Article
Withdrawing consent: why it must be as easy as giving it
6 Nov 2026 · Dpofficer.in team · 2 min read
Section 6(4) of the DPDP Act says withdrawing consent must be as easy as giving it. What that means for apps, websites, call centres and marketing lists.
If it takes one tap to say yes, it can’t take a phone call, an email and a 30-day wait to say no. That’s the simple idea behind section 6(4) of the DPDP Act: a Data Principal may withdraw consent at any time, with comparable ease to the way it was given.
What “comparable ease” looks like
| Consent was given by… | Withdrawal should be… |
|---|---|
| Ticking a box at sign-up | Unticking a setting in the account page |
| Replying “YES” on WhatsApp | Replying “STOP” |
| Clicking a cookie banner | A “Manage consent” link on every page |
| Signing a paper form at a branch | A form at the branch, plus an online option |
Signs of a failing design: withdrawal hidden in the fifth layer of settings, a requirement to email a generic inbox, or a “retention call” before the request is processed.
What happens after withdrawal
Section 6(6) says that once consent is withdrawn, the Data Fiduciary must, within a reasonable time, stop processing the data and make its processors stop too, unless the Act or another law requires or authorises continued processing.
Section 8(7) adds the erasure duty: when consent is withdrawn, the data must be erased unless retention is legally required.
The consequences are the person’s to bear
Section 6(5) says the consequences of withdrawal are borne by the Data Principal, and that withdrawal doesn’t affect the legality of processing before the withdrawal. If someone withdraws consent for the account itself, they lose the service. That’s fine; just say so clearly in your notice.
Partial withdrawal
Consent is purpose-specific, so withdrawal can be too. A customer may withdraw consent for marketing while keeping the account. Design for that: one switch per purpose.
Don’t forget the processors
Withdrawal has to travel. If a marketing agency holds your customer list, your systems must tell the agency to stop. Write this into your processor contracts, and test it.
Consent Managers
From 13 November 2026, registered Consent Managers can let people give, manage, review and withdraw consent across many organisations through one platform. If your users come through a Consent Manager, withdrawal requests will arrive through it too.
Keep a record
Every withdrawal should be logged with the date, time and purpose withdrawn. Under section 6(10), you may have to prove what consent you held and when it ended.
A five-point check
- Is there a withdrawal option for every purpose you asked consent for?
- Can a user find it in under 30 seconds?
- Does it take effect without a human approval step?
- Are processors told automatically?
- Is each withdrawal recorded?
Go deeper
Our courses include consent lifecycle design with real interfaces. Browse the courses.
This article is for education and is not legal advice.
Get a new DPDP explainer every day
Follow dpdpcourse.in: