Withdrawal of Consent
The Data Principal’s right to take back consent at any time, as easily as it was given.
Withdrawal of consent means a person changes her mind and tells an organisation to stop using her data for a purpose she had agreed to. The DPDP Act says she can do this at any time, and it must be as easy as saying yes was.
Meaning of Withdrawal of Consent
After withdrawal, the Data Fiduciary must stop processing, and ask its processors to stop, within a reasonable time, unless another ground (such as a legal duty) applies. The consequences of withdrawal are the person's responsibility. Withdrawal does not make earlier processing unlawful.
Section 6(4) of the DPDP Act gives every Data Principal the right to withdraw consent at any time, and says the ease of withdrawal must be comparable to the ease of giving consent. Rule 3 reinforces this by requiring the notice to carry a link, on the website or app, through which the person can withdraw consent as easily as she gave it. Where the person consented through a registered Consent Manager, she may withdraw through that platform as well, under Section 6(7).
Section 6(5) and 6(6) set out what follows. The consequences of withdrawal are borne by the Data Principal, which means that if a service cannot run without the data, the service may end. Withdrawal does not make earlier processing unlawful. After withdrawal the Fiduciary must, within a reasonable time, stop processing and make its Data Processors stop, unless the processing without consent is required or authorised by law.
Section 8(7) adds the clean-up duty: when consent is withdrawn, the Fiduciary must erase the personal data, and cause its processors to erase any data they hold, unless retention is necessary for compliance with a law. Be careful to separate withdrawal from an erasure request under Section 12(3). Withdrawal stops the use that depended on consent; a person may also ask for erasure, and in practice many withdrawals trigger both.
Withdrawal applies where consent is the basis of the processing. It does not switch off processing that rests on a Section 7 legitimate use, such as a statutory disclosure or payroll. A person cannot withdraw her way out of a court order. Organisations should therefore tell people clearly which processing the withdrawal will end and which will continue on another ground.
Examples of Withdrawal of Consent
A subscriber clicks "unsubscribe" in a newsletter. The sender stops sending and removes the email from the marketing list and from partners who send for it.
A reader clicks the unsubscribe link in an email. Within the day her address is removed from the mailing tool and from the sponsor-alert list, and a confirmation page says which emails she will no longer receive. Her subscription billing records stay, because tax law requires them.
A customer switches off a toggle that allowed use of her transaction history for product offers. The app stops offer personalisation immediately, while processing needed for statements and RBI reporting continues on other grounds, which the screen explains.
A user withdraws consent for sharing workout data with a partner brand. The start-up tells the partner, which deletes the data it received, and the user keeps her basic account because that processing does not depend on the withdrawn consent.
Why Withdrawal of Consent matters
A withdrawal mechanism that exists only on paper is a compliance gap with direct consequences. If someone withdraws and marketing messages continue, she has a grievance under Section 13 and can complain to the Data Protection Board once the grievance route has been exhausted. The continued processing no longer has any ground and falls into the residual penalty tier of up to ₹50 crore.
For business, withdrawal is also an operational test. Consent records, marketing platforms, analytics tools and processors all need to hear about the change quickly, and many organisations discover that their systems cannot propagate a stop instruction at all. Fixing that early is cheaper than manual clean-ups later, and it builds trust with customers who know they can leave cleanly.
How it works in practice
- 1Place the withdrawal option where people expect it: an account-settings toggle, an unsubscribe link in every message, and a visible link in the notice. Match the channel of consent, so an app consent can be withdrawn in the app.
- 2Give the withdrawal a tracked status. Log the request, the time, the purposes affected and the systems that must act, then confirm to the person in plain words what has stopped.
- 3Connect the consent store to downstream tools such as the email platform, the CRM, ad audiences and processors, so a withdrawal is applied automatically or within a defined, short internal deadline.
- 4Decide the erasure or retention outcome for each data set under Section 8(7), keep only what a law requires, and document the legal basis for anything retained.
- 5Explain consequences before the person clicks. If cancelling consent ends a loyalty programme, say so, but do not add penalties, extra hurdles or retention offers that make leaving harder.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Making withdrawal harder than sign-up, for example by requiring an email to a postal address. Mirror the consent channel so that leaving is as quick as joining.
Stopping marketing in one tool while processors and partner lists keep running. Section 6(6) requires processors to stop too.
Treating withdrawal as an automatic deletion of every record. Some data must be kept by law, so decide record by record what is erased and what is retained.
Adding guilt screens or retention friction. These resemble dark patterns and conflict with the "as easily" standard.
Compliance tips
Set an internal service level for propagating withdrawals, such as 24 to 72 hours, and test it regularly with dummy accounts.
Keep a log of withdrawals and the actions taken, since in a dispute you may need to show when you stopped.
Tell customers what continues after withdrawal and why, citing the legal duty, to avoid complaints that you ignored the request.
Review processor contracts so they commit the processor to act on withdrawal and erasure instructions promptly.
Common questions about Withdrawal of Consent
Can a company refuse to let me withdraw consent?
No, where consent is the basis of the processing. Section 6(4) lets a Data Principal withdraw at any time. The company may point out consequences, such as ending a service that needs the data, and may keep data that a law requires it to retain, but it cannot block the withdrawal.
Does withdrawal delete my data automatically?
Not automatically in every case. Section 6(6) requires processing to stop within a reasonable time, and Section 8(7) requires erasure on withdrawal unless retention is necessary for legal compliance. You can also make a separate erasure request under Section 12(3) to be sure.
Does withdrawing consent make earlier processing illegal?
No. Section 6(5) says withdrawal does not affect the lawfulness of processing done on the basis of consent before the withdrawal. The change applies from the point the organisation receives the request, which is why prompt handling and good timestamps matter.