Compliance
Accepting a voluntary undertaking from the Data Protection Board bars any further action under the Act for the covered matter, saving the business the full cost of a penalty or protracted litigation as long as the terms are honoured
Check your DPDP readiness — free More on the blogSection 32 of the Digital Personal Data Protection Act lets the Data Protection Board accept a voluntary undertaking from any person at any stage of a proceeding. The undertaking can promise to do something, to refrain from something, or to make the commitment public. Once the Board accepts it, the matter is taken off the board's docket, meaning no further enforcement action can be taken on that specific issue while the terms are met.
The core effect of an accepted undertaking is a legal bar on any further proceedings under the Act concerning the same issue. This bar is the primary value of the mechanism because it prevents the board from issuing notices, fines or orders related to that matter. The protection lasts exactly as long as the undertaking’s conditions are fulfilled, making compliance with the terms essential for the business to retain the benefit.
If the business fails to meet any of the conditions, the board can reopen the matter. After giving an opportunity to be heard, the board treats the breach as a violation of the Act itself and may impose the same penalties that would have applied without the undertaking. In effect, the bar is lost and the business faces the full cost of a penalty, plus any additional costs of defending the breach.
Many firms treat an undertaking as an admission that ends all exposure, but the bar only lasts while the terms are kept. Offering an undertaking without costing the required actions can lead to missed deadlines and penalties. Assuming the undertaking remains private is also wrong; the board may require it to be publicised, which can affect reputation. Finally, waiting for a final order before seeking an undertaking wastes the chance to stop proceedings early. The board can vary the terms of an accepted undertaking if the business applies. This flexibility can be useful if circumstances change, but any variation must be formally approved. Until the board signs off on the new terms, the original conditions remain in force, and non‑compliance with them still triggers the breach penalty.
The immediate cost of an accepted undertaking is the avoidance of any penalty or enforcement action for the covered issue. That saving can be substantial, especially where fines under the Act run into millions of rupees. However, the business must invest resources to meet the stipulated actions, whether that means technical changes, staff training, or public communication. Those implementation costs are the only outlay required to retain the bar. Because the bar lasts only while the terms are observed, ongoing monitoring is essential. Failure to track compliance dates or to verify that the promised action has been completed can inadvertently reopen the matter, leading to unexpected penalty exposure. Simple check‑lists and calendar reminders can mitigate this risk at low cost. In practice, an undertaking is most valuable when the potential penalty exceeds the cost of compliance. Small businesses should therefore calculate the effort needed to fulfil the terms and compare it with the likely fine. If the compliance cost is modest, the undertaking offers a cost‑effective shield against a much larger financial hit.
A voluntary undertaking is a promise accepted by the Data Protection Board to take a specific action, refrain from an action, or publicise the commitment. Once accepted, it stops any further proceedings on that issue under the Act.
Yes, the board may accept a voluntary undertaking at any stage of a proceeding, even before formal notices or penalties are issued, providing an early way to halt enforcement.
If the terms are not met, the board can reopen the matter, give the business a chance to be heard, and then treat the breach as a violation of the Act, imposing the usual penalties.
The board can vary the terms of an accepted undertaking on application. Until the variation is approved, the original terms remain binding, and non‑compliance with them still triggers penalties.
Published 3 October 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.