Rights requests and erasure
How people withdraw consent, what erasure removes and what it keeps, how rights requests arrive and how long you have to answer.
Short answers about withdrawal, erasure and rights requests. Each one links to the page that explains it.
Withdrawal#
Can people withdraw consent, and how?#
Yes, at any time. There are five ways:
- the visitor reopens the choices with the privacy button on your site, or with your own link
- a person opens the consent portal from a link your server gives them, and withdraws any consent listed there
- anyone sends a withdrawal request on the hosted request page
- your server withdraws one record, or everything a person agreed to
- your team chooses Withdraw on a record in the console
More: Withdraw consent or erase a person and Data processing.
What happens when someone withdraws?#
Every optional purpose is set to declined, the change is sealed, and a consent.withdrawn webhook goes to your systems. From then on, the consent check answers withdrawn.
On the website the banner script passes the new choice to tags that accept one, such as Google's. It deletes the cookies it knows belong to those purposes and holds their tags back from then on. A script that already ran keeps running until the visitor leaves the page.
More: DPDP duties for notice and consent.
Can a withdrawal be undone?#
No. Every optional purpose is set to declined, and the person would have to consent again.
More: Withdraw consent or erase a person.
Erasure#
Can people ask for erasure, and how do we start it?#
Yes. Erasure can be started in three ways:
- from an erasure request, with Erase and complete
- on the Records page, after you search for the person
- from your server
More: Withdraw consent or erase a person.
What does erasure remove?#
A record whose consent is still in force is withdrawn first. Then the record's identifying details are removed:
- any readable copy of the identifier
- the subject fingerprint
- the IP address hash
- the browser and the page address
- the data your site attached
- every linked identifier
The erasure is sealed as an event on the record.
More: Withdraw consent or erase a person.
What stays after erasure?#
The decisions, the times and a hash of the identifier stay, as proof that the consent was handled properly. The hash cannot be turned back into the identifier.
More: Withdraw consent or erase a person.
Does erasure delete the person's data in our own systems?#
No. The product erases only what it holds, which is consent records. A subject.erased webhook is sent for each record, listing an erase task for each registered Data Processor. When it arrives, delete your own copy and pass the tasks on.
The webhook carries the subject fingerprint as it was before the erasure, so that you can tell whose data to delete.
More: Withdraw or erase a person.
Why are some details kept for a year after erasure in India?#
Rule 8(3) of the DPDP Rules asks for the logs of a processing to be kept for a year. When a record under the DPDP Act is erased less than a year after it was last processed, its identifying values are kept until that year is over.
Linked identifiers are the exception: they are removed at once. The console, receipts and webhooks leave the kept values out in that time. A daily job then clears them.
More: Withdraw consent or erase a person.
Can an erasure be undone?#
No. The console warns that it cannot be undone. If the person consents again, a new record is made.
More: Withdraw consent or erase a person.
Rights requests#
How does a person make a rights request?#
The product hosts a request page for you at https://console.dpconsent.com/consent/sdk/v1/pages/pk_…/request, where pk_… is your publishable key. Where a region rule under the DPDP law applies, the banner links to it as Your rights. The person chooses what they are asking for, enters the identifier you know them by, and sends it.
Your team can also log a request that arrived by email, phone or a support ticket, with Log a request.
More: Ways people send a rights request.
Why can we not complete a request from the hosted page?#
The request waits, as Verifying identity, until the person confirms it is theirs. Your server receives the confirmation link in the subject_request.received webhook and emails it to the person. The product sends no email itself.
If none of your webhook addresses receives it, the person never gets the link. The request cannot be carried out before they confirm.
More: Record and request problems.
How long do we have to answer a request?#
The deadline is the Response deadline in Project settings, 30 days unless you changed it. For India the deadline is never more than 90 days, whatever the setting says.
The deadline runs from the moment the request was sent or logged, not from the moment it was confirmed.
More: Handle a request.
Which requests can be carried out in one step?#
Five types have a button that carries out the request and closes it:
- access and portability: Export and complete
- erasure: Erase and complete
- withdrawal and objection: Withdraw and complete
Correction, restriction and grievance need a person. Your team does the work in your own systems, then chooses Mark completed. A nomination closes when you record the nominee. Write your answer under Reply to the person. The person reads it on their status page, and your systems email it.
More: Handle a request.
How do we find one person's records?#
Open Records, type the identifier your systems use for the person in the search box, and choose Find. The identifier is hashed before matching and is not saved in the database.
The search covers every property in the project, live and test records alike, and marks the test ones. A record is found by the identifier it is kept under, or by any identifier linked to it.
More: Find a person.
What if the request names a different identifier from our records?#
A person may make a request under one identifier, such as an email address. Their records may be kept under another, such as your customer number. Use Link to your identifier on the request to tie the two together.
More: Handle a request.
Children#
What about children?#
The DPDP Act treats anyone under 18 as a child and asks for a parent's verifiable consent. The product does not check anyone's age or identity. You verify the parent or guardian. Then your server records the consent as a child's, with the guardian's relationship and how you verified them.
On such a record, marketing and sale or sharing are always refused. Analytics, personalisation and sensitive-data purposes are refused unless the purpose names a Fourth Schedule exemption that covers it.