--- title: "Section 32: Voluntary undertaking" url: https://dpdp.myndsolution.com/wiki/act/section-32-voluntary-undertaking/ description: "Section 32 of the Digital Personal Data Protection Act, 2023 (Voluntary undertaking). Official text verbatim, comes into force on 13 may 2027, with…" kind: act-section updated: 2026-09-09 official_source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf text_type: official-text-plus-interpretation publisher: MYND Integrated Solutions license: Official Government of India texts are reproduced verbatim (public domain / open government data). Interpretation is CC BY 4.0, MYND Integrated Solutions. disclaimer: Not legal advice. Official text prevails over any interpretation. html_version: https://dpdp.myndsolution.com/wiki/act/section-32-voluntary-undertaking/ --- # Section 32: Voluntary undertaking *The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Chapter VII: APPEAL AND ALTERNATE DISPUTE RESOLUTION. Comes into force on 13 May 2027.* ## Official text - **(1)** The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28. - **(2)** The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking. - **(3)** The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking. - **(4)** The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5). - **(5)** Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33. ## Interpretation in plain English (not legal advice) > This is a plain-English interpretation of the official text, prepared by the DPDP Wiki editorial team. It is not the law and not legal advice, and it may be incomplete or wrong. Always rely on the official text of the Act, the Rules and the notifications, and take advice from a qualified professional for your situation. Section 32 allows the Data Protection Board of India (the Board) to accept a voluntary undertaking from any person during a proceeding under Section 28. This can happen at any stage of the proceeding. A voluntary undertaking is a formal promise regarding compliance with the provisions of the Act.\n\nThe undertaking can include promises to take specific actions within a timeframe set by the Board, to stop taking certain actions, or to publicize the undertaking itself. Once the Board accepts this promise, it acts as a bar on further proceedings under the Act regarding the specific contents of that undertaking. The Board can change the terms of the undertaking later, but only if the person who made the promise agrees to the changes.\n\nIf a person fails to follow the terms of an accepted voluntary undertaking, that failure is legally treated as a breach of the Act. In such cases, the Board will give the person an opportunity to be heard and can then proceed with penalties under Section 33. The text also notes that the Appellate Tribunal may send any of its orders to a local civil court, which must execute the order as if it were a decree made by that court. ### Key points - The Board may accept a voluntary undertaking from any person at any stage of a proceeding under section 28. [(1)] - The Appellate Tribunal can transmit its orders to a local civil court to be executed as a court decree. [(2)] - An undertaking may require a person to take action within a set time, refrain from action, or publicize the undertaking. [(2)] - The Board can vary the terms of an accepted undertaking only with the consent of the person who gave it. [(3)] - Accepting the undertaking bars further proceedings on the matters it covers, unless the person breaks the promise. [(4)] - Failing to adhere to the undertaking is deemed a breach of the Act, allowing the Board to proceed under section 33 after a hearing. [(5)] ### Common misreadings - Readers might think the Board can change the terms of an undertaking whenever it wants, but the Board must get the consent of the person who gave it. - Readers might assume that giving an undertaking completely clears them of all future actions, but failing to adhere to the terms is treated as a new breach of the Act. *Interpretation prepared 2026-09-09 from the official text only; the official text prevails.* --- Cite as: Digital Personal Data Protection Act, 2023, s. 32. Official source: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf