SAP Customer Data Cloud (CDC): Identity, Consent, and CIAM Explained

SAP Customer Data Cloud (CDC) is SAP’s customer identity and access management (CIAM) offering. It handles the front door: how customers register, log in, manage their profile and control consent. It is the trust layer between you and your customers, and without that trust, personalisation feels intrusive rather than helpful.

People tend to dismiss CDC as “the login widget”. It is considerably more: customers register once and get single sign-on across your web shops, apps and portals, while you keep central control over data, permissions and preferences.

TL;DR: SAP Customer Data Cloud consists of three products: Customer Identity (registration, login, single sign-on, profiles), Customer Consent (privacy, consent and preferences) and CIAM for B2B (organisations, delegated administration, roles). It makes GDPR and nDSG consent part of the architecture, protects accounts with risk-based authentication and feeds identity and consent to SAP Commerce Cloud, SAP Engagement Cloud and SAP Customer Data Platform. A standard B2C rollout typically takes 6 to 10 weeks.

What is SAP Customer Data Cloud?

CDC grew out of Gigya, which SAP acquired in 2017, and is documented on the SAP Help Portal. SAP Help lists three products under it: Customer Identity, Customer Consent and CIAM for B2B. Together they collect and manage customer data across touchpoints (websites, apps, portals, social logins) so that one registration becomes one identity everywhere.

CDC plugs into the rest of the SAP CX portfolio: it feeds identity and consent to the Customer Data Platform for unification, to SAP Commerce Cloud for authenticated shopping, and to SAP Engagement Cloud (formerly SAP Emarsys) for campaigns that respect consent.

What do the three products do?

Customer Identity

The authentication and profile layer. Customers register with email, a social login or passwordless (FIDO) authentication, and get single sign-on and single sign-out across every connected application. No more separate accounts per shop or country.

Customer Identity also holds the profile, and progressive profiling is its most useful technique. Instead of a twenty-field registration form that customers abandon, CDC collects data step by step: email and password at sign-up, the delivery address at the first order, preferences a few visits later. Configurable registration and profile screens decide what is asked at each stage. People share more when they are not ambushed.

Get identity right and everything downstream (personalisation, service context, trust) works better. Get it wrong and you have duplicate accounts and customers who do not trust you with anything.

Customer Consent

The privacy and compliance layer. It records consent per purpose (marketing email, SMS, personalised advertising, data sharing), versions the legal texts and keeps an audit trail. Customers can view, change or withdraw consent and request deletion of their data at any time, which covers what the GDPR and the Swiss revised Data Protection Act (nDSG/FADP) require of consent handling.

When someone opts out of email marketing, the change reaches every connected system. That propagation is what separates a proper CIAM from a consent checkbox nobody maintains.

CIAM for B2B

The business relationship layer. It models business partners, their members and organisational hierarchies and applies fine-grained authorisation rules. A customer’s own administrator can manage their users (delegated administration), and roles decide who may see prices, place orders or approve them. If you have ever tried to model “buyer at the Frankfurt branch who can approve orders up to EUR 50,000” in a consumer login system, you know why this product exists.

What security features does CDC provide?

Across the three products, CDC protects accounts well beyond a password check:

• Security dashboard: visibility into login attempts, suspicious activity and policy compliance, so issues surface before they become incidents.
• Risk-based authentication: each login is assessed by device, location and behaviour. Low-risk logins pass without friction; high-risk ones trigger additional verification.
• Account takeover protection: detects and blocks attempts to take over customer accounts, for example with credentials leaked elsewhere.
• Password policies and multi-factor authentication: configurable complexity and history rules, two-factor authentication and FIDO-based passwordless login.

How does CDC fit into the SAP CX architecture?

CDC sits at the foundation of the customer-facing stack:

• SAP Commerce Cloud uses CDC for registration, login and consent on storefronts
• SAP Engagement Cloud respects CDC-managed consent when it sends campaigns
• SAP CDP ingests CDC identity and consent together with CRM and behavioural data (see SAP CDP vs CDC and when you actually need a CDP)
• SAP Sales Cloud V2 and SAP Service Cloud V2 work with verified customer identities instead of guessing which record is the right one

Without CDC, each system manages identity on its own, which leads to duplicate accounts, inconsistent consent records and compliance gaps. With CDC, identity is managed once and used everywhere. At Medion, five national web shops with separate customer databases now share one identity pool of 2.8 million accounts and one consent schema. At SPAR, the CDC rollout across several countries became possible once the SAP Commerce platform underneath had been upgraded.

If you are choosing a partner for this layer, our guide to SAP CIAM and CDP partners in Switzerland and DACH explains what to look for.

Frequently asked questions

What is SAP Customer Data Cloud?

SAP Customer Data Cloud is SAP’s customer identity and access management (CIAM) offering. It consists of Customer Identity (registration, login, single sign-on, profiles), Customer Consent (privacy, consent and preferences) and CIAM for B2B (organisations, delegated administration, roles), protected by a shared security layer.

How does CDC help with GDPR and nDSG compliance?

CDC records consent per purpose with versioned legal texts and a full audit trail, and passes changes to connected systems. Customers can view, change or withdraw consent and request deletion through self-service. When consent is withdrawn, marketing, analytics and personalisation systems connected to CDC stop using that data for the withdrawn purpose.

What’s the difference between CDC and a standard login system?

A standard login authenticates users, and that is all. CDC adds consent management, progressive profiling, risk-based authentication, account takeover protection, social and passwordless login, single sign-on across applications and B2B organisation hierarchies.

Can CDC work without SAP CDP?

Yes. CDC works on its own as a CIAM platform, and many organisations start with CDC alone for registration, consent and single sign-on. If they add CDP later for data unification, CDC becomes one of its sources.

How long does a CDC implementation take?

A standard B2C rollout with registration, single sign-on and consent management typically takes 6 to 10 weeks. Adding CIAM for B2B with organisation hierarchies and delegated administration extends it to around 10 to 14 weeks. Multi-market programmes take longer when existing accounts and consent must be migrated: Medion’s five-market consolidation ran in three phases over twelve weeks.