Not everything you processis something they consented to.
ConsentCenter keeps required processing, marketing choices and communication preferences as the separate things they are, each with its own record.
- GDPR Article 6(1)
- GDPR Article 7(1)
- GDPR Article 12(3)
Asking for consent you do not need is its own risk.
Because now you can lose it.
If you rely on consent for processing you are actually required to perform, withdrawal puts you in an impossible position. The fix is not a better banner. It is being precise about which basis covers what.
Where this goes wrong first.
One status for many purposes
A single consent flag cannot distinguish regulatory reporting from marketing from optional analytics. When it is withdrawn, nobody knows which of the three is supposed to stop.
The history has gaps
You can see the current preference but not when it changed, through which channel, or what the customer was shown at the time. The current state is the easy half of the question.
Requests cross too many desks
An access request touches core banking, the CRM, the contact centre and an archive. Four owners, one fixed deadline, and no shared view of whether anyone has started.
What you are actually buying.
Record choices against defined purposes instead of one blanket status.
Keep a timestamped history of updates and withdrawals, not just the current value.
Coordinate privacy requests across owners, systems and deadlines.
How it works
Define
Model the purposes used across customer journeys, and which basis covers each.
Orchestrate
Propagate approved preference changes to the systems that act on them.
Evidence
Preserve the event history needed for internal review and audit support.
What the text actually says.
- GDPR Article 6(1)
- Processing needs a lawful basis, and consent is only one of six — contract, legal obligation and legitimate interests are separate bases with different consequences.
- GDPR Article 7(1)
- Where you do rely on consent, you must be able to demonstrate that the person gave it.
- GDPR Article 12(3)
- A data subject request must be answered within one month of receipt, extendable by two further months where the request is complex.
Paraphrased for brevity and provided for orientation, not as legal advice. Which obligations apply to your organisation is a question for your own counsel, and ConsentCenter does not determine it for you.
The products that apply
Universal Consent & Preference Management
Hold purpose-based choices separately instead of as one status.
View productDSAR & Privacy Rights
Track requests from intake to secure delivery, with owners and deadlines.
View productData Mapping
Build visibility into which systems hold personal data and how it flows.
View product
Frequently asked questions
No. ConsentCenter supports operational privacy workflows; your legal team should determine the requirements and lawful basis that apply to your organisation.
ConsentCenter UCPM is designed to maintain a history of preference changes, including withdrawals, so a withdrawal is a recorded event rather than the absence of one.
That should not be sitting behind a consent toggle. Modelling it as a separate purpose on a separate basis is the point of this: the customer gets a real choice where there is one, and you are not asking permission for something you cannot stop.
Bring us the financial services version of this problem.
Show us the consent question you cannot currently answer — the choice that did not propagate, the record you could not reproduce — and we will walk through exactly how ConsentCenter handles it.