/The Act · Chapter VII · Appeal and Alternate Dispute Resolution
Section 32: Voluntary undertaking
DPDP Act, 2023 (No. 22 of 2023). Comes into force on 13 May 2027.
- Provision
- Section 32 of The Digital Personal Data Protection Act, 2023
- Status
- Comes into force on 13 May 2027 (phase 3) G.S.R. 843(E)
- Rules made under it
- None identified
- Source
- Ministry of Law and Justice (Legislative Department) · 11 August 2023 · Official PDF
The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28.
The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking.
The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking.
The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5).
Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33.
Section 32 allows the Data Protection Board of India (the Board) to accept a voluntary undertaking from any person during a proceeding under Section 28. This can happen at any stage of the proceeding. A voluntary undertaking is a formal promise regarding compliance with the provisions of the Act.\n\nThe undertaking can include promises to take specific actions within a timeframe set by the Board, to stop taking certain actions, or to publicize the undertaking itself. Once the Board accepts this promise, it acts as a bar on further proceedings under the Act regarding the specific contents of that undertaking. The Board can change the terms of the undertaking later, but only if the person who made the promise agrees to the changes.\n\nIf a person fails to follow the terms of an accepted voluntary undertaking, that failure is legally treated as a breach of the Act. In such cases, the Board will give the person an opportunity to be heard and can then proceed with penalties under Section 33. The text also notes that the Appellate Tribunal may send any of its orders to a local civil court, which must execute the order as if it were a decree made by that court.
Key points
- The Board may accept a voluntary undertaking from any person at any stage of a proceeding under section 28. [(1)]
- The Appellate Tribunal can transmit its orders to a local civil court to be executed as a court decree. [(2)]
- An undertaking may require a person to take action within a set time, refrain from action, or publicize the undertaking. [(2)]
- The Board can vary the terms of an accepted undertaking only with the consent of the person who gave it. [(3)]
- Accepting the undertaking bars further proceedings on the matters it covers, unless the person breaks the promise. [(4)]
- Failing to adhere to the undertaking is deemed a breach of the Act, allowing the Board to proceed under section 33 after a hearing. [(5)]
Common misreadings
- Readers might think the Board can change the terms of an undertaking whenever it wants, but the Board must get the consent of the person who gave it.
- Readers might assume that giving an undertaking completely clears them of all future actions, but failing to adhere to the terms is treated as a new breach of the Act.
Interpretation prepared from the official text only, 9 September 2026. The official text above prevails.
/MYND · DPDP practice
Putting this into practice?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.