top of page
Search

How to Offer a Voluntary Undertaking to the Data Protection Board Under Section 32

Writer: Kaustav Chowdhury
Kaustav Chowdhury
7 days ago
5 min read

A voluntary undertaking is the only route in the Digital Personal Data Protection Act, 2023 by which a person under inquiry can close the matter on terms it has helped write. Section 32 lets the Data Protection Board accept one at any stage of a proceeding, and acceptance bars further proceedings on what the undertaking covers. Section 31 offers a different off ramp, mediation, which is the Board's to direct rather than the party's to elect.

Step 1: Fix the Commencement Position

Sections 28 to 34 come into force eighteen months after publication of the commencement notification G.S.R. 843(E) dated November 13, 2025, which falls in May 2027. So neither the undertaking under section 32 nor the mediation direction under section 31 is available yet, and an advice that treats either as a present remedy is wrong on status.

The planning value is real even so. An undertaking is only as good as the remediation a client can actually promise, and the work of knowing what can be delivered, and in what time, is the work that has to be done before an inquiry starts.

Step 2: Know When an Undertaking Can Be Offered

Section 32(1) provides that the Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of the Act, from any person, at any stage of a proceeding under section 28. Three features of that wording matter.

The subject matter is wide, being any matter related to observance of the Act rather than a listed class of breach. The offeror is any person, not only a data fiduciary. And the timing is any stage, so an undertaking is not shut out because an inquiry has already been ordered or has run for months.

Step 3: Draft the Undertaking to the Statutory Shape

Section 32(2) provides that the undertaking may include an undertaking to take such action within such time as may be determined by the Board, or to refrain from taking such action, and or to publicise the undertaking. Each of those three limbs is a drafting decision rather than a form to be filled in.

Note where the time comes from. The period is determined by the Board, not proposed and accepted as a matter of course, so an offer should carry its own timetable with reasons, and should not promise a date the client cannot hold. The publicity limb is the one clients underestimate: an undertaking that is published is a document a regulator, a counterparty and a journalist can all read.

Step 4: Understand Exactly What the Bar Covers

Section 32(4) provides that acceptance of the undertaking by the Board constitutes a bar on proceedings under the Act as regards the contents of the undertaking, except in cases covered by sub-section (5). The bar is therefore defined by the contents, not by the episode.

That makes scope the central negotiation. An undertaking drawn narrowly leaves the surrounding conduct open to inquiry, and one drawn widely buys peace on terms that have to be performed. Record what the client understands to be covered, because the breadth of the contents is what it is buying.

Step 5: Price the Downside Before Offering

Section 32(5) provides that where a person fails to adhere to any term of an accepted undertaking, the breach shall be deemed to be a breach of the provisions of the Act, and the Board may, after giving that person an opportunity of being heard, proceed in accordance with section 33.

This is the clause that should govern how ambitious an offer is. A term the client misses converts a disputed allegation into a deemed breach, which removes the argument the client would otherwise have had on the merits. Promise less and perform it.

Step 6: Keep the Variation Route in View

Section 32(3) provides that the Board may, after accepting the undertaking and with the consent of the person who gave it, vary the terms included in it. Variation is therefore consensual on both sides after acceptance, which is a protection rather than a risk.

Use it deliberately. Where a commitment depends on a third party, a vendor migration or a system that is being rebuilt, the sensible course is a term that is achievable now plus a recorded intention to seek variation if circumstances change, rather than a heroic term and a hope.

Step 7: Weigh Mediation Under Section 31 Separately

Section 31 provides that if the Board is of the opinion that any complaint may be resolved by mediation, it may direct the parties concerned to attempt resolution of the dispute through such mediation by such mediator as the parties may mutually agree upon, or as provided for under any law for the time being in force in India.

Two differences from section 32 follow. The trigger is the Board's opinion rather than a party's offer, so mediation is something to invite rather than to claim. And it addresses a complaint between parties, where an undertaking addresses observance of the Act, so the two routes answer different problems and can be in play at once.

Common Pitfalls to Avoid

  • Treating either route as presently available: Sections 31 and 32 commence with the eighteen month tranche.

  • Offering an undertaking late by assumption: Section 32(1) permits acceptance at any stage of a proceeding, so lateness is a tactical question and not a bar.

  • Promising a timetable the client cannot hold: Section 32(5) deems a missed term to be a breach of the Act.

  • Leaving the contents vague: The bar under section 32(4) runs to the contents of the undertaking, so vague drafting buys vague protection.

  • Forgetting the publicity limb: Section 32(2) contemplates publicising the undertaking, which has consequences well beyond the proceeding.

  • Assuming a variation can be imposed: Section 32(3) requires the consent of the person who gave the undertaking.

  • Describing mediation as a right: Section 31 turns on the Board's opinion that the complaint may be resolved by mediation.

Key Statutory Provisions

  • Section 28 of the Digital Personal Data Protection Act, 2023: The proceeding at any stage of which an undertaking may be accepted, being the Board's procedure from the determination of sufficient grounds through the inquiry to its conclusion.

  • Section 31 of the Act: Where the Board is of the opinion that a complaint may be resolved by mediation, it may direct the parties to attempt resolution through a mediator they mutually agree upon or as provided under any law in force in India.

  • Section 32 of the Act: Acceptance of a voluntary undertaking in respect of any matter related to observance of the Act, from any person, at any stage of a proceeding; the contents, which may include action within a time determined by the Board, refraining from action, and publicity; variation after acceptance with the consent of the person who gave it; the bar on proceedings as regards the contents; and the deeming of a failure to adhere as a breach of the Act.

  • Section 33 of the Act: The penalty route the Board may take after a hearing, both on conclusion of an inquiry and where a term of an accepted undertaking is not adhered to.

Sources and References


Disclaimer: This article is for informational purposes only and does not constitute legal advice. Readers should consult a qualified legal professional for advice specific to their circumstances.

Comments

bottom of page