Shrnutí: Under the GDPR, you may withdraw your consent to the processing of personal data at any time, and withdrawing consent must be as easy as giving it. Withdrawal does not have retroactive effect; however, the controller generally may no longer continue processing based on the withdrawn consent. We’ll explain how to withdraw consent under the GDPR, what the withdrawal notice should include, and when your data may continue to be processed.
Not sure whether a company can continue to use your personal data after you withdraw your consent? Our attorneys will assess the legal basis for the data processing and advise you on how to effectively defend your rights.
The GDPR, or General Data Protection Regulation, is a regulation designed to strengthen and harmonize data protection for all EU citizens and give them greater control over their personal data. The GDPR thus applies to all organizations that process the personal data of EU citizens (e.g., online stores, government agencies, hospitals, etc.). Key principles of the GDPR include fair and lawful processing, purpose limitation, data minimization, and the retention of personal data.
As a general rule, you must be informed about the processing of your personal data before it takes place. You must therefore receive information, for example, about the purposes of the processing, the types of personal data collected, the recipients, and the rights of these individuals regarding personal data protection.
Contact Dostupný advokát. We will review your case and, within 24 hours, prepare a proposal for legal services to resolve it. If you then decide to entrust the resolution of your case to us, the proposal will be provided free of charge.
The GDPR grants you a number of rights designed to help you control and protect your personal data. Specifically, these include:
This includes the right to be clearly informed about why your data is needed, how long it will be retained, and who has access to it. This means that the data controller must provide transparent information, communicate clearly, and comply with other requirements regarding the processing of personal data.
Tip: Be sure to also read about how the GDPR regulates employee privacy in the workplace.
You have the right to request a copy of the information that a particular organization holds about you (in most cases, free of charge). This allows you to verify what personal data is being processed and whether its processing complies with the law.
If the information is inaccurate or incomplete, you can request that it be updated.
This right allows you to request the erasure of your personal data. However, this applies only under certain circumstances, such as when the data is no longer necessary or when the processing was based on consent that has been withdrawn.
This allows you to “freeze” the processing of your personal data under certain circumstances (for example, while the accuracy of the data is being verified or while you object to the processing).
This gives you control over your personal data by allowing you to transfer it from one service to another. This right promotes competition and innovation because it facilitates, for example, switching to a new platform or service.
In certain cases, you have the right to object to the processing of your data. This applies in particular to situations where your personal data is processed for marketing purposes.
You have the right not to be subject to decisions based solely on automated processing, including profiling, if such activities have a significant impact on you. This includes situations where such decision-making could lead to legal effects or similarly significant consequences.
Among the most frequently exercised rights is the ability to withdraw consent to the processing of personal data, which is often associated with some confusion.
Tip: You’ve probably come across a popular service that lets you trace your ancestors using DNA. But you can read about what the GDPR has to say about this in our article.
Under the GDPR, you may withdraw your consent to the processing of personal data at any time, and doing so must be just as easy as giving consent. These are the basic principles that apply:
When it comes to the processing of personal data, it is important to keep in mind that your consent may not always be explicit. In some cases, it is implied. For example, when you order a service that requires you to provide your personal data. In this case, your very interest in the service is considered consent to the processing of your personal data.
Withdrawal does not have to follow any prescribed form. If the controller offers a simple option directly within your account, in an app, or via a link in an email, you can use it. Otherwise, you can withdraw consent, for example, by email or letter.
It is advisable to include the following in your withdrawal:
For example, the following wording is sufficient: “I hereby withdraw my consent to the processing of personal data provided for the purpose of sending marketing communications.”
In practice: A common source of misunderstanding is the belief that, upon withdrawal of consent, a company must automatically delete all customer data. However, this is not always the case. For example, if a company needs certain data to fulfill a legal obligation or to protect its legal claims, it may continue to process that data for that other purpose.
Have you withdrawn your consent, but the company continues to use your data and claims it is authorized to do so? We can help you verify the legal basis for the processing and prepare the next steps regarding the data controller or the Office for Personal Data Protection.
If you are a data controller yourself (e.g., you own an e-shop) and are considering entrusting this responsibility to someone else, you may have already come across the term “data processing agreement.” This agreement governs the relationship between the controller (i.e., the party that determines the purposes and means of personal data processing—you) and the processor (the party that processes personal data on behalf of the controller—a third party). This agreement should cover all important aspects of personal data processing to ensure that the data is protected and processed in accordance with the GDPR.
Tip: Many business owners have used templates found online to meet their legal obligations under the GDPR and have adapted their documents and terms of service accordingly. However, this is far from enough to ensure that everything is done correctly and that you avoid a fine from the Office for Personal Data Protection. Instead, choose the more reliable option of a GDPR audit for businesses. With Dostupný advokát, the entire process is simple, online, tailored to your specific needs, and at a fixed price. We handle most cases within five business days.
So what should the contract include?
Consent to the processing of personal data is an essential legal tool that protects your data. If you are unsure how to properly grant, manage, or withdraw consent, consult a legal professional.
Under the GDPR, you may withdraw your consent to the processing of personal data at any time, and doing so must be just as easy as granting it. Depending on the circumstances, you can withdraw your consent, for example, through your user account, a link in an email, or by sending a message to the controller. Withdrawal does not have retroactive effect, so processing carried out before the withdrawal remains lawful. However, the controller cannot rely on the withdrawn consent for further processing. This does not mean, however, that the controller must automatically erase all of your personal data—there may be other legal grounds for retaining some of it. If the controller does not respect your withdrawal, you may contact the Office for Personal Data Protection.
No. You can withdraw your consent at any time, and you do not need to provide any reason for your decision.
Withdrawing consent must be as easy as giving it and should not entail harm or create undue obstacles for the person withdrawing it.
No. If you have given consent for several different purposes, you may only withdraw your consent for a specific type of processing.
No. It depends on what options the administrator offers. If consent is given electronically, there should be an equally simple electronic way to revoke it.
This does not necessarily constitute a violation of the GDPR. A company may have another legal basis for retaining certain data, such as a statutory obligation.
Our team of experienced attorneys will help you solve any legal issue. Within 24 hours we’ll evaluate your situation and suggest a step-by-step solution, including all costs. The price for this proposal is only CZK 690, and this is refunded to you when you order service from us.
Ondřej is the attorney who came up with the idea of providing legal services online. He's been earning his living through legal services for more than 15 years. He especially likes to help clients who may have given up hope in solving their legal issues at work, for example with real estate transfers or copyright licenses.
Ondřej is the attorney who came up with the idea of providing legal services online. He's been earning his living through legal services for more than 15 years. He especially likes to help clients who may have given up hope in solving their legal issues at work, for example with real estate transfers or copyright licenses.
We’ll review your case and suggest how to resolve it for CZK 690.
In person and online. Just choose the appropriate service or opt for an independent consultation when you are unsure.
