Data privacy (DPDP Act, 2023) · Template

DPDP voluntary undertaking plan template

Section 32 lets the Data Protection Board accept a voluntary undertaking at any stage of proceedings, and acceptance bars further proceedings on that subject matter. It is the provision almost nobody uses, and the one worth understanding before you need it — because a self-reported gap with a credible remediation plan is a different conversation from a gap the Board found.

Generate this document See all 21 templates

When you need this

  • When an internal review finds a compliance gap you cannot immediately close
  • After a breach, where remediation will take longer than the incident response
  • Where a readiness assessment shows a structural rather than a one-off failure
  • At any stage of proceedings before the Board, since s. 32 is not limited to the outset
  • When you would rather define the remediation timetable than have one set for you

What this document must contain

  • An honest statement of the gap — The undertaking is only credible if it describes the actual problem. A minimised account is the fastest way to have it rejected.
  • Scope: data, systems and individuals affected — Bounds what the undertaking covers, which matters because acceptance bars further proceedings in respect of that subject matter.
  • Specific committed actions — Named actions, not intentions. 'Improve security posture' is not an undertaking; 'complete access review across these systems' is.
  • A dated timetable with milestones — Each action with a completion date. The credibility of the whole document rests on whether the dates look achievable.
  • Ownership — A named accountable person per action. Unowned commitments do not get delivered.
  • Verification and reporting — How completion will be evidenced and reported. An undertaking with no verification is difficult to accept.
  • Interim risk mitigation — What protects data principals while remediation is in progress.

The law that governs it

  • DPDP Act, 2023 — s. 32 — The Board may accept a voluntary undertaking in respect of any matter related to observance of the Act, at any stage after proceedings have been initiated. Acceptance constitutes a bar to proceedings in respect of the subject matter of the undertaking.
  • DPDP Act, 2023 — s. 32 (breach of undertaking) — Where a person fails to adhere to an accepted undertaking, the Board may proceed as if the breach were a contravention of the Act. Committing to a timetable you cannot meet is worse than not offering one.
  • DPDP Act, 2023 — the Schedule — The alternative route is assessment of a financial penalty under the Schedule, which is the comparison the undertaking is measured against.

Common mistakes

  • Understating the gap, which undermines the credibility of everything that follows
  • Committing to a timetable the organisation cannot actually meet, where failure is treated as a contravention
  • Vague actions that cannot be verified as complete
  • No named owner, so nothing is anyone's job
  • Saying nothing about interim mitigation while remediation runs

Frequently asked questions

What is a voluntary undertaking under the DPDP Act?

Section 32 of the DPDP Act, 2023 allows the Data Protection Board to accept a voluntary undertaking in respect of any matter related to observance of the Act, at any stage after proceedings have been initiated. Where the Board accepts it, that acceptance constitutes a bar to proceedings in respect of the subject matter of the undertaking.

Does a voluntary undertaking avoid a penalty?

Acceptance bars proceedings in respect of the subject matter of the undertaking, which is the practical benefit. It is not automatic — the Board decides whether to accept, and may accept with modifications agreed by the person giving it.

What happens if I fail to meet the undertaking?

Section 32 provides that where a person fails to adhere to an accepted undertaking, the Board may proceed as if that failure were a contravention of the Act. This is why the timetable must be one the organisation can actually deliver.

Should I self-report a gap I found myself?

It is a judgement call that depends on the severity of the gap and how long remediation will take, and it is worth taking advice on. The structural point is that s. 32 gives a route to define your own remediation timetable, which is generally a better position than having one imposed.

Related documents