OB-DB-006PSR 43(2b)Consent dashboard

After withdrawal, the TPP stops and deletes

What the text fixes

After a withdrawal, the TPP stops accessing and using the data, then deletes it without undue delay but not before 48 hours, unless the user explicitly chooses to let it keep the data.

Article: PSR 43(2b)Provisional numbering of the April 2026 compromise (Council doc. 8221/26). The final numbering will be added when the Official Journal publishes the text, without changing the id.
Who is bound: AISP, PISP
Who it is for: Product, Compliance, Operations, Audit and pentest
Application: 21 months after entry into force, the general application date (Article 112).
Level 2: No EBA mandate covers this obligation.
Origin: New, with no equivalent in PSD2 or in the 2018 RTS.

STET 1.6.3

Out of spec

The TPP can only apply this rule if it learns of the withdrawal, which STET only tells it indirectly (OB-DB-008).

Sources

Council doc. 8221/26, page 259

Checked on October 4, 2026

The entry as JSON

{
  "id": "OB-DB-006",
  "article": "PSR 43(2b)",
  "alsoIn": [],
  "articleFinal": null,
  "actors": [
    "aisp",
    "pisp"
  ],
  "roles": [
    "product",
    "compliance",
    "infra",
    "pentest"
  ],
  "appliesAt": "T+21",
  "title": {
    "fr": "Après un retrait, le TPP arrête et supprime",
    "en": "After withdrawal, the TPP stops and deletes",
    "es": "Tras una retirada, el TPP se detiene y borra",
    "pt-br": "Após a retirada, o TPP para e apaga"
  },
  "level1": {
    "fr": "Après un retrait, le TPP cesse d'accéder aux données et de les utiliser, puis les supprime sans retard injustifié mais pas avant 48 heures, sauf si l'utilisateur choisit expressément qu'il les garde.",
    "en": "After a withdrawal, the TPP stops accessing and using the data, then deletes it without undue delay but not before 48 hours, unless the user explicitly chooses to let it keep the data.",
    "es": "Tras una retirada, el TPP deja de acceder a los datos y de usarlos, y luego los borra sin demora indebida pero no antes de 48 horas, salvo que el usuario elija expresamente que los conserve.",
    "pt-br": "Após uma retirada, o TPP deixa de acessar e de usar os dados e depois os apaga sem demora injustificada, mas não antes de 48 horas, salvo se o usuário escolher expressamente que ele os mantenha."
  },
  "level2": null,
  "origin": [],
  "stet": {
    "1.6.3": {
      "status": "out-of-scope",
      "note": {
        "fr": "Le TPP ne peut appliquer cette règle que s'il apprend le retrait, ce que STET ne fait qu'indirectement (OB-DB-008).",
        "en": "The TPP can only apply this rule if it learns of the withdrawal, which STET only tells it indirectly (OB-DB-008).",
        "es": "El TPP solo puede aplicar esta regla si se entera de la retirada, algo que STET solo le comunica de forma indirecta (OB-DB-008).",
        "pt-br": "O TPP só pode aplicar essa regra se souber da retirada, o que o STET só lhe comunica de forma indireta (OB-DB-008)."
      },
      "pages": []
    }
  },
  "verification": null,
  "sources": [
    {
      "document": "8221/26",
      "page": 259
    }
  ],
  "verifiedAt": "2026-10-04"
}

All obligations Markdown version