sec_5_4__para__5

If consumers exercise their right of withdrawal under the CRD (or the contract termination remedy under the DCD), it is a matter of the GDPR to assess whether the withdrawal from the contract also constitutes the withdrawal of legal basis for the processing of personal data. In many situations, it is very likely that the declaration of the consumer to exercise the right of withdrawal and to terminate the contract can be interpreted as including a withdrawal of the legal basis, including withdrawal of consent to other processing of personal data that was not necessary for the performance of the contract in the meaning of the GDPR. In this situation, the trader/controller has to assess if there is still a valid legal basis for such other processing of those personal data such as, for example, compliance with a legal obligation. In the absence of a valid legal basis, the processing should be discontinued.

← sec_5_4__para__4 · All articles · sec_5_4__para__6 →

Source: EUR-Lex (Cellar) · retrieved 2026-09-25 · Text as adopted (Official Journal); later amendments are not incorporated in this text.