Consent Withdrawal
The right to say "stop" must be as easy as saying "go".
🎯 Learning Objectives
- ▸ Understand the legal requirement for withdrawal
- ▸ Design an effective withdrawal flow
- ▸ Understand the technical impact of withdrawal
The Legal Requirement
Section 6(4) is a game-changer. It stops companies from putting consent withdrawal behind 5 different customer service phone calls. If you can sign up with one click, you must be able to withdraw with one click.
Once a user withdraws consent, the Data Fiduciary must cease processing the data for that purpose. Continuing to process it is a direct violation of the Act.
Implementation
How do you actually implement this?
- • In-App Settings: Provide a "Privacy Settings" or "Consent Dashboard" link on the main menu.
- • One-Click Toggle: Allow users to simply toggle off the consent.
- • Automated Pipelines: The withdrawal must trigger a webhook or API call that stops downstream processing immediately.
- • Data Deletion: If the data was collected based solely on consent, withdrawal should trigger a request for erasure (unless retention is legally required).
💡 Example
If a user opts out of marketing emails, your system should instantly update their status in the CRM to "unsubscribed" and remove them from the active mailing list.
📖 Glossary
- Withdrawal of Consent
- The act of a Data Principal revoking their earlier permission for a Data Fiduciary to process their personal data.
- Downstream Processing
- The secondary use or sharing of data after it has been initially collected.
🔑 Key Takeaways
- Withdrawal must be as easy as giving consent.
- Withdrawal must be processed "without undue delay".
- Withdrawal does not affect past lawful processing.
📚 Further Reading
- DPDPA Section 6(4) — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...