to withdraw your consent at any time

Sharing your data under the CDR is always your choice. You do not have to share it, and choosing not to share it does not stop us providing your payroll services. It means we will use another method to obtain the bank information we need, such as you providing statements to us directly.

Accredited Data Recipients

An Accredited Data Recipient (ADR) is an organisation approved under the CDR framework to receive and handle consumer data. Accreditation is granted by the ACCC and carries strict, legally binding obligations. An ADR must:

tell you clearly and honestly how your data will be used
collect only the data it genuinely needs, for only as long as it needs it
store and transfer your data securely
obtain your express consent before collecting anything, and honour any withdrawal of that consent

Who receives your data, and our role

We are not an Accredited Data Recipient in our own right.

Your banking data is collected by Basiq Pty Ltd, an Accredited Data Recipient under the Consumer Data Right, accreditation number ADRBNK000208. We access that data as a CDR Representative of Basiq, under a written arrangement with them.

What this means for you in practice:

The consent screens you see when you connect your bank account are provided by Basiq and display Basiq’s name and accreditation number.
Basiq collects your data from your bank and passes it to us for the purposes you consented to.
We are contractually bound, through our arrangement with Basiq, to handle your data under the same CDR rules that apply to Basiq.
Basiq’s own CDR Policy explains their handling of your data and is available at Basiq’s Consumer Data Right (CDR) Policy.

We do not ever see, receive or store your bank login details. Your username, password and any security codes are entered with your bank or with Basiq, and are never disclosed to us.

2. Your rights

Under the CDR you have the right to:

Choose. Decide whether to share your data at all, and which accounts to share.
Know. Be told what data is being collected, why, and for how long it will be held.
Control. Review your active consent at any time, and change or withdraw it.
Be forgotten. Ask us to delete or de-identify the data we hold about you.
Complain. Raise a concern with us, with Basiq, or with the OAIC.

Withdrawing consent is free, and we will not treat you differently for doing so.

3. What data we collect, and why

Who this applies to

Consent under the CDR is given by a director or authorised representative of a company we provide payroll services to, in relation to that company’s business bank accounts. We do not ask employees or contractors who are paid through our services to share their personal bank data under the CDR.

Why we collect it

We collect your business banking data for one purpose: to operate the payroll and payment services you have engaged us to provide. Specifically, we use it to:

confirm that cleared funds are available in your account before we make payments on your behalf
make and verify payments of wages and salaries to your employees and contractors
make and verify payments of superannuation contributions
make and verify payments of PAYG withholding and other tax obligations
make and verify payments of supplier invoices and other bills where we administer them for you
reconcile all of the above against your account, so that your payroll records match what actually left your bank account

Accurate reconciliation is what allows us to identify a failed, duplicated or mismatched payment quickly, and to give you and your accountant records that agree with your bank.

What we collect

With your consent, we collect from your nominated business accounts:

Account details (account name, BSB, account number, account type) — to identify the correct account and match payments to it
Account balance (current balance and available funds) — to confirm funds are available before we release a payment run
Transactions (date, amount, description, reference, and whether it was money in or out) — to reconcile payroll, super, tax and bill payments against your account
Your contact and business details (your name, contact details, and your business name and ABN or ACN) — to confirm you are authorised to share the account, and to link the account to the correct business

Why this is the minimum we need

We have deliberately limited what we ask for.

We only request access to the business accounts you nominate. We do not ask for your personal accounts, and we do not ask for accounts unrelated to your payroll.
We only request balances and transaction records, because reconciliation cannot be done without knowing what money moved and what remains.
We do not request or use data about loans, mortgages, credit cards, investments, insurance or savings products.
We do not use your data to assess your creditworthiness, to build a profile of your spending, or to make decisions about you.

What we do not do

We do not:

sell your data, or share it for anyone’s marketing purposes
use your data to market other products to you
disclose your data to any other party, except where we are required to by law or where it is necessary to carry out a payment you have instructed
use your data for any purpose other than those listed above

4. Managing your consent

You stay in control of your consent for as long as we hold it. You can review it, change which accounts are shared, or withdraw it entirely, at any time and at no cost.

Manage your consent yourself

When we first asked you to connect your bank account, we sent you an email containing a manage consent link. That link is the quickest and most direct way to:

see what you have agreed to share, and when your consent is due to expire
change which accounts are shared
withdraw your consent entirely

You do not need a login to our systems to use it. The link takes you to the consent management service operated by Basiq, the Accredited Data Recipient described in section 1.

Please keep that email. If you no longer have it, contact us using the details below and we will send you a new link.

Ask us to action it for you

If you would prefer us to make the change on your behalf, contact us. We will verify your identity, action the change, and confirm in writing once it is done.

By email
privacy@achievecorp.com.au
Please include your name, your business name, and what you would like to change.

By telephone
02 6264 8200, Monday to Friday, 9.00am to 5.00pm AEST/AEDT
Ask for the Privacy Officer.

Through your bank

You can also withdraw consent directly through your bank, using your bank’s own data sharing controls. If you do that, data sharing stops immediately and we may not know why, so we would appreciate you telling us as well, so we can talk to you about how we will get the information we need to keep your payroll running.

What happens when you withdraw consent

As soon as we action your withdrawal:

No further banking data is collected from your account. This takes effect immediately.
Your consent is revoked with Basiq, and Basiq destroys or de-identifies the data it holds.
We handle the data already in our systems as described in section 5 below.
We contact you to arrange another way of obtaining the bank information your payroll requires, so that your employees, super and tax payments are not disrupted.

