Consent Management Platform (CMP)
Software that a business uses to collect, record, honour and withdraw consent.
A consent management platform, or CMP, is software an organisation uses to ask for consent, store each person's choices as records, pass them on to other systems and let people change them later. It is a tool, not a legal status.
Meaning of Consent Management Platform (CMP)
A CMP typically shows consent requests, stores a record of what each person agreed to and when, passes the choice to downstream systems and lets people change their mind. A CMP is a tool. It is not the same as a Consent Manager registered under the Act.
The DPDP Act does not mention a CMP by name, but the duties it creates are exactly the ones a CMP is built to manage. Section 6 requires consent to be specific, informed and given by a clear affirmative action; Section 6(4) requires withdrawal to be as easy as giving; and Section 6(10) places on the Data Fiduciary the burden of proving that notice was given and consent obtained. A CMP gives the organisation a systematic way to meet and demonstrate each of these.
Typical functions are: presenting the notice and consent request in the user's chosen language, capturing granular choices by purpose, storing a time-stamped record with the notice version, exposing a preference centre where people review and withdraw, and sending the resulting signals to downstream systems such as email tools, analytics, advertising tags, CRM and processors. Good platforms also support audit reports, data-principal request workflows and integrations through APIs.
A CMP is different from a Consent Manager under the Act. A Consent Manager, defined in Section 2 and regulated by Section 6(7)–(9) and Rule 4, is a registered entity, accountable to the Data Principal, through which she can give, manage, review and withdraw consent across multiple Fiduciaries. A company's own CMP serves that company only. The Rules set conditions for Consent Manager registration, including a net worth threshold, and registration under Rule 4 is expected from November 2026.
Buying a CMP does not make an organisation compliant. The tool records and enforces whatever design it is configured with. A banner with misleading wording, a withdrawal flow that does not reach the data warehouse, or processors that ignore signals will still be failures of the organisation, because Section 8(1) keeps the Fiduciary responsible for processing done on its behalf, whatever software it uses.
Examples of Consent Management Platform (CMP)
A retailer's CMP records that a user consented to email but not SMS, and blocks SMS sends for that user.
The marketplace's CMP records that a shopper agreed to email offers but not SMS or push notifications. The email platform receives the choice in real time. When she withdraws email consent in settings, the CMP updates the record and the platform stops sending.
A bank uses a CMP across its mobile app, website and call centre. Every consent has a record with notice version and channel. When a customer files a grievance, the officer retrieves the full history in minutes.
A publisher uses a CMP to load analytics and ad scripts only after visitors choose. The platform blocks the scripts by default, logs choices, and sends monthly reports to the privacy team on how many visitors changed their settings.
Why Consent Management Platform (CMP) matters
Without a central system, consent often lives in scattered places: spreadsheets, form submissions, email threads, app databases. When someone withdraws or a regulator asks for proof, the organisation cannot answer quickly, and the burden of proof under Section 6(10) falls on it. Failures to honour withdrawals or to prove consent can be pursued as breaches carrying up to ₹50 crore in the residual penalty tier.
A well-run CMP reduces that risk and saves time. It shortens responses to rights requests, gives auditors a clean trail, and lets the business use data confidently because the permitted purposes are known. For customers, it means their choices actually travel through the organisation's systems rather than stopping at the website banner.
How it works in practice
- 1Start with requirements, not vendors: list the channels you collect consent through, the purposes, the languages needed, the systems that must receive signals, and your retention and audit needs.
- 2Check the platform against the Act: unticked controls, purpose-level choices, equal-weight refusal, access to notices in English and Eighth Schedule languages, withdrawal parity and time-stamped, versioned records.
- 3Integrate it with downstream tools through APIs or tag controls so that a withdrawal changes behaviour everywhere, including at processors, and test with sample users end to end.
- 4Secure the consent store with encryption, role-based access and logs, because it is personal data in its own right and falls under the safeguards in Rule 6.
- 5Check where the vendor stores data, which sub-processors it uses, and what its contract says about breach notice and deletion, since you remain accountable under Section 8(1).
- 6Review reports regularly: opt-in and withdrawal rates, failed signals, unresolved requests, and any consent screens that have drifted from the approved design.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming that installing a CMP equals compliance. The settings, wording and integrations decide whether consent is valid.
Confusing a CMP with a registered Consent Manager. Only registered entities under Rule 4 can use that status.
Storing consent logs without notice versions. Without them you cannot show what the person actually saw.
Not connecting the CMP to processors and marketing tools. A signal that stops at the platform changes nothing.
Compliance tips
Pilot the CMP on one journey, such as sign-up, and test withdrawal across systems before a wider rollout.
Keep an exit plan: make sure you can export consent records in a standard format if you change vendors.
Align retention of consent records with the periods in which disputes or audits are likely to arise, and document the reasoning.
Ask for a review by legal counsel of the default templates, because vendor defaults may not suit Indian requirements.
Common questions about Consent Management Platform (CMP)
Is a CMP mandatory under the DPDP Act?
No. The Act does not require any particular software. It requires valid consent, notice, withdrawal and proof, and a CMP is a practical way to manage these at scale. Small organisations with few consent points may meet the duties with simpler records, if they are reliable.
Is a consent management platform the same as a Consent Manager?
No. A Consent Manager is a person registered with the Data Protection Board under Section 6(9) and Rule 4, accountable to the Data Principal and operating across Fiduciaries. A CMP is software one organisation uses for its own consent. A vendor selling CMP software is not automatically a registered Consent Manager.
What should a CMP record for DPDP purposes?
At minimum, who consented, to which purposes, on which notice version, when, through which channel and by what action, plus any later withdrawal. Because Section 6(10) puts the burden of proof on the Fiduciary, these records are the evidence you may need to show.