Voluntary undertakings under section 32: the DPDP settlement track

Most enforcement discussions of the DPDP Act stop at the penalty caps. Section 32 is the other half of the picture: a settlement track that can end a proceeding without a penalty, on commitments the Board accepts.

What the Board may accept, and when

"The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28."

Section 32(1) of the DPDP Act 2023.

Three features stand out. The undertaking is available to any person, not only Data Fiduciaries. It can arrive at any stage of a section 28 proceeding, from the first determination of grounds to the end of a full inquiry. And acceptance is the Board's discretion; nothing obliges it to take the deal.

What an undertaking can contain

Section 32(2) lets the undertaking include a commitment to take an action within a time the Board determines, to refrain from an action, or to publicise the undertaking itself. The publicity option matters: the Board can make the commitment part of the public record, which turns a private assurance into a reputational stake. Under section 32(3) the Board may later vary the terms, but only with the consent of the person who gave the undertaking.

The bar on proceedings

Section 32(4) is the incentive. Acceptance of the undertaking constitutes a bar on proceedings under the Act as regards the contents of the undertaking. Matters the undertaking covers are settled; the Board cannot pursue them further while the undertaking holds. The bar has one exception, and it is the one that gives the section its teeth.

Breaking the undertaking

"Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33."

Section 32(5) of the DPDP Act 2023.

The failure itself becomes a deemed breach of the Act. The Schedule then supplies the number: row 6 caps the penalty for breach of an undertaking term at the extent applicable for the breach in respect of which the original section 28 proceedings were instituted. An undertaking given to settle a security safeguards proceeding, where the cap is two hundred and fifty crore rupees, carries that same exposure if its terms are not honoured.

When this operates, and what to prepare

Section 32 sits with the rest of the enforcement provisions, sections 28 to 34, in the group due eighteen months from the notification gazette; the computed date of 13 May 2027 is interpretation until officially confirmed. The practical preparation is not a template but a decision: know in advance who in your organisation could authorise an undertaking, what commitments you could credibly deliver on a Board timeline, and how you would track adherence, because an undertaking you cannot keep converts a settlement into the original penalty exposure. The company action plan tool helps sequence the underlying compliance work so the proceeding never starts.