Section 32 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 32 gives a person under inquiry a way to settle with the Board. At any stage of a section 28 proceeding, the Board may accept a voluntary undertaking about observing the Act. Once accepted, it bars proceedings on what the undertaking covers. But if the undertaking is broken, the breach is deemed a breach of the Act and the Board can go on to penalty under section 33. Our legal dispute resolution team can help you weigh this option.
The Board may accept a voluntary undertaking from any person, at any stage of a proceeding under section 28, on any matter related to observance of the Act (32(1)). It may include action within a time set by the Board, refraining from action, and publicising the undertaking (32(2)). Terms can be varied with the giver's consent (32(3)). Acceptance bars proceedings on its contents (32(4)). Breach is deemed a breach of the Act and the Board may proceed under section 33 after a hearing (32(5)); the penalty is capped by Schedule item 6.
The sub-sections at a glance
| Sub-section | Subject | Key content |
|---|---|---|
| 32(1) | Power | Board may accept a voluntary undertaking on any matter related to observance of the Act, from any person, at any stage of a section 28 proceeding |
| 32(2) | Content | May include action within a time the Board determines, or refraining from action, and or publicising the undertaking |
| 32(3) | Variation | After acceptance, with the consent of the person who gave it |
| 32(4) | Effect | Bar on proceedings under the Act regarding the contents, except in cases under 32(5) |
| 32(5) | Breach | Deemed breach of the Act; Board may, after a hearing, proceed under section 33 |
32(1): who, when and what
"The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28."
- Who: "any person", not only a Data Fiduciary. A Consent Manager or a Data Processor under inquiry could offer one.
- When: "at any stage of a proceeding under section 28": from receipt of the complaint to before final order. The Act does not say whether an undertaking can be offered after a penalty order or during appeal.
- What: "any matter related to observance of the provisions of this Act". The scope is wide.
- "May accept". The Board has a discretion. The Act sets no criteria and gives no right to have an undertaking accepted.
32(2): what an undertaking can contain
It "may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking."
Three kinds of term:
- Positive action within a time set by the Board, such as fixing a process, erasing data, improving safeguards or communicating with affected people.
- Refraining from an action.
- Publicising the undertaking itself. This has a reputational cost; weigh it.
The phrase "and or" shows the terms can be combined. The Act does not list permissible terms or exclude any, and does not say whether the giver can offer monetary terms.
32(3): changes
"The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking." Variation needs both the Board's decision and the giver's consent. It is the route for a term that turns out to be impractical. The Act does not say how to ask or whether a variation needs a hearing.
32(4): the bar on proceedings
"The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5)."
What is barred is proceedings on the "contents" of the undertaking. If the undertaking covers one part of a complaint, other parts remain. A careful draft states exactly which alleged breaches it covers. The bar is on proceedings "under the provisions of this Act", so it does not by itself stop other laws from applying.
32(5): breach of the undertaking
"Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33."
Consequences:
- The failure is treated as a breach of the Act itself, not only a failure of a private promise.
- The Board must give an opportunity of being heard.
- It proceeds under section 33, which requires a finding that the breach is significant and weighs the section 33(2) factors. See section 33.
- The Schedule, item 6: "Breach of any term of voluntary undertaking accepted by the Board under section 32" attracts "up to the extent applicable for the breach in respect of which the proceedings under section 28 were instituted". So the ceiling is that of the original alleged breach. If the original complaint concerned a safeguards failure, the exposure can go up to the amount for that breach (item 1, two hundred and fifty crore rupees at most); if it concerned a breach falling under item 7, up to fifty crore rupees. See the Schedule.
The effect: an undertaking can close an inquiry, but it puts your exposure back on the table if you fail to perform.
Undertaking or contest: a decision guide
| Factor | Undertaking | Contest to penalty |
|---|---|---|
| Certainty | Ends proceedings on the covered contents | Outcome uncertain |
| Cost of performance | You commit to actions and time | No commitment until decision |
| Publicity | May be publicised as a term | Order may be known through other channels |
| Risk | Breach restores the original ceiling | Penalty on findings, with appeal |
| Timing | Any stage of the inquiry | Through to conclusion |
The table is a thinking aid, not advice on a particular case.
Practical steps
- Fix first, then offer. Undertake what you can actually perform and have already started.
- Draft precisely. Identify the alleged breaches covered, the actions, dates and evidence.
- Set internal owners and milestones for each term. A missed date is a breach.
- Decide on publicity with communications advice before you offer it.
- Think about affected people. An undertaking does not stop a Data Principal's rights against you under the Act except as to the barred proceedings.
- Keep proof of performance ready for the Board.
Example
During an inquiry into a retail company's handling of erasure requests, the company offers an undertaking: within a set period it will process all pending requests and put a documented erasure process in place, and it will publicise the undertaking. The Board accepts. Proceedings on those contents are barred. Six months later, the company misses a term. The Board can, after hearing it, proceed under section 33 with the ceiling of item 6.
What section 32 does not say
- No list of matters for which an undertaking is unsuitable.
- No right of a complainant to be heard on acceptance.
- No appeal provision specific to acceptance or refusal of an undertaking; section 29(1) speaks of "an order or direction".
- No figure for penalty beyond the Schedule.
Need help deciding on an undertaking?
Offering an undertaking trades certainty for commitments you must then keep. Our legal dispute resolution team can help you evaluate the option, draft precise terms and plan performance.
Key takeaways
- The Board may accept an undertaking from any person at any stage of a section 28 proceeding.
- Terms can include action by a date, refraining and publicising.
- Variation needs the giver's consent.
- Acceptance bars proceedings on its contents.
- Breach is deemed breach of the Act; the penalty ceiling follows the original alleged breach (Schedule item 6).
Read next
- Sections 30 and 31: execution of orders and mediation
- Section 33 of the DPDP Act, 2023: monetary penalty and factors
- Schedule to the DPDP Act, 2023: penalties
- Section 28 (1)-(6): inquiry procedure of the Board
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.