What you are agreeing to when you share data for a loan

Online lending runs on consent. Every connection, every check and every share of information should happen because you agreed to it. The trouble is that consent screens are easy to tap through. Here is what you are actually agreeing to at each step, and how to keep control.

What kinds of consent will you give?

Consent	What it allows	How long
Enquiry form	Collection and use of your details to find suitable finance	Until the purpose is complete
Open banking connection	A lender reads specified bank accounts	As stated on the consent screen
Accounting app connection	A lender reads reports from Xero or MYOB	Until you disconnect
Identity verification	A provider checks your ID and selfie	For the check, with records kept as required
Credit check	A lender obtains your credit report	One-off; the enquiry is recorded
Loan documents	Ongoing monitoring, direct debits and security registration	For the life of the facility

What should a good consent screen tell you?

Before you approve anything, you should be able to answer five questions:

1. Who is asking for access?
2. What data exactly?
3. Why do they need it?
4. How long will access last?
5. How can you withdraw it?

If the screen does not answer these, ask. The Privacy Act 2020 expects organisations to tell you why information is collected and who will receive it, and to collect it in a fair way.

How does open banking consent work?

Regulated open banking is built around consent. You are sent to your own bank’s app or website, where you see the request and approve or decline. You never share your password with the lender. You can typically choose which accounts to include and later review or withdraw consent. If a lender’s request covers accounts that have nothing to do with the business, ask why before approving.

Why do accounting app connections need extra care?

Unlike a one-off data pull, a connection to Xero or MYOB usually stays in place until you remove it. That is useful for facilities such as invoice finance, which rely on live data. For a one-off loan assessment, it is good practice to disconnect once the decision is made. Check your connected apps every few months and remove any you do not recognise. See linking Xero or MYOB.

Ready to start with an enquiry that asks for consent only when it is needed? Begin here.

When should you consent to a credit check?

Only once you have decided to proceed with a specific option. A credit check is usually recorded as an enquiry on your credit file, visible to other lenders. Multiple checks in a short time can look like repeated declines. That is why our enquiry does not trigger one. Read credit checks explained for the details.

What about consent in the loan documents?

Loan agreements often include ongoing consents: to collect repayments by direct debit, to obtain updated information during the life of the loan, to register security on public registers, and to report repayment history to credit reporters. Read these clauses. They are standard, but you should know they are there.

Worked example (illustrative): a Hamilton bakery owner approves a bank connection for a loan assessment. The consent screen lists the business cheque account only, for 30 days. After approval, she checks her banking app, sees the consent listed with its expiry date, and also disconnects the lender’s app from Xero, which she no longer needs connected.

How do you withdraw consent?

• Open banking: through your bank’s consent management area in the app or internet banking, or through the service you connected with.
• Accounting apps: in the connected apps settings of Xero or MYOB.
• Marketing: use the unsubscribe link, or ask in writing.
• Personal information generally: ask the organisation; you also have the right to request access and correction.

Withdrawing consent may end an application in progress, because the lender can no longer verify information. That is your choice to make.

What red flags should stop you?

• A consent screen hosted on a site you do not recognise.
• Requests for your banking password instead of an approval inside your bank’s app.
• Access requested for far longer than the application needs.
• Consent bundled with unrelated marketing you cannot opt out of.

If any of these appear, pause and check. See online loan scams.

Who else might see your data?

Consent screens usually name the lender, but the data may also pass through service providers acting for it: the open banking intermediary, the identity verification company, the e-signing platform, the cloud storage provider. That is normal, and the Privacy Act 2020 expects the organisation that collected your information to keep it protected when service providers handle it. If you want to know who those providers are and where your data is stored — including whether it leaves New Zealand — ask. Information sent overseas needs comparable protection under the Act’s twelfth principle.

Is consent the same as a contract?

Not quite. Consent to share data lets the lender look at information. It does not commit you to borrowing. You can consent to a bank connection, see the outcome and still decide not to proceed. The binding commitment comes only when you sign loan documents.

Stay in control from the first click

Our 60-second enquiry asks only for what is needed to match you and runs no credit check. It is read by one team, not forwarded to a list of lenders, and a real specialist explains every consent before you are asked for it. Please answer accurately so later consents are limited to what really matters. See what you could qualify for.