Consent Withdrawal Under the DPDP Act: What Businesses Need to Know
Understand consent withdrawal obligations, the distinction between withdrawal and erasure, and how to operationalize withdrawal workflows.
Executive Summary
Consent withdrawal allows individuals to revoke consent at any time. This article explains what happens when someone withdraws consent, the critical distinction from erasure/deletion, and how businesses must operationalize withdrawal.
What Is Consent Withdrawal?
Under Section 6(3) of the DPDP Act, a Data Principal can withdraw consent at any time. When they do, the Data Fiduciary must stop processing personal data for that purpose going forward.
Key Point: Withdrawal is forward-looking, not retroactive. You can keep data already processed while consent was active.
CRITICAL: Withdrawal ≠ Erasure
This distinction is the most important in DPDP compliance:
Consent Withdrawal
- Stop new processing
- Can retain existing data
- Unless other legal reason to delete
- Forward-looking
Right to Erasure
- Delete data entirely
- Remove from all systems
- Subject to legal exceptions
- Retroactive
An individual can withdraw consent for marketing emails without demanding deletion of all personal data.
Operational Requirements
When someone withdraws consent:
- Record the withdrawal: Timestamp it and mark consent state as withdrawn
- Stop new processing: Update downstream systems to respect the withdrawal
- Acknowledge the withdrawal: Confirm to the individual
- Retain evidence: Keep records for compliance audit
Key Takeaways
Withdrawal is forward-looking: Stop new processing but keep existing data.
It's distinct from erasure: Don't confuse the two concepts.
Sources & Further Reading
Digital Personal Data Protection Act, 2023 - Sections 6-11
Parliament of India
https://indiacode.gov.in/act/c058fa9f-eaf0-4ca3-98f1-3443b087bca9/sectionsRelated Articles
What Is Consent Under the DPDP Act?
A deep dive into consent under India's DPDP Act: requirements, notice, informed decision-making, withdrawal, and how to implement consent properly.
What Is the DPDP Act? A Practical Guide for Indian Businesses
Understand India's Digital Personal Data Protection Act 2023: scope, key concepts, obligations, and what compliance means for your business.
Building your DPDP compliance infrastructure?
ConsentLog helps Indian businesses operationalize DPDP consent requirements across their systems. Learn how we're approaching consent infrastructure.