Consent is the only lawful basis where the burden of proof sits entirely with you, and the proof is not the checkbox. It is the record around it. Five fields, and the reason most consent records fail is that they store the first and last only.
Who
Identified well enough to match to the person later. An email address is usually enough. A session identifier that was never linked to an account is not, because you cannot honour a withdrawal from somebody you cannot find.
What they were shown
The version of the notice, not a link to the current one. This is the field that decides arguments, because the current notice is not the one they read and pointing at it proves nothing. Store the version identifier and keep the versions.
What they agreed to
Per purpose, not in aggregate. Agreeing to receive a newsletter is not agreeing to profile building, and a single consented flag cannot be unpicked later when somebody asks which of the two they said yes to.
When
A timestamp, and the channel it came through. Consent captured by a support agent on a call is legitimate and needs the agent recorded, because an unattributed consent is one you cannot stand behind when the person says they never agreed to anything and you have nobody who can say otherwise.
How it can be withdrawn
Withdrawal must be as easy as giving it. That is a design constraint on the product, not a line in the policy, and it is the one an auditor can test in thirty seconds by looking for the withdrawal route.
Questions people ask about customer consent management
Is implied consent ever enough?
Rarely, and less often than people hope. Where it is the basis, the record still has to show what made the implication reasonable, which usually means the same five fields anyway.
Do we re-consent when the notice changes?
Only where the change materially alters what somebody agreed to. A wording tidy-up does not; a new purpose does. Versioning the notice is what lets you tell the two apart later.
How long do we keep a consent record?
As long as you rely on it, plus long enough afterwards to answer a complaint. Deleting the record when the consent is withdrawn removes your evidence that it was ever valid.