SCENARIO S02 · PROCESSORS & EVIDENCE
A processor keeps using marketing data after the person withdraws consent. What should the fiduciary check?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Verify that the withdrawal caused documented cessation instructions and completion across processors.
Trace the withdrawal from the user control to every affected instruction, while separately documenting any processing required or authorised without consent.
WHY THE OTHER INSTINCTS MISS
Verify that the withdrawal caused documented cessation instructions and completion across processors.
Correct. Act section 6(6), not section 8 alone, specifically addresses causing processors to cease consent-based processing within a reasonable time.
Close the ticket once the first-party marketing list is updated.
That misses processing performed on the fiduciary’s behalf.
Assume the processor owns the withdrawal decision.
The fiduciary remains responsible for the consent-based processing chain; a processor does not inherit an independent decision by default.
BUILD THIS EVIDENCE
Processor instruction, affected-system list, exception rationale and completion timestamp.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 6(4)–(6); G.S.R. 843(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)