Consent Withdrawal Mechanism Checker

DPDP Section 6(4) requires that withdrawing consent must be as easy as the process for giving it. If consent was given with a single click on a form, withdrawal must be achievable through a similarly accessible process — not buried three levels deep in account settings or requiring an email request.

Restricting core service because consent for non-essential processing was withdrawn is likely a DPDP violation. If the service is genuinely contingent on the specific processing (e.g. a personalisation service that cannot function without consent), the service can end — but general account suspension as a penalty for withdrawal is not permitted.

The DPDP Rules 2025 are expected to specify maximum processing timelines for consent withdrawal. Best practice is immediate or within 7 days. Withdrawal that takes 30+ days is at risk of being found to violate the 'as easy' standard.