Lesson 4.6: Withdrawal and consent records
Consent is not a one-time event. Learn how to handle withdrawal and how to prove consent. This DPDPA 2023 course page explains withdrawal and consent records in plain language.
'%2F%3E%3Ccircle%20cx%3D'650'%20cy%3D'15'%20r%3D'62'%20fill%3D'%2314b8a6'%20opacity%3D'.35'%2F%3E%3Ctext%20x%3D'28'%20y%3D'54'%20font-family%3D'Poppins%2CArial%2Csans-serif'%20font-size%3D'26'%20font-weight%3D'800'%20fill%3D'white'%3EDPDPA%202023%20COURSE%3C%2Ftext%3E%3C%2Fsvg%3E)
What you will learn about withdrawal and consent records
- Handle withdrawal correctly
- Keep consent records
- Understand what happens after withdrawal
Section 6 on withdrawal (withdrawal and consent records)
A Data Principal can withdraw consent at any time and it must be as easy as giving it. Consequences of withdrawal are borne by the principal. Processing done before withdrawal stays lawful. After withdrawal the fiduciary must stop processing within a reasonable time and cause its processors to stop, unless law requires or permits otherwise.
Withdrawal flow
Select a numbered box to read more.
Consent record fields (withdrawal and consent records)
| Field | Why |
|---|---|
| Who | Identify the principal |
| When | Date and time |
| What notice version | Show what she saw |
| What purpose | Specific |
| How | Channel and action |
| Withdrawal date | Evidence of stop |
Worked example
A user unticks marketing in the settings. The system stops marketing the same day, notifies the email vendor, and logs the date.
Activity (5 minutes) (withdrawal and consent records)
Create a consent log with the six columns above. See How to manage consent and withdrawal.
Check your understanding of withdrawal and consent records
Q1. Withdrawal must be:
Q2. Earlier lawful processing after withdrawal is:
Q3. A consent record should include:
Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.