Data protection · Provision
The Data Protection Board may accept a voluntary undertaking to take remedial action, barring formal penalties as long as terms are fulfilled. (Section 32, Digital Personal Data Protection Act, 2023.)
Quick Statutory Answer
Under Section 32 of the DPDP Act 2023, the Data Protection Board of India has statutory discretion to accept a Voluntary Undertaking from a business at any stage of an inquiry. The undertaking involves committing to specific remedial actions, security upgrades, or user compensations. Acceptance by the Board legally bars formal penal proceedings regarding the breach, providing businesses with a statutory path to resolve non-compliance without facing maximum Section 33 fines.
| Procedure Stage | Governing Clause | Statutory Requirement | Consequence / Outcome |
|---|---|---|---|
| Submission of Undertaking | Section 32(1) | Offered by business during Board inquiry | Board evaluates proposed remedial actions |
| Acceptance by Board | Section 32(2) | Formal Board order approving commitments | Formal penal proceedings legally barred |
| Variation of Terms | Section 32(3) | Application to Board for modification | Board may amend timeline or conditions |
| Breach of Undertaking | Section 32(4) | Failure to execute promised remedies | Treated as breach of Act; Section 33 penalty levied |
Proceedings barred. Acceptance prevents formal penalty orders and regulatory hearings so long as terms are strictly observed.
A voluntary undertaking is a formal legal commitment submitted to the Data Protection Board where a business agrees to take remedial steps to rectify non-compliance. Acceptance by the Board halts regulatory penalty proceedings.
Under Section 32(4), failure to fulfill the terms is treated as a direct breach of the DPDP Act, and the Board can impose monetary penalties under Section 33.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.