Definition
LawConsent withdrawal is a Data Principal's act of revoking previously given consent for a specific processing purpose. Under Section 6, the Act requires that the process for withdrawing be as easy as the process for giving it was — a direct, comparative standard, not a separately defined checklist. If consent was given with one click, withdrawal needs to be roughly that easy too; it can't require a phone call, a written request, or navigating through several settings screens if the original consent took one click on a banner.
Why It Matters
Withdrawal is the part of the consent lifecycle most likely to be under-built, because it's not the part anyone is incentivised to optimise for conversion. It's also one of the more visible compliance gaps to an outside observer — a Data Principal who tries to withdraw and hits friction (a hidden setting, a support ticket that takes days) has a very concrete, easy-to-articulate complaint, which is exactly the kind of thing more likely to end up in front of the Data Protection Board once its enforcement powers are active.
How It Works in Practice
- Same channel, same effort — if consent was given in-app, withdrawal should be available in-app, not only by emailing support.
- Granular, not all-or-nothing — if purposes were consented to separately, withdrawal should let a Data Principal revoke one purpose without being forced to withdraw everything.
- Propagates everywhere the consent was used — the withdrawal needs to reach every system that was relying on that consent (CRM, marketing automation, analytics, any vendor it was shared with), not just the system the withdrawal request came through.
- Doesn't retroactively undo lawful past processing — data already processed under valid consent before withdrawal isn't automatically unlawful in hindsight; withdrawal governs processing going forward.
A Data Principal consented to marketing emails via a single checkbox at signup. A working withdrawal flow gives them an unsubscribe link in every marketing email, and a settings toggle in their account, either of which immediately stops future marketing sends — not a form that generates a support ticket resolved "within 30 days."
Building an unsubscribe link that only removes someone from the email marketing tool, while their consent status in the CRM and any ad-retargeting audience list stays unchanged — meaning they keep receiving retargeted ads or getting synced back into a marketing list on the next CRM export. The withdrawal needs to reach every downstream system, not just the one the click happened in.
Implementation Checklist
- Withdrawal is available through at least the same channel consent was given in.
- Withdrawal is purpose-specific where consent was purpose-specific.
- A single withdrawal action updates every downstream system relying on that consent, not just one.
- The consent record is updated to reflect withdrawal (with a timestamp), not deleted outright — the history matters for your own audit trail.
- Withdrawal doesn't require more identity verification or friction than the original consent did.