Chapter VII · Appeal and Alternate Dispute Resolution
Section 32: Voluntary Undertaking
Section 32 is the settlement-with-teeth route: at any stage of a Board inquiry you can offer a binding commitment to fix, stop or publicise something, and if the Board accepts it, that closes the matter on those points, unless you break it.
- Chapter
- Chapter VII · Appeal and ADR
- Status
- Enacted · phased commencement
- Full compliance
- 13 May 2027
- Applies to
- Any person in a s.28 inquiry
- Official citation
- DPDP Act, 2023, s.32
- Reading time
- 7 min
- Updated
- August 2026
At a glance
Section 32 lets the Data Protection Board accept a voluntary undertaking from any person at any stage of a Section 28 proceeding, in respect of observance of the Act [32(1)]. The undertaking can commit the person to take or refrain from specified action within a Board-set time, and to publicise it [32(2)]; the Board can vary its terms only with the giver's consent [32(3)]. Acceptance bars further proceedings under the Act as regards the undertaking's contents, except on breach [32(4)]. If the person fails to adhere to any term, that failure is deemed a breach of the Act, and the Board may, after a hearing, proceed to a Section 33 penalty [32(5)]. The Schedule ties the penalty for that breach to the maximum applicable to the underlying breach that started the Section 28 proceeding, not a fixed figure. Section 32 takes effect on 13 May 2027.
Key takeaways
- Section 32 lets the Board accept a voluntary undertaking from any person at any stage of a Section 28 inquiry [32(1)].
- The undertaking can commit you to take or stop specified action within a Board-set time, and to publicise it [32(2)]; terms can be varied only with your consent [32(3)].
- Its power is the express bar: once accepted, the Act bars further proceedings on the undertaking's contents [32(4)], the certainty that Section 31 mediation does not give.
- That bar is limited to the contents: it is not a blanket immunity for other issues, data, systems or future processing.
- Breach re-opens everything: failing any term is deemed a breach of the Act, and the Board may move to a Section 33 penalty after a hearing [32(5)].
- The penalty for that breach tracks the underlying breach that started the inquiry (its Schedule maximum), not a fixed amount.
Who should read this
Read this if you are in, or could face, a Board inquiry and want a controlled exit: it explains how a voluntary undertaking closes a matter, what it costs you, and how breaking it can bring the penalty back.
In plain language
Section 32 is the settlement route with real closure. During a Board inquiry, you can offer a binding commitment, to fix something, stop something, or publish the commitment, and if the Board accepts it, the Act bars further proceedings on those points.
That express bar is what makes it stronger than mediation: Section 31 gives no such guarantee, but a Section 32(4) acceptance does, at least for what the undertaking covers. It is not a blanket release for everything else.
The catch is symmetrical. Breaking any term is deemed a breach of the Act, and the Board can then move to a Section 33 penalty. So an undertaking is only worth offering if you are certain you can deliver every commitment in it.
The text of the law
Section 32: Voluntary Undertaking
32(1) The Board may accept a voluntary undertaking, in respect of any matter related to observance of the Act, from any person at any stage of a proceeding under Section 28.
32(2) The undertaking may include a commitment to take specified action within a Board-determined time, to refrain from specified action, and to publicise the undertaking.
32(3) The Board may, with the consent of the person who gave it, vary the terms of an accepted undertaking.
32(4) Acceptance of the undertaking bars proceedings under the Act as regards its contents, except in cases covered by sub-section (5).
32(5) Where a person fails to adhere to any term, the breach is deemed a breach of the Act, and the Board may, after a hearing, proceed under Section 33.
Wording summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.
What this means for you
- Offer an undertaking only when you can deliver every term: because breach is deemed a breach of the Act, an overbroad or technically impossible commitment is worse than none.
- Scope it tightly to the specific issue in the proceeding: the Section 32(4) bar only covers the undertaking's contents, so a precise scope is a feature, not a weakness.
- Make it auditable: named owner, concrete action, Board-set deadline, evidence (config records, test results, processor confirmation, deletion certificates), and a monitoring cadence.
- Do not promise what the law forbids: you cannot undertake to delete records you must retain under tax, legal-hold or sectoral rules, and any variation later needs the Board's process and your consent.
- Weigh the trade-off honestly: certainty and closure now, against a binding, possibly published commitment whose breach revives penalty exposure. Not sure you can stand behind every term? Take the readiness assessment or find a specialist first.
Frequently asked questions
Can we give an undertaking before a Section 28 proceeding starts?
Does offering an undertaking stop the inquiry?
Can the Board change the terms later?
Does an accepted undertaking guarantee no penalty?
What happens if we miss a deadline in it?
Sources
- Digital Personal Data Protection Act, 2023Ministry of Electronics and IT (MeitY)
- DPDP Rules, 2025Notified 13–14 November 2025
This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.