// Compliance Guide
DPDPA 2023 Consent Withdrawal Mechanisms
How Indian Data Fiduciaries must architect frictionless consent revocation, cease processing, and notify downstream processors under Section 6(4).
The Statutory Mandate: Section 6(4)
Section 6(4) of the Digital Personal Data Protection Act, 2023 establishes an unambiguous standard: the ease of withdrawing consent must be comparable to the ease with which consent was originally given. If a user was able to grant consent with a single click on a cookie banner or button, withdrawing that consent cannot require contacting customer support, navigating complex menus, or waiting days for verification.
Upon receiving a consent withdrawal, the Data Fiduciary is under a mandatory statutory obligation to cease processing the personal data within a reasonable time, and must instruct all third-party Data Processors to immediately cease processing as well.
Architecting Compliant Revocation Mechanisms
1. Persistent Consent Widget / Revisit Toggle
Maintain an omnipresent, subtle privacy trigger (such as a floating shield or footer button) allowing visitors to summon their preferences and toggle off analytics or marketing tags in one click.
2. Account Preference Center
For authenticated platforms, provide an intuitive 'Data Privacy & Consent' tab where users can independently view and toggle consent categories.
3. Automated Revocation Event Dispatch
When withdrawal is triggered, the frontend must immediately suppress tracking scripts and emit a webhook to the backend to log the revocation event in an append-only audit trail.
4. Downstream Processor Propagation
The Data Fiduciary must automatically signal external processors (CRMs, analytics suites, cloud vendors) to discontinue processing the withdrawn data.
Legal Consequences and Non-Discrimination Rules
Withdrawal of consent does not invalidate or affect the legality of any processing carried out prior to the moment of withdrawal. However, from the timestamp of withdrawal onward, no further processing can be justified on the basis of consent.
Under Section 6(6), Data Fiduciaries cannot penalize or deny services to a Data Principal merely because they exercised their right of withdrawal, unless the personal data was strictly necessary for delivering that specific service.
Frequently Asked Questions
Can we require a user to send an email to withdraw cookie consent?
No. Requiring an email or written request to withdraw consent that was originally given in one click violates Section 6(4)'s requirement that withdrawal must be as easy as granting consent.
How quickly must processing cease following a consent withdrawal?
The Act requires processing to cease within a 'reasonable time'. For digital systems and automated trackers, this is expected to take effect immediately or within minutes, while backend workflows should reflect the revocation without undue delay.
Does withdrawing consent mean all past user data must be permanently deleted immediately?
Not necessarily. If retention is required by another applicable Indian law (e.g., tax records, financial regulations, statutory audit trails), the data must be retained for that specific legal compliance purpose, but all other processing must cease.
Related Compliance Guides
Verify Your Consent Withdrawal Workflows
Test whether your current cookie banner and account settings meet DPDPA Section 6(4) standards using SYRA Data's automated scanner.