Imagine a customer who has given consent to an online financial services platform to process data for marketing purposes. I feel this step shows trust from the customer.
A months later the customer decides to withdraw that consent. Of contacting the financial services company directly the customer uses a registered Consent Manager. The customer hopes the Consent Manager will handle the withdrawal quickly.
The Consent Manager records the withdrawal request. Forwards it to the company. However the company continues sending marketing communications. The customer is puzzled by this mismatch.
The customer now has a question: who is responsible? The customer wonders who must fix this.
Should the complaint be addressed to the Consent Manager, the Data Fiduciary or both? The customer seeks clarity.
This is an issue that businesses and Consent Managers must understand as Indias Digital Personal Data Protection framework develops. It matters to all customers and companies alike.
- Understanding the roles
The Consent Manager and the Data Fiduciary have different responsibilities. The roles are not the same.
A Consent Manager acts as a point of contact through which an individual can give, manage, review and withdraw consent. The Consent Manager is the line for consent changes.
A Data Fiduciary on the hand determines the purpose and means of processing personal data. The Data Fiduciary decides how data is used.
The distinction matters because facilitating withdrawal and actually stopping consent-based processing are two activities. The Consent Manager can send the request. The Data Fiduciary must stop the data use.
For example a Consent Manager may successfully transmit a withdrawal instruction. The Data Fiduciary may fail to update its internal marketing database. The withdrawal may not be applied.
The technical failure may occur at the Data Fiduciarys end. The individual should not be left without a proper grievance mechanism. The customer must have a way to complain.
- What happens when withdrawal fails?
Consider the following situation:
- A customer withdraws consent through a Consent Manager.
- The Consent Manager records the withdrawal.
- The withdrawal instruction is transmitted to the Data Fiduciary.
- The Data Fiduciarys system does not process the instruction.
- Marketing messages continue to reach the customer.
There are possible reasons for the failure:
- Technical failure: The API connecting the two platforms may be unavailable.
- Integration failure: The Data Fiduciary may not have configured its systems to recognise withdrawal instructions.
- Operational failure: The request may have reached the company but remained unprocessed.
- Record mismatch: The Consent Manager may show a completed withdrawal while the Data Fiduciarys system continues to show consent.
Each situation requires investigation. Each situation requires investigation. Simply marking the request as completed on the Consent Managers dashboard does not resolve the individuals problem. The customer still receives marketing emails.
- Who is responsible for stopping processing?
Section 6(4) of the DPDP Act provides for withdrawal of consent at any time with the ease of withdrawal being comparable to the ease of giving consent. The law makes withdrawal simple.
Section 6(6) provides that following withdrawal the Data Fiduciary must within a time cease and cause its Data Processors to cease processing the personal data unless continued processing is required or authorised under the Act or another applicable Indian law. The Data Fiduciary must act fast.
Therefore the Data Fiduciary has a responsibility to implement the consequences of withdrawal. The Data Fiduciary must stop the data use.
The Consent Managers role is different. It must perform its obligations relating to consent management, records and communication through its platform. The Consent Manager must keep records.
The Consent Manager cannot simply assume that its responsibility ends when an API request is transmitted. Its own platform and record‑management obligations must also be fulfilled. The Consent Manager must keep the withdrawal logged.
- What should an effective grievance mechanism look like?
A practical grievance‑handling system should have a documented process. The steps must be easy to follow.
Step 1: Register the complaint.
The individual should be able to report that a withdrawal request has not been implemented. The complaint must be simple to file.
Step 2: Identify the parties. The complaint must point to the Consent Manager or the Data Fiduciary.
Step 3: Verify the transaction. The system must check the records.
Step 4: Escalate the matter. The complaint must go to the team.
Step 5: Verify resolution. The complaint must show a fix.
Step 6: Communicate the outcome. The customer must hear what happened.
The individual should receive a response explaining what happened and what action was taken. The response must be honest.
- What does Rule 14 provide?
Rule 14 of the DPDP Rules 2025 deals, with the rights of Data Principals.
It requires Data Fiduciaries and where Consent Managers to publish the means through which individuals can exercise their rights.
Importantly Rule 14(3) requires every Data Fiduciary and Consent Manager to establish a grievance redressal system and publish it on their website or app.
It also requires technical and organisational measures so that grievances are resolved within a reasonable time that does not exceed ninety days.
However there is a start date: Rule 14 will become active eighteen months after the Rules are published that is on 13 May 2027 and not on 13 November 2026.
Therefore the ninety‑day rule should not be shown as a duty that starts today.
- Can a person go to the Data Protection Board?
Yes, when the relevant laws are active and the complaint process is ready.
Section 27 of the DPDP Act lists the powers and duties of the Board such as handling complaints and other matters covered by the Act.
The person should keep proof of the withdrawal request the acknowledgement, messages and any ongoing processing.
These records can be important to show what occurred and whether the required duties were met.
- What should companies learn from this?
Companies should not see withdrawal as a button in an app.
It is a process that may need many systems, vendors, databases and inside teams.
Companies should set up:
- A team for withdrawal complaints.
- Clear steps to raise issues with Consent Managers.
- Reliable logs for transactions and acknowledgements.
- Steps to spot failed withdrawal requests.
- Match consent records, with processing activities.
- A way to confirm that Data Processors have received the instructions.
Conclusion
The success of a Consent Manager will not be judged by how easily a customer can withdraw consent.
It will also depend on whether the withdrawal instruction’s recorded correctly sent out and shown in the proper consent‑management process.
At the time a Data Fiduciary cannot give up its legal duties just by adding a Consent Manager.
The main rule is this: consent withdrawal must be treated as a compliance action, not just a recorded customer preference.
