Consent management: how to answer it in a security questionnaire

What is consent management?

Consent management is how an organization collects, records, and honors people's permission to process their personal data. Under GDPR, valid consent must be freely given, specific, informed, and as easy to withdraw as to give. A consent management platform (CMP) is software that handles this, most often for website cookies.

What the buyer is really asking

First work out whose consent the buyer means. Under GDPR a B2B processor usually relies on the customer to collect consent from their own users. Explain your role and describe any consent you collect directly, such as cookies or marketing email.

Other ways buyers ask it

Every one of these wants the same answer:

• →“How do you obtain and manage consent?”
• →“How are consent preferences recorded and honored?”
• →“Can users withdraw consent?”
• →“Do you use a consent management platform?”

Evidence to have ready

• Your cookie banner or consent platform configuration
• The lawful basis section of your privacy notice
• Records showing how consent withdrawals are processed

Related privacy and compliance questions

• What privacy notices do you provide?
• Do you claim rights to use customer data for your own purposes?
• Do you sell customer data to third parties?
• Do you sign Business Associate Agreements (BAAs) with customers?

All privacy and compliance questions →