How must consent withdrawal work under the DPDP framework?
Answer:
Withdrawing consent must be as easy as giving it. When a Data Principal withdraws consent, the Data Fiduciary (and any processor acting on its behalf) must stop processing that personal data within a reasonable time and erase it, unless retention is required by law. Withdrawal does not affect the lawfulness of processing done before it.
consent withdrawal easy erase stop processing
Related Questions:
- By when do organizations need to technically integrate with Board-registered Consent Managers?
- Is the consent notice required to give contact details?
- What makes consent valid under Section 6 of the DPDP Act?
- Must a Data Fiduciary maintain data accuracy?
- What is the right to correction and erasure?
- How are DPDP penalties determined by the Board?