Data privacy (DPDP Act, 2023) · Template
Section 32 lets the Data Protection Board accept a voluntary undertaking at any stage of proceedings, and acceptance bars further proceedings on that subject matter. It is the provision almost nobody uses, and the one worth understanding before you need it — because a self-reported gap with a credible remediation plan is a different conversation from a gap the Board found.
Quick Statutory Answer
What is a voluntary undertaking under the DPDP Act? Section 32 of the DPDP Act, 2023 allows the Data Protection Board to accept a voluntary undertaking in respect of any matter related to observance of the Act, at any stage after proceedings have been initiated. Where the Board accepts it, that acceptance constitutes a bar to proceedings in respect of the subject matter of the undertaking.
The full text of this document as VidhiSar drafts it, with every blank shown in square brackets. Copy it or download it as a Word file and fill it in yourself — or answer a few questions and VidhiSar fills it in and prints a formatted PDF. Clauses that apply only in some cases are left out here; the drafting flow adds them when your answers call for them.
BACKGROUND
Date: [Date of This Undertaking]
Submitted By: [Your Business Name] Incident Reference: [Related Incident Reference]
To, The Data Protection Board of India
Subject: Voluntary Undertaking in Connection with a Data Protection Compliance Matter
Dear Sir/Madam,
[Your Business Name] submits this Voluntary Undertaking in good faith, in connection with the above-referenced matter, in accordance with the spirit of Section 32 of the Digital Personal Data Protection Act, 2023, which recognises voluntary undertakings as a means of demonstrating a good-faith commitment to remediation and future compliance.
UNDERTAKING
1. Acknowledgement. We acknowledge the compliance gap or incident identified and take full responsibility for taking corrective action.
2. Remedial Measures Already Taken. The following remedial measures have already been implemented: [Remedial Steps Already Taken].
3. Remedial Measures Planned. We undertake to complete the following further remedial measures: [Remedial Steps Still Planned], within [Days to Complete All Planned Steps] days from the date of this submission.
4. Self-Reporting. This matter is being self-reported by us as of [Date of Self-Reporting], reflecting our proactive commitment to compliance rather than in response to an external complaint or regulatory action.
5. Request for Consideration. In light of our voluntary and timely self-reporting and the remedial measures outlined above, we respectfully request that the Data Protection Board of India take this undertaking into account in determining any appropriate regulatory response.
6. Point of Contact. All correspondence in connection with this Undertaking may be directed to [Responsible Officer Name] at [Responsible Officer Email].
DECLARATION
We declare that the information provided in this Undertaking is true and accurate to the best of our knowledge, and we remain fully committed to cooperating with the Data Protection Board of India in this matter.
Yours faithfully, For [Your Business Name]
[Responsible Officer Name] Authorised Signatory
What the law behind this document actually requires.
| Essential Clause | Legal Purpose & Protection | Governing Law / Benchmark |
|---|---|---|
| An honest statement of the gap | The undertaking is only credible if it describes the actual problem. A minimised account is the fastest way to have it rejected. | DPDP Act, 2023 — s. 32 |
| Scope: data, systems and individuals affected | Bounds what the undertaking covers, which matters because acceptance bars further proceedings in respect of that subject matter. | DPDP Act, 2023 — s. 32 (breach of undertaking) |
| Specific committed actions | Named actions, not intentions. 'Improve security posture' is not an undertaking; 'complete access review across these systems' is. | DPDP Act, 2023 — the Schedule |
| A dated timetable with milestones | Each action with a completion date. The credibility of the whole document rests on whether the dates look achievable. | DPDP Act, 2023 — s. 32 |
| Ownership | A named accountable person per action. Unowned commitments do not get delivered. | DPDP Act, 2023 — s. 32 (breach of undertaking) |
| Verification and reporting | How completion will be evidenced and reported. An undertaking with no verification is difficult to accept. | DPDP Act, 2023 — the Schedule |
| Interim risk mitigation | What protects data principals while remediation is in progress. | DPDP Act, 2023 — s. 32 |
Section 32 of the DPDP Act, 2023 allows the Data Protection Board to accept a voluntary undertaking in respect of any matter related to observance of the Act, at any stage after proceedings have been initiated. Where the Board accepts it, that acceptance constitutes a bar to proceedings in respect of the subject matter of the undertaking.
Acceptance bars proceedings in respect of the subject matter of the undertaking, which is the practical benefit. It is not automatic — the Board decides whether to accept, and may accept with modifications agreed by the person giving it.
Section 32 provides that where a person fails to adhere to an accepted undertaking, the Board may proceed as if that failure were a contravention of the Act. This is why the timetable must be one the organisation can actually deliver.
It is a judgement call that depends on the severity of the gap and how long remediation will take, and it is worth taking advice on. The structural point is that s. 32 gives a route to define your own remediation timetable, which is generally a better position than having one imposed.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.