Section 3 illustrates provisions that data regulations under section 2 may, among other things, contain. Data regulations do not have to contain all of these provisions, neither are they limited to them.
	Subsection (2) envisages that regulations may include: provisions about the procedure by which customers authorise a person to access their data or otherwise act on their behalf (paragraph (a)); provisions restricting the persons that a customer may authorise to those complying with conditions specified by or under the regulations (paragraph (b)); and provisions for a person (a decision-maker) to decide whether a person satisfies those conditions (paragraph (c)). Paragraph (c) envisages the possibility of a system of accreditation for third party recipients: if so, section 6 (decision-makers) will apply and that section contains further provisions and requirements about decision-makers.
	Subsection (3) envisages provisions about the making of requests relating to customer data: the regulations may, for instance, impose requirements as to how requests may be made. Subsection (3) also envisages that regulations may provide circumstances in which a data holder may or must refuse to act on a request: such circumstances might, for instance, include unfounded or excessive requests.
	Subsection (4) envisages provisions about how customer data is to be provided and action is to be taken on the customer’s behalf in accordance with regulations under section 2(4).
	Subsection (4)(a) envisages that customer data may be provided on one or more occasions, for a specified period (e.g., continuously available for a set amount of time) or at specified intervals.
	Subsection (4)(b) envisages requirements for the use of specified facilities or services, including electronic communications services or application programming interfaces (see section 25(1)) (APIs). APIs are software intermediaries that allow two applications to talk to each other, e.g. share data and typically adhere to standards that are developer- friendly and easily accessible. Banks in scope of the CMA’s Retail Banking Market Order were required to comply with API standards that were designed by a separate implementation body, to ensure the timely sharing of customer data.
	Subsection (4)(c) envisages requirements on data holders and third party recipients to comply with specified standards, or participate in specified arrangements, relating to, or to the use of, those facilities or services. For example, data holders and third party recipients may be required to participate in the design and implementation of mechanisms or protocols that allow for efficient and timely provision of data. Using the example of APIs, data holders may be required to establish and maintain their APIs in alignment with standards prescribed or identified in the regulations.
	Subsection (4)(d) envisages requirements on data holders and third party recipients to provide for, or arrange, specified assistance in relation to establishing, maintaining or managing those facilities or services. Subsection (11) provides that assistance may include actual or contingent financial assistance and gives examples of such assistance.
	Subsection (4)(e) envisages provisions about interface bodies. These are dealt with in section 7 (interface bodies). Interface bodies may undertake the tasks in subsection (1) of that section.
	Subsection (5) envisages provisions requiring or enabling data holders and third party recipients to produce, collect, or retain records of their provision or (as the case may be) receipt of customer data.
	Subsection (6) envisages that a person who processes customer data may be required to assist a trader in complying with the regulations.
	Subsection (7) envisages requirements about the processing of customer data provided to third party recipients. Paragraphs (a) to (c) envisage requirements on third party recipients reflecting paragraphs (b) to (d) of subsection (4) with subsection (11) applying in relation to the specified assistance referred to paragraph (c). Paragraph (d) envisages requirements about interface bodies in accordance with section 7. Paragraph (e) envisages requirements about further disclosure of customer data including for "downstream" data recipients to be subject to some or all requirements imposed by the regulations on third party recipients or to conditions imposed on them by the third party recipient.
	Subsection (8) envisages provisions enabling or requiring a data holder or third party recipient to publish specified information about rights and obligations under the regulations. Such provisions may be important, for instance, to require traders to draw customers’ attention to their rights and how they may be exercised.
	Subsection (9) envisages provision about complaints which may include a requirement for data holders and third party recipients to implement complaints procedures (decision-makers may also be required to implement such procedures under section 6(7)).
	Subsection (10) envisages provision for dispute resolution. This may include appointing a person to determine disputes, with provisions about their powers when determining disputes, the effect of decisions relating to disputes, and provisions about review of decisions and for appeals to a court or tribunal. By way of example, a person determining a dispute may be a recognised ombudsman in a given sector, or simply an alternative dispute resolution (ADR) provider.
	Subsection (11) is explained in the context of subsections (4)(d) and (7)(c).
Part 1: Access to Customer Data and Business Data Data regulations Section 3: Customer data: supplementary