Interactive Checklist

C-05 Notice & Consent Product Manager & UX Designer

The Withdrawal Parity Test

Technical and UX audit ensuring that withdrawing consent is as easy, fast, and accessible as giving consent under Section 6(4).

Statutory Source: Ch. 10 §5: give-path vs withdraw-path, channels, language, confirmation (s.6(4))

Total Verification Points: 6 Audit Checks

C-05Ch. 10 §5: give-path vs withdraw-path, channels, language, confirmation (s.6(4))

The Withdrawal Parity Test

If withdrawal is harder than consent, you fail s.6(4)

Readiness Score

0 / 6 checks

Click Count Parity: The number of clicks/taps required to withdraw consent does not exceed the clicks taken to grant consent.

Section 6(4)

Channel Availability Parity: Withdrawal is available across every channel where consent was captured (web, mobile, app, IVR).

Section 6(4)

No Dark Pattern Friction: No mandatory cooling-off delays, survey gates, guilt-trip dialogue boxes, or hidden navigation.

Section 6(4)

Clear Consequence Disclosure: Immediate, honest summary of services affected upon withdrawal without punitive disconnections.

Section 6(4)

Automated Downstream Cessation: Processing stops across all internal microservices and external processors within SLAs.

Section 6(4) & Section 8(2)

Immediate Written Confirmation: Data Principal receives an instant receipt/email confirming successful withdrawal of consent.

Section 6(4)

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 6(4)

Section 6(1)

Section 8(7)

Rule 3

Statutory Context:

This checklist is directly anchored in Ch. 10 §5: give-path vs withdraw-path, channels, language, confirmation (s.6(4)). Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-001 Architecture Spec →

Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-002 Architecture Spec →

Core Lending Monolith & Transaction Store

Domestic production database and primary system of record for loan servicing

SYS-003 Architecture Spec →

Marketing Automation Engine

Processor-operated messaging engine (ENT-004) gated by optional consent

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-05 Workpaper →

Control Dossier OBL-05

OBL-13 Workpaper →

Control Dossier OBL-13

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-04 — The Exemption Trap Checklist

Next Checklist

C-06 — The Breach Intimation Checklist