Readiness assessment
The Act
The DPDP Act, explainedThe DPDP Rules 2025

Ch IPreliminary

S.1 Short title and commencementS.2 DefinitionsS.3 Application and scope

Ch IIObligations of Data Fiduciary

S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data Fiduciary

Ch IIIRights and duties of Data Principal

S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data Principal

Ch IVSpecial provisions

S.16 Transfer outside IndiaS.17 Exemptions

Ch VData Protection Board of India

S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the Chairperson

Ch VIBoard powers and procedure

S.27 Powers and functions of the BoardS.28 Procedure followed by the Board

Ch VIIAppeal and dispute resolution

S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertaking

Ch VIIIPenalties

S.33 Penalties and the ScheduleS.34 Penalties to Consolidated Fund

Ch IXMiscellaneous

S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other Acts
Industries
Implementation
Training
Resources
About
Readiness assessment
Share this section

Chapter VII · Appeal and Alternate Dispute Resolution

Section 32: Voluntary Undertaking

Section 32 is the settlement-with-teeth route: at any stage of a Board inquiry you can offer a binding commitment to fix, stop or publicise something, and if the Board accepts it, that closes the matter on those points, unless you break it.

Official text
Section 32Voluntary undertaking
Chapter
Chapter VII · Appeal and ADR
Status
Enacted · phased commencement
Full compliance
13 May 2027
Applies to
Any person in a s.28 inquiry
Official citation
DPDP Act, 2023, s.32
Reading time
7 min
Updated
August 2026

At a glance

Section 32 lets the Data Protection Board accept a voluntary undertaking from any person at any stage of a Section 28 proceeding, in respect of observance of the Act [32(1)]. The undertaking can commit the person to take or refrain from specified action within a Board-set time, and to publicise it [32(2)]; the Board can vary its terms only with the giver's consent [32(3)]. Acceptance bars further proceedings under the Act as regards the undertaking's contents, except on breach [32(4)]. If the person fails to adhere to any term, that failure is deemed a breach of the Act, and the Board may, after a hearing, proceed to a Section 33 penalty [32(5)]. The Schedule ties the penalty for that breach to the maximum applicable to the underlying breach that started the Section 28 proceeding, not a fixed figure. Section 32 takes effect on 13 May 2027.

Applies to Any person in an inquiryChapter Chapter VIIEffective 13 May 2027Read time 7 min

Section 32: key takeaways

  • Section 32 lets the Board accept a voluntary undertaking from any person at any stage of a Section 28 inquiry [32(1)].
  • The undertaking can commit you to take or stop specified action within a Board-set time, and to publicise it [32(2)]; terms can be varied only with your consent [32(3)].
  • Its power is the express bar: once accepted, the Act bars further proceedings on the undertaking's contents [32(4)], the certainty that Section 31 mediation does not give.
  • That bar is limited to the contents: it is not a blanket immunity for other issues, data, systems or future processing.
  • Breach re-opens everything: failing any term is deemed a breach of the Act, and the Board may move to a Section 33 penalty after a hearing [32(5)].
  • The penalty for that breach tracks the underlying breach that started the inquiry (its Schedule maximum), not a fixed amount.

Who Section 32 applies to

Read this if you are in, or could face, a Board inquiry and want a controlled exit: it explains how a voluntary undertaking closes a matter, what it costs you, and how breaking it can bring the penalty back.

FoundersLegal / DPOCompliance leadsProduct / engineering

Section 32 in plain language

Section 32 is the settlement route with real closure. During a Board inquiry, you can offer a binding commitment, to fix something, stop something, or publish the commitment, and if the Board accepts it, the Act bars further proceedings on those points.

That express bar is what makes it stronger than mediation: Section 31 gives no such guarantee, but a Section 32(4) acceptance does, at least for what the undertaking covers. It is not a blanket release for everything else.

The catch is symmetrical. Breaking any term is deemed a breach of the Act, and the Board can then move to a Section 33 penalty. So an undertaking is only worth offering if you are certain you can deliver every commitment in it.

Section 32 of the DPDP Act: full text

Section 32: Voluntary Undertaking

32(1) The Board may accept a voluntary undertaking, in respect of any matter related to observance of the Act, from any person at any stage of a proceeding under Section 28.

32(2) The undertaking may include a commitment to take specified action within a Board-determined time, to refrain from specified action, and to publicise the undertaking.

32(3) The Board may, with the consent of the person who gave it, vary the terms of an accepted undertaking.

32(4) Acceptance of the undertaking bars proceedings under the Act as regards its contents, except in cases covered by sub-section (5).

32(5) Where a person fails to adhere to any term, the breach is deemed a breach of the Act, and the Board may, after a hearing, proceed under Section 33.

Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What Section 32 means for your business

  • Offer an undertaking only when you can deliver every term: because breach is deemed a breach of the Act, an overbroad or technically impossible commitment is worse than none.
  • Scope it tightly to the specific issue in the proceeding: the Section 32(4) bar only covers the undertaking's contents, so a precise scope is a feature, not a weakness.
  • Make it auditable: named owner, concrete action, Board-set deadline, evidence (config records, test results, processor confirmation, deletion certificates), and a monitoring cadence.
  • Do not promise what the law forbids: you cannot undertake to delete records you must retain under tax, legal-hold or sectoral rules, and any variation later needs the Board's process and your consent.
  • Weigh the trade-off honestly: certainty and closure now, against a binding, possibly published commitment whose breach revives penalty exposure. Not sure you can stand behind every term? Take the readiness assessment or find a specialist first.

Frequently asked questions about Section 32

Can we give an undertaking before a Section 28 proceeding starts?
No. Section 32 applies at any stage of a proceeding under Section 28. It is not a pre-proceeding self-reporting route.
Does offering an undertaking stop the inquiry?
Not by itself. Only the Board's acceptance creates the Section 32(4) bar, and that bar is limited to the undertaking's contents.
Can the Board change the terms later?
Yes, but only with the consent of the person who gave the undertaking.
Does an accepted undertaking guarantee no penalty?
It bars further proceedings on its contents, unless you breach it. It is not immunity for unrelated conduct, future breaches or matters outside its scope.
What happens if we miss a deadline in it?
Failing any term is deemed a breach of the Act. After a hearing, the Board may proceed under Section 33, with the penalty tracking the underlying breach that started the inquiry.

Sources

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment