s.6 · s.12 · Rule 8
Withdrawal of consent
A Data Principal may withdraw consent at any time, and Section 6(4) requires withdrawing it to be as easy as giving it was.
The ease test is the one businesses fail. If consent was one click on a banner, withdrawal cannot be an email to a support address, a phone call, or a settings page four levels deep. The same effort, in the same place, is the standard.
Withdrawal does not undo processing that already happened lawfully, but it ends the ground for further processing. Section 6(6) requires the Data Fiduciary, and its Data Processors, to stop within a reasonable time and to erase the data unless another law requires keeping it. The consequences of withdrawal fall on the Data Principal, which means a service that genuinely needs the data may stop providing what depends on it.
Questions people ask
- Can we keep data after consent is withdrawn?
- Only where another law requires retention, for example tax or company law records. Everything else must be erased within a reasonable time.
- Must withdrawal be offered on the website?
- It must be as easy as giving consent was. If consent was given on the website, withdrawal has to be available there too.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.