Right to Withdraw Consent

Under the DPDP Act, the Right to Withdraw Consent allows a Data Principal to withdraw consent previously provided to a Data Fiduciary for the processing of personal data.

The DPDP Act requires Data Fiduciaries to provide a mechanism through which Data Principals can withdraw consent. The process for withdrawing consent should be as easy as providing consent. Once consent is withdrawn, the Data Fiduciary must stop processing the personal data based on that consent, subject to applicable requirements and any other lawful basis for processing.

Managing consent withdrawal requires organizations to maintain accurate consent records, identify where personal data is being processed, update preferences across systems, and ensure downstream processing activities are handled appropriately.

In practice, gaps emerge when:

• Organizations make consent withdrawal difficult compared to consent collection.
• Consent preferences are not updated across systems.
• Teams cannot identify all processing activities linked to consent.
• Withdrawal requests are handled manually without tracking.
• Third-party processors continue processing after consent withdrawal.

Organizations address these challenges by implementing consent management systems, maintaining consent records, automating preference updates, mapping data flows, and managing Data Processor activities. Within Privy, capabilities such as consent lifecycle management, preference management, workflow automation, and compliance reporting help organizations manage consent withdrawal processes.