What are consent-withdrawal rules under DPDP?

DPDP Section 6(4) requires that consent be withdrawable, and the withdrawal process must be as easy as the consent process. Once withdrawn, the Fiduciary must cease processing based on that consent, subject to any legal retention obligations. dcomply's consent widget defaults to instant withdrawal.

What SLA applies to withdrawal?

DPDP does not fix a specific hour count but 'as easy as consent' implies real-time. Practical benchmark: withdrawal reflected in downstream systems within 24 hours (dcomply propagates immediately via webhooks to Zoho CRM, LeadSquared, MoEngage, etc.).

Can I retain data after withdrawal for legal purposes?

Yes, retention required by law (RBI KYC, GST, MSMED, Companies Act, tax audits) overrides the withdrawal for those specific fields. But secondary uses (marketing, profiling, analytics) must cease. dcomply implements partial-anonymisation to reconcile these two obligations.

How does withdrawal propagate to my connected systems?

dcomply's connector layer includes a consent-sync capability: on withdrawal, ZohoCrm and LeadSquared connectors call the vendor API to set Email_Opt_Out=true (Zoho) or DoNotEmail=1 + DoNotCall=1 (LeadSquared). MoEngage, WebEngage and CleverTap are on the connector roadmap.

What evidence must I keep of withdrawal?

Every withdrawal is recorded in the audit chain with: timestamp, channel (email, portal, WhatsApp, in-person), Principal identifier hash, purposes withdrawn, IP address hash. On DPB inspection you can prove withdrawal happened and was actioned within SLA.

What if a user withdraws consent given by mistake?

The user can re-consent. dcomply's UX shows the current consent state and allows immediate re-consent through the preference centre. Re-consent creates a new consent record; the old withdrawal record is preserved.

Consent Withdrawals

Make Consent Withdrawal As Easy as Giving It

DPDP Section 11 requires that withdrawing consent be as easy as giving it. Automate the entire withdrawal process, from user request to data processing cessation to deletion confirmation, with full audit trails.

Try the live product

Withdrawals (this month)23

Processed18

Pending5

Avg. Processing Time2.3 days

Downstream systems notified: 7

DPDP Section 11 compliant

The Problem

No Withdrawal Process = Ongoing DPDP Violation

DPDP mandates consent withdrawal be as easy as giving it, but most businesses have no formal process, making every unanswered withdrawal a continuing violation

No Formal Process

Most businesses have no workflow for handling consent withdrawal, requests go to a generic email address and get ignored

Cessation Deadline

DPDP requires cessation of data processing within a "reasonable time" after withdrawal, no automation means manual chaos

Ongoing Violations

Failure to act on withdrawal means continued data processing without consent, an ongoing DPDP violation with escalating penalties

Capabilities

DPDP Section 11 Compliant. Automated. Proven.

Self-Service Portal

Branded withdrawal portal where users can withdraw consent with one click, as easy as giving it was.

Processing Halt

Automatic cessation of data processing on withdrawal, all systems updated to stop processing within the configured SLA.

Deletion Workflow

Trigger deletion of personal data or document the legitimate retention justification, both outcomes fully audited.

Timeline Tracking

SLA compliance tracking per withdrawal request, see at a glance which requests are on time and which need attention.

Multi-System Propagation

Automatically notify CRM, email marketing, analytics, and other systems to stop processing, no manual coordination.

Audit Log

Proof of action for every withdrawal request, timestamped record of when it was received, actioned, and completed.

DPDP Section 11 Compliant. Automated. Proven.

Consent withdrawal management for DPDP Act compliance

View All Features