Glossary · Consent Withdrawal
What Is Consent Withdrawal Under DPDPA?
Consent withdrawal under the Digital Personal Data Protection Act, 2023 is a Section 6(4) duty, not a settings toggle. If the ground is consent, withdrawing it must be as easy as giving it, and that purpose must actually stop. Remaining notice, security and rights duties phase in on 13 May 2027.
Last reviewed: 3 September 2026
Definition
Section 6(4) of the Digital Personal Data Protection Act, 2023 says the Data Principal may withdraw consent as easily as it was given. Once withdrawn, the Data Fiduciary cannot keep processing that personal data on the consent ground. Processing that never sat on consent — a named Section 7 legitimate use, including employment-necessary processing under Section 7(i) — does not disappear because someone clicked withdraw. Consent itself must be free, specific, informed, unconditional, unambiguous, and given by clear affirmative action. A pre-ticked box is not consent, so it is not a withdrawal you can honour either.
How this matters in practice
Test one live record through the front door. Count how many systems still hold it an hour later — CRM, WhatsApp, an LSP export. If withdrawal cannot reach those copies, you do not have Section 6(4). Put a timed, logged stop in the Section 8(2) processor contract. Do not invent a consent banner for payroll you cannot survive withdrawing.
Frequently asked questions
If an employee withdraws consent, must we stop payroll?
No. Processing necessary for employment purposes can sit under Section 7(i). Routing payroll through Section 6 consent creates a withdrawal you cannot honour. Notice, security and processor contracts still apply. Optional staff tools still need valid Section 6 consent.
Does withdrawal have to be one click if signup was a form?
It must be as easy as the original consent — same channel friction, not a branch visit after an app signup. Log the timestamp. Then stop that purpose across CRM, vendors and backups you still control. Processor copies are still personal data.
Does a Consent Manager licence replace our withdrawal duty?
No. Rule 4 registration of Consent Managers commences on 13 November 2026. Until a name is on the Board register, software you buy is a Data Processor. Section 6(7) makes a registered Consent Manager optional for the Principal, not a purchase that deletes Section 6(4).
Test one withdrawal this fortnight
Book 30 minutes to see whether a Section 6(4) stop actually reaches CRM, payroll-adjacent tools and vendors.
Book a demo
Free Gap Analysis
Disclaimer: Privigo is not a law firm. This page provides operational compliance guidance only. For institution-specific obligations, work with qualified Indian legal counsel.