A person is an accredited data recipient , of CDR data, if:
(a) the person is an accredited person; and
(b) the CDR data is held by (or on behalf of) the person; and
(c) the CDR data, or any other CDR data from which it was directly or indirectly derived, was disclosed to the person under the consumer data rules; and
(d) the person is neither a data holder, nor a designated gateway, for the first-mentioned CDR data.
Note: For paragraph (d), the person will be a data holder of that CDR data if subsection 56AJ(4) applies.