Lawfulness and transparency

Withdraw consent

Record a withdrawal, identify every activity depending on that consent, and trigger cessation, deletion, restriction or a review of the basis.

When a subscriber withdraws consent to marketing emails, the withdrawal has to be as easy to record as the original consent was, and every activity that depended on it has to surface immediately rather than through a search.

This is exercised at a media company where marketing, personalisation and a partner sharing arrangement all cited the same consent record. Withdrawing it in one place has to expose all three, not just the one the requester remembered to mention.

The proof is that the withdrawal date is recorded, the dependent activities are listed without being searched for, and the erasure that follows is raised as its own tracked action.

Regulation

Articles 7(3) and 17

Registers

Consent record · Processing activity · Privacy action · Data subject request

The steps

1. 01Open the Consent records register and select the record to withdraw.
2. 02Use the state rail to move the record from Active to Withdrawn, entering the date.
3. 03Open the Linked records band to read the activities linked to this consent.
4. 04For each dependent activity, decide whether processing must cease, and note the decision on the activity's Details tab.
5. 05Open the Privacy actions register and use the plus button beside the register title to raise the cessation or erasure that follows.
6. 06Link the new action back to the consent record and the affected activity.