Withdrawal of consent under the DPDP Act: Section 6(4)–(6)

Under Section 6(4) of the DPDP Act, 2023, a person who has given consent can withdraw it at any time, and withdrawing must be as easy as giving it was. When she does, you must stop processing her personal data within a reasonable time and make your Data Processors stop too (Section 6(6)), and erase the data unless a law requires you to keep it (Section 8(7)).

The Act speaks of "withdrawing" consent; "revoking" consent means the same thing. This guide covers what the Act and the DPDP Rules, 2025 say, what follows a withdrawal, and a checklist for Data Fiduciaries.

What the Act says

Provision	What it requires
Section 5(1)(ii)	Your notice must tell the person how to withdraw consent (and exercise her other rights)
Section 6(4)	Where consent is the basis of processing, she may withdraw it at any time, with ease comparable to the ease of giving it
Section 6(5)	She bears the consequences of withdrawing, and withdrawal does not affect the legality of processing done before it
Section 6(6)	You must, within a reasonable time, cease processing and cause your Data Processors to cease, unless processing without consent is required or authorised by the Act, the Rules or another law
Section 6(7)	She may withdraw through a Consent Manager
Section 6(10)	If questioned in a proceeding, you must prove notice and consent, which in practice means records of withdrawals too
Section 8(7)	On withdrawal, erase the personal data and cause your Data Processors to erase what you gave them, unless retention is necessary to comply with a law

Rule 3(c)(i) of the DPDP Rules, 2025 adds that the notice must give the link to your website or app, and describe any other means, through which she can withdraw consent "with the ease of doing so being comparable to that with which such consent was given".

What "comparable ease" means in practice

The Act does not define comparable ease, but the test is about the person's effort. If she gave consent with one tap in your app, a withdrawal process that needs a signed letter, an email to a general inbox or a call centre is unlikely to pass. In practice:

• offer withdrawal in the same channel where consent was given (web, app, in person), and in your preference centre;
• let her withdraw one purpose at a time, not only everything at once, since consent is given for specified purposes (Section 6(1));
• do not add steps at withdrawal that were not there at consent: extra logins, verification beyond what is needed to identify her, or "are you sure" loops.

What happens after a withdrawal

1. Stop processing. Section 6(6) requires you to cease processing for the withdrawn purpose within a reasonable time. The Act does not define "reasonable time". Act as quickly as your systems allow, and document the time you normally take.

2. Make your processors stop. The same subsection makes you responsible for your Data Processors ceasing too. The Act's illustration: a telecom company whose customer switches from emailed bills to in-app bills must stop emailing bills itself and make its email vendor stop.

3. Erase, unless the law says keep. Section 8(7)(a) requires you to erase the data once consent is withdrawn (or once the purpose is no longer served, whichever is earlier), and Section 8(7)(b) to make your processors erase what you gave them. Retention that another law requires, such as tax, banking or KYC records, still applies. Separately, Rule 8(3) requires you to keep personal data, traffic data and logs of processing for at least one year from the processing, for the purposes in the Seventh Schedule. How Rule 8(3) and Section 8(7) fit together is not spelled out, so take advice on what you keep after a withdrawal.

4. Past processing stays lawful. Withdrawal does not make earlier processing unlawful (Section 6(5)).

5. The consequences fall on her. The Act's illustration: if a shopper withdraws consent, an online store may stop letting her place new orders, but must still deliver what she has already ordered and paid for (Section 6(5)).

6. Other lawful bases are unaffected. Section 6(6) stops processing based on consent, not processing that the Act or another law requires or authorises without consent, such as the legitimate uses in Section 7.

Withdrawal vs erasure

	Withdrawal of consent	Erasure request
Source	Section 6(4)–(6)	Section 12(1) and 12(3)
What she asks	Stop processing for a purpose	Erase her personal data
Your duty	Stop processing, make processors stop, then erase under Section 8(7)	Erase, unless retention is necessary for the specified purpose or for compliance with a law
How it reaches you	Any channel where consent was given, your preference centre, or a Consent Manager	Through the means you publish for rights requests (Rule 14 from 13 May 2027)

The two often arrive together, but they are separate rights. Withdrawal can be for one purpose while she keeps using your service for others.

Checklist for Data Fiduciaries

1. Notice: your notice says how to withdraw, with a link (Section 5(1)(ii), Rule 3(c)(i)). See the DPDP consent notice checklist.
2. Same channel: withdrawal works wherever consent was collected, purpose by purpose.
3. Preference centre: one place where a person sees what she agreed to and withdraws.
4. Downstream systems: every system that uses the data for that purpose (CRM, marketing tools, analytics, data warehouse) receives the withdrawal.
5. Processors: each processor is told and confirms it has stopped and erased (Sections 6(6) and 8(7)(b)).
6. Retention rules: you know which records a law requires you to keep, and for how long.
7. Consent Manager: if you accept consents through a Consent Manager, withdrawals from it are honoured the same way. See the Consent Manager integration checklist.
8. Records: each withdrawal is logged with time, channel, purpose and the processors notified, so you can show what happened (Section 6(10)).

Frequently asked questions

Can a person withdraw consent at any time?

Yes. Section 6(4) of the DPDP Act lets a Data Principal withdraw consent at any time where consent is the basis of processing, and withdrawing must be as easy as giving consent was.

Does withdrawing consent make past processing unlawful?

No. Section 6(5) says withdrawal does not affect the legality of processing based on consent before it was withdrawn.

How quickly must we stop processing after a withdrawal?

Within a reasonable time (Section 6(6)). The Act and the Rules do not set a number of days, so act as quickly as your systems allow and document your normal turnaround.

Do we have to delete the data after consent is withdrawn?

Generally yes. Section 8(7) requires you to erase the data and make your processors erase it once consent is withdrawn, unless a law requires you to keep it. Rule 8(3) separately requires keeping logs of processing for at least one year for the purposes in the Seventh Schedule.

Can we stop providing our service if a user withdraws consent?

Where the service depends on that consent, yes. Section 6(5) puts the consequences of withdrawal on the Data Principal. In the Act's example, an online store can stop taking new orders but must still deliver orders already paid for.

Can a user withdraw consent through a Consent Manager?

Yes. Section 6(7) lets a Data Principal give, manage, review or withdraw consent through a Consent Manager registered with the Data Protection Board, and you must honour that withdrawal as if it came to you directly.

When do these rules apply?

The duties on Data Fiduciaries in the DPDP Rules, 2025, including Rule 3 on notices, apply from 13 May 2027. See the DPDP Rules 2025 timeline.

Where Consentrio fits

Consentrio is a consent management platform for India's DPDP Act. It gives your users a preference centre where they withdraw as easily as they consented; sends signed notifications to your processors when consent changes; applies retention policies per purpose, with legal holds where a law or dispute requires you to keep data; and keeps a tamper-evident audit trail of every consent and withdrawal as proof. For the other consent requirements, see DPDP Act consent requirements.