Compliance
A voluntary undertaking stops a DPDP Board proceeding while it lasts, but only if the business follows the agreed steps, documents everything and can produce proof if the Board asks for it later.
Check your DPDP readiness — free More on the blogThe first task is to pinpoint the exact data‑protection breach or compliance gap that could trigger a Board proceeding. The compliance officer or legal counsel reviews the incident, maps it to the specific requirement of the DPDP Act, and prepares a brief note that records the facts, the date of discovery and the potential penalty exposure. This note becomes the factual basis for any undertaking proposal.
A concise written proposal is prepared, usually by the legal team, outlining the action the business will take, the deadline for completion and whether the undertaking will be publicised. The document must state the exact steps – for example, deleting unauthorised personal data within 30 days – and assign responsibility to a senior manager. The draft is reviewed internally, signed by the authorised signatory and kept in the compliance register.
The compliance officer files the signed proposal with the Data Protection Board, either electronically or by post, attaching the factual note from Step 1. The submission includes a cover letter that requests acceptance of the undertaking and confirms that the business is ready to comply with any conditions the Board may impose. A copy is filed with the board’s acknowledgement receipt for future reference.
Once the Board accepts the undertaking, it issues a formal acceptance letter. This letter is the key evidence that all proceedings under the Act are barred for the matters covered. The compliance team logs the acceptance, updates the risk register to show the bar, and circulates the letter to senior management. The bar remains in force for as long as the business complies with the terms.
The manager named in the undertaking coordinates the required actions – for example, updating privacy policies, training staff or deleting data. Progress is tracked in a project plan that records milestones, responsible persons and completion dates. The compliance officer monitors the plan, ensuring each step is finished before the deadline set in the undertaking.
At each milestone the responsible team creates evidence – screenshots, audit logs, training attendance sheets or signed certificates – and stores them in a secure folder. A compliance summary report is compiled at the end of the period, listing every action taken, the date of completion and the supporting documents. This report is the primary material the Board may request if it suspects a breach of the undertaking.
If the Board raises a concern that the undertaking has not been met, the compliance officer prepares a response within the statutory time‑frame. The response includes the compliance summary, copies of all supporting evidence and, if necessary, an explanation for any delay. The Board then gives an opportunity of being heard before deciding on a penalty.
Should circumstances change – for example, a delay in technology rollout – the business may apply to vary the terms. The application is drafted by legal, signed by the authorised signatory and submitted with a justification and a revised timeline. The Board’s approval of the variation is recorded and the compliance plan updated accordingly.
The bar remains in effect for the entire period that the business complies with the terms of the undertaking. As soon as any condition is breached, the Board can lift the bar and impose a penalty.
The signatory must be an authorised person under the DPDP Act, typically the chief executive officer, managing director or a senior officer expressly empowered by the board to bind the company.
The Board looks for a compliance summary report and the underlying evidence – audit logs, deletion certificates, training records or any document that shows each promised action was completed by the agreed deadline.
Yes, the undertaking may include a clause to publicise it. If that clause is accepted, the business must publish the agreed wording, usually on its website or in a press release, and keep a copy of the publication as part of its compliance records.
Published 19 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.