What is a Consent Management Platform (CMP)?

A Consent Management Platform (CMP) is software that asks people for their consent, records exactly what they agreed to, and makes sure your business respects that choice everywhere it uses their data. Under India’s DPDP Act, a CMP is how a business shows that every yes was asked clearly, given freely and can be changed any time.

This guide explains what a CMP does, how it differs from a cookie banner, what DPDP expects in plain terms, and what to look for when you choose one.

What does a CMP actually do?

A CMP does five jobs. If a tool skips one, it is only part of a CMP.

1. Tell people. Show a clear notice: what you collect, why, and who to contact.
2. Ask per purpose. Offer a separate choice for each reason you use data, such as responding to a demo request or sending product updates.
3. Record the answer. Keep a time-stamped record of who agreed to what, on which version of the notice.
4. Honour changes. When someone withdraws, that choice reaches every place that uses their data.
5. Prove it. Give the person a receipt, and give you a record you can show when someone asks.

Why DPDP makes a CMP matter

The DPDP Act is built around people having a real say in how their data is used. In everyday terms, it expects a business to:

• Tell people what data you collect and why, in language they understand.
• Ask for a clear yes for each purpose, not one bundled tick-box.
• Let people say no without being locked out of the basics.
• Make withdrawing consent as easy as giving it.
• Respond when people ask to see, correct or delete their data.
• Be able to show a record of all of the above.

Doing this by hand across forms, cookies and emails quickly turns into spreadsheets and guesswork. A CMP does it in one place.

CMP vs cookie banner: what is the difference?

A cookie banner is one small part of consent. A CMP covers the whole journey.

	Cookie banner	Consent Management Platform
Where it works	Your website	Website, forms, apps and emails
What it asks	Cookie categories	Every purpose you use data for
Record kept	Often none, or a browser setting	Time-stamped record per person and purpose
Withdrawal	Re-open the banner	One preference page that updates everywhere
Data requests	Not covered	Access, correction and erasure handled with a clock
Proof	None	Receipts and an exportable record

If you only have a banner, you have the first step. A CMP completes the rest.

What to look for in a CMP

Use this as a checklist when you compare options:

• Built for India. Notices in Indian languages, not just English, and wording that fits DPDP.
• Per-purpose consent. Separate, unticked boxes for each purpose.
• A permanent record. An append-only log, so entries cannot be quietly edited.
• Receipts. The person gets proof of what they agreed to.
• Easy withdrawal. One link, one click.
• Data requests included. Access, correction and erasure in the same tool.
• Quick to set up. One script on your site, not a six-month project.
• A public trust page. Your notices, versions and contact details in one place.

How pactbase works as a CMP

pactbase is a Consent Management Platform built for India’s DPDP Act. It has four modules that work as one record:

• Cookies: scan your site, sort every cookie and hold scripts until the visitor says yes.
• Consent: per-purpose consent on your forms, an append-only ledger and a receipt for every yes.
• Trust Center: a public page with your notice, versions and contact, in all 22 scheduled Indian languages.
• Data Rights: a front door for access, correction, erasure and nomination requests, with OTP verification and a case timeline.

Get started in a day

1. Define. List the purposes you ask for and the policies you publish.
2. Install. Add one script to your site and paste a snippet into your forms.
3. Collect. Consents and data requests start flowing in, each one recorded.

You can start free or book a demo to see it on your own use case.

Frequently asked questions

What does CMP stand for?

CMP stands for Consent Management Platform.

Is a cookie banner enough for DPDP?

A banner covers cookies on your website. DPDP consent also applies to forms, apps and communication, so most businesses need a platform that covers all of them and keeps a record.

Who needs a CMP?

Any business that collects personal data from people in India and wants to ask for, record and honour consent properly. That includes SaaS companies, agencies, D2C brands, clinics and professional firms.

How long does it take to set up?

With pactbase, most teams are live in a day: define purposes, add one script, and publish your trust center.

Does a CMP replace my privacy policy?

No. It makes your notice easier to show, translate and version, and it connects it to the choices people make.