Implementing Regulation of PDPL Article 12 gives individuals the right to withdraw their consent to personal data processing at any time. Controllers must make the withdrawal process clear and easy, and once consent is withdrawn, they must stop processing and notify all third parties who received the data. However, this doesn’t apply to data processed under a different legal basis.
Implementing Regulation of PDPL Article 12 (1)
Consent Withdrawal Right:
Data Subject has the right to withdraw their consent for Processing their Personal Data at any time, and they shall inform the Controller of this through any available means according to Article (4) of this Regulation.
Implementing Regulation of PDPL Article 12 (2)
Simple Withdrawal Process:
Before requesting consent from the Data Subject, the Controller shall establish
procedures that allow for the withdrawal of that consent and take the necessary measures to ensure their implementation, with the procedures for withdrawing consent being similar to or easier than those for obtaining it.
Implementing Regulation of PDPL Article 12 (3)
Stop Processing Immediately:
In the event of consent withdrawal, the Controller shall cease Processing without undue delay from withdrawal request. The withdrawal of consent shall not affect the lawfulness of Processing based on consent before its withdrawal.
Implementing Regulation of PDPL Article 12 (4)
Notify Data Recipients:
When the Data Subject withdraws their consent for Processing their data, the Controller shall take appropriate measures to notify those to whom the Personal Data has been disclosed and request its Destruction through any available means.
Implementing Regulation of PDPL Article 12 (5)
Legal Basis Exception:
Consent withdrawal shall not affect the Processing of Personal Data that is based on other legal basis.
Explanation of Implementing Regulation of PDPL Article 12
Data Subjects may revoke consent at any time:
Implementing Regulation of PDPL Article 12 (1) says, individuals have the right to inform Controllers to stop processing their data.
Withdrawal must be as easy as giving consent:
Implementing Regulation of PDPL Article 12 (2) says, controllers must set up and implement simple, accessible withdrawal procedures.
Processing must halt after withdrawal:
Implementing Regulation of PDPL Article 12 (3) says, controllers must cease processing without undue delay, but past lawful processing remains valid.
Others must be told to destroy data:
Implementing Regulation of PDPL Article 12 (4) says, controllers must inform all third parties to destroy the data once consent is withdrawn.
Other legal bases remain valid
Implementing Regulation of PDPL Article 12 (5) says, if processing is based on a different lawful basis, withdrawal of consent doesn’t apply.
