What is the right to withdraw consent?

The right to withdraw consent means you can take back your agreement to a business using your personal data at any time — and doing so must be as easy as giving consent was. Once you withdraw, the business must stop the processing that relied on that consent.

Educational resource only — not legal advice.

Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), consent is not a one-time, permanent sign-off. When you withdraw it, the business must stop using your data for that purpose and make any processors it shared the data with stop too, unless another lawful basis genuinely applies. Withdrawal can’t be made deliberately harder than the one-tap “yes” that gave consent in the first place.

Why it matters to you. For an individual, it’s the lever that keeps consent meaningful — you’re not locked in. For a business, your withdrawal flow has to be as simple as your opt-in, and it has to actually stop the processing.

What it is not. Withdrawing consent isn’t the same as erasure — it stops future use, while erasure is a separate request to delete data already held. Withdrawal also doesn’t undo processing that was lawful before you withdrew.