DPDP reference
Section 32: Voluntary undertaking
Last checked 6 Nov 2026
The Board may accept a voluntary undertaking at any stage of a proceeding under s.28 (s.32(1)). It may include acting within a set time, refraining from an action, or publicising the undertaking (s.32(2)). Acceptance bars proceedings on the contents of the undertaking (s.32(4)). Breaching a term counts as a breach of the Act, and after a hearing the Board may proceed under s.33 (s.32(5)).
- Applies to
- Any person in a proceeding under s.28.
- Starts
- 13 May 2027 (G.S.R. 843(E), item (c)).
- Penalty
- Up to the extent applicable for the breach behind the proceedings (s.33, Schedule item 6).
- Source
- Digital Personal Data Protection Act, 2023 (22 of 2023), section 32; G.S.R. 843(E), commencement
Questions
Does a voluntary undertaking end the case?
Acceptance bars proceedings on what the undertaking covers. Failing to follow a term brings s.33 back into play (s.32(4) and (5)).
Related
- Section 28: Procedure to be followed by Board
- Section 33: Penalties
- Section 31: Alternate dispute resolution
Next
Not legal advice.