A customer withdraws consent. Must the company immediately delete every record about that customer?
Not necessarily.
Under Section 6(6) of the Digital Personal Data Protection (DPDP) Act, withdrawal generally requires the Data Fiduciary and its Data Processors to cease the relevant processing within a reasonable time, unless continued processing is legally required or authorised.
Section 8(7) also requires erasure, subject to legal retention obligations.
Consider a customer who closes a bank account.
The bank may still be legally required to retain identity and transaction records under applicable banking laws.
The takeaway: Consent withdrawal, cessation of processing and data erasure are connected obligations, but they aren’t identical.
Your systems need to distinguish between data that must be deleted and data that must legally be retained.
This article is general information, not legal advice.