DPDP Insights › Questions › Someone withdraws consent. What has to stop, and how fast?

Question

Someone withdraws consent. What has to stop, and how fast?

Short answer: Stop that use quickly, across every system and vendor

Withdrawal must be as easy as giving consent. Once someone withdraws, you and every vendor working for you must stop that use within a reasonable time. What was done before withdrawal stays lawful, and data that a law requires you to keep is kept.

What the law says

Section 6(4) to 6(6) give the right to withdraw at any time, with the same ease, and require processors to stop as well. Section 8(7) then asks for erasure unless a law requires retention.

Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.
Section 8(1)–(2): The organisation that decides why and how data is used (the Data Fiduciary) stays responsible, even when a vendor (Data Processor) does the work. A processor may be engaged only under a valid contract.

Steps

Give one simple way to withdraw on every channel where consent is taken.
Record the withdrawal against the person and the purpose.
Push the change to every system and vendor that uses that purpose.
Confirm to the person, in writing, what has stopped and what is kept by law.
Check a sample every month to see that the change actually reached every list.

Evidence to keep

Withdrawal log with time stamps
Proof that downstream systems and vendors updated
Confirmation sent to the person

Common mistakes

Withdrawal by email only, while consent was one tap in an app
Stopping in the main system but not in vendor lists
Deleting records a law requires you to keep

How it plays out by sector

Banking, financial services and insurance: A customer taps 'stop offers' in the app. The dialler, SMS tool and partner insurer must all stop within a day.
Central government: ministries and departments: Where consent was the basis, such as newsletters, withdrawal must work.
Healthcare and hospitals: A patient who withdraws consent for offers keeps receiving care.

From each seat

Marketing department: Make the stop option work across every channel and agency within a day.
Customer service department: Process stop requests the same day and confirm in writing.

What a good answer from management sounds like

“Withdrawal takes one step on the same channel. It reaches all our systems and vendors within a working day, and we test this every month.” Effort and time: Medium · 6 to 12 weeks.