Can I withdraw consent for data processing?

What the Law Says

The Digital Personal Data Protection Act, 2023 grants individuals a clear, enforceable right to withdraw consent for data processing. This right is foundational to the principle of autonomy over personal data.

Under Section 6(4) of the Digital Personal Data Protection Act, 2023, consent is not permanent: it can be withdrawn at any time by the data principal (you). Once withdrawn, the data fiduciary must cease processing your personal data — unless another lawful basis applies.

The law requires that the mechanism to withdraw consent must be 'as easily accessible and usable' as the one used to give consent. This ensures fairness and prevents design-based barriers.

Importantly, withdrawal does not affect the lawfulness of processing done before withdrawal — but all future processing must stop unless justified under an alternative ground (e.g., legal obligation or public interest).

Statutory Text

Consent may be withdrawn at any time by the data principal, and such withdrawal shall be as easily accessible and usable as the manner in which consent was given.

— Digital Personal Data Protection Act, 2023, s. 6(4) — Withdrawal of Consent

Sources