The consequences of withdrawing consent depend on how the data is used and whether it is genuinely needed to provide the service. Essential service data, optional marketing and records retained for legal reasons should be treated separately.
Understand the law and process
The DPDP consent-withdrawal framework is linked to the phased implementation of the principal rights. For the current request, also review the company’s privacy policy, consent terms and applicable regional laws. The framework envisages that withdrawing consent should be as easy as giving it; processing carried out lawfully before withdrawal does not become unlawful solely for that reason. If a service genuinely cannot operate without the relevant data, it may not be possible to continue providing it. However, forcing a user to accept unrelated advertising raises a separate consumer question. A bank’s retention of tax records and its use of those same records for marketing are separate purposes.
In detail: What factors can affect the outcome?
Clearly defining the scope of your request can reduce unintended consequences. State whether you want promotional calls to stop, optional profiling to be discontinued, or the entire account to be closed. Ask the company to explain the consequences in advance. Also ask whether you can access any remaining balance, invoices or necessary documents, so that practical records are not lost as a result of taking steps to protect your privacy.
What should you do?
- First, review the consent categories and the terms of the relevant service; identify which uses are essential and which are optional.
- Identify in writing the purpose for which you are withdrawing permission and ask for written confirmation.
- If the company threatens to stop the service, ask for the reason and any alternative arrangements, and make an appropriate complaint.
Which documents should you keep?
Keep your consent settings, the version of the policy, marketing messages, service agreement and withdrawal request.
Hypothetical example
A customer wants to continue receiving loan alerts but wants to stop partner offers. Turning off all communication permissions could result in repayment reminders being missed. The customer therefore submitted a request distinguishing promotional sharing from necessary account notices.
Will all previous records be erased as soon as consent is withdrawn?
Not necessarily. Withdrawal, deletion and record retention under the law are separate questions, and the basis for each must be considered separately.
Sources and related rules
- Digital Personal Data Protection Act 2023
- DPDP commencement notification, November 2025
- Indian Contract Act, 1872 — Sections 27, 72–74, 126–128
Editorial review: 26 October 2026. This is general legal information. The outcome may vary depending on the facts of the case, applicable state law and subsequent amendments.