Withdrawal of Consent

Under the DPDP Act, Withdrawal of Consent enables a Data Principal to withdraw consent that was previously provided to a Data Fiduciary for processing personal data.

The DPDP Act requires organizations to provide a mechanism through which Data Principals can withdraw consent. The process for withdrawal must be as easy as the process of providing consent. Once consent is withdrawn, the Data Fiduciary must stop processing personal data based on that consent, unless another lawful basis permits continued processing.

Managing withdrawal of consent requires organizations to maintain accurate consent records, identify processing activities linked to consent, update preferences across systems, and ensure that related processing activities are handled appropriately.

A structured consent withdrawal process helps organizations maintain transparency, respect Data Principal choices, and demonstrate accountability for personal data processing.

In Practice, Gaps Emerge When:

• Consent withdrawal processes are difficult to access.
• Organizations cannot identify all systems using withdrawn consent data.
• Consent preferences are not updated across platforms.
• Withdrawal requests are managed manually without tracking.
• Third-party processing continues without updated consent information.

Organizations address these challenges by implementing consent management systems, maintaining consent records, automating preference updates, mapping data flows, and monitoring Data Processor activities. Within Privy, capabilities such as consent lifecycle management, preference management, workflow automation, and compliance reporting help organizations manage withdrawal requests effectively.