If your consent expires

Consent under the CDR is given for a set period and does not last indefinitely.

Before your consent is due to expire, and again once it has expired, we will ask you to give a new consent if you would like data sharing to continue. If you take no action, the consent lapses on its expiry date, no further banking data is collected, and we treat it the same way as a withdrawal.

5. Data retention and deletion

We stop collecting straight away

When your consent ends, whether because you withdrew it, because it expired, or because your company stopped using our services, no further banking data is collected from that point. Once a consent has ended we are no longer able to retrieve new data from your account.

Why we keep the data we already hold

We are required by law to keep records of the services we have provided to you. Two separate obligations apply.

Tax agent record keeping. Achieve Corporation Pty Ltd is the registered tax agent for both businesses, and tax agent services provided to Pro Payroll clients are provided under that registration. Under section 30 of the Tax Agent Services (Code of Professional Conduct) Determination 2024, a registered tax agent must keep records that correctly record the tax agent services provided to each of its clients, including former clients. Those records must show the nature, scope and outcome of the service, and must reference the information reasonably considered in providing it. They must be kept for at least five years.

Employment record keeping. Our service includes the full outsourced administration of your payroll company, including maintaining the employer’s books and records and making payroll and supplier payments on your behalf. Under the Fair Work Act 2009 and the Fair Work Regulations 2009, an employer must keep time and wages records for seven years. These include records of pay, hours worked, superannuation contributions, leave and the ending of employment. Because we carry out that record keeping for you, we must hold those records for the same period.

The banking data we received under your consent forms part of both records. It is the evidence of the payroll, superannuation, tax and supplier payments we made on your behalf, and of the reconciliation we carried out.

By default we therefore retain it for seven years, being the longer of the two periods. The seven years runs from the later of the date you withdraw your consent and the date you stop using our services.

While we hold it:

it is used only to evidence and support the payments already made, and to meet our record-keeping, audit and tax obligations
it is not used for any new purpose
it is not used to make decisions about you
access is restricted to staff who need it for those obligations
it is protected by the security measures described in section 6

You can ask us to destroy it earlier

The seven year period exists because we keep your employment records for you. That obligation is yours as the employer, so if you ask us to destroy our copy, the responsibility for holding those records returns to you and we will action your request.

We cannot go below five years. The tax agent obligation applies to Achieve Corporation directly rather than to you, so it is not ours to set aside at your request.

In practice this means:

for the first five years we must keep the data, even if you ask us to destroy it
between five and seven years we will destroy it if you ask us to
at seven years we destroy it automatically, without you needing to ask

Whenever we destroy your data at your request, we will confirm in writing what has been destroyed and, if any part must be retained, what it is and why.

You can ask us for a copy at any time

You can request a copy of the banking data we hold about you at any time, including after your consent has ended and after your company has stopped using our services. Contact our Privacy Officer using the details in section 8 and we will provide it in a usable format.

What happens after seven years

Once the seven year period has ended, the data is permanently destroyed through a controlled, approved deletion process, together with the other records for your business. The deletion is irreversible and is recorded, so that we can demonstrate it happened.

Important: if you ask us to delete your data early

Asking us to destroy your data early does not change what you are required to keep.

Under the Fair Work Act 2009 and the Fair Work Regulations 2009, an employer must keep time and wages records for seven years. These include records of pay, hours worked, superannuation contributions, leave and the ending of employment. That obligation rests with you as the employer.

If we destroy our copy at your request during the five to seven year window, you will still be required to hold those records and we will no longer have them. Please make sure you keep your own copies of your payroll records, and do not rely on us as your only source.

If you would like a copy of anything we hold before we destroy it, ask us at any time and we will provide it.

6. How we protect your data

Your banking data is held to the same standards as the rest of the sensitive financial information we hold, which is described in our Privacy Policy. Measures include:

encryption of data in transit and at rest
access controls and multifactor authentication, with access limited to staff who need it
system monitoring, logging and alerting
secure, access-controlled backups
due diligence and contractual protections applied to our technology providers
documented incident response and breach notification procedures
staff training and confidentiality obligations

If we become aware of a data breach likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as required under the Notifiable Data Breaches scheme.

No system is completely secure. If you believe your data or your access to our systems has been compromised, contact us immediately using the details below.

7. Complaints

If you are unhappy with how we have handled your data, please contact our Privacy Officer using the details below. We aim to acknowledge complaints within five business days and to give you a substantive written response within 30 calendar days.

You can also complain to:

Basiq, as the Accredited Data Recipient, using the contact details in their CDR Policy
the Office of the Australian Information Commissioner, at www.oaic.gov.au or 1300 363 992

8. Contact us

Privacy Officer
Achieve Corporation Pty Ltd
PO Box 4833, Kingston ACT 2604
Email: privacy@achievecorp.com.au
Telephone: 02 6264 8200

The same contact applies for Pro Payroll Pty Ltd.

9. Related information

Achieve Corporation Privacy Policy
Basiq Consumer Data Right (CDR) Policy
Tax Agent Services (Code of Professional Conduct) Determination 2024
Fair Work Ombudsman, record-keeping obligations for employers
Consumer Data Right, official information: www.cdr.gov.au
Office of the Australian Information Commissioner: www.oaic.gov.au

This page is reviewed at least annually and whenever our data handling practices change. Last updated: 7 September 2026.