Voluntary Undertaking
A written commitment to the Board, by a fiduciary, to take specified steps, which the Board can accept to end proceedings.
A voluntary undertaking is a written promise, given to the Data Protection Board, to fix a problem or stop a practice. If the Board accepts it, the Board cannot go on with proceedings about that matter.
Meaning of Voluntary Undertaking
The Board can accept an undertaking at any stage. Once accepted, it bars proceedings on the matter in respect of its contents, though breaching the undertaking can lead to penalties. It rewards early, sincere correction of problems.
Section 32 allows the Board to accept a voluntary undertaking in relation to the observance of the Act from any person at any stage of a proceeding under Section 28. The word "any person" matters: it can be a Data Fiduciary, a Data Processor, or a Consent Manager. The undertaking can include a commitment to take specified action within a specified time, a commitment to refrain from specified action, and a commitment to publicise the undertaking itself. It works like a settlement inside the Board's own process.
The Board is not obliged to accept an undertaking, and the person cannot insist on one. If the Board accepts it, the acceptance constitutes a bar on further proceedings under the Act in relation to the contents of the undertaking, so no penalty inquiry continues on that issue. The Board may, with the person's consent, vary the terms of an accepted undertaking. This is a flexible tool for situations where fixing the underlying issue is a better outcome than a penalty.
The protection is conditional. Under Section 32(5), if the person fails to follow the undertaking, that failure is treated as a breach of the Act. The Board can then proceed to a penalty after giving a hearing, and the Schedule sets a ceiling for breach of a voluntary undertaking that relates to the breach the undertaking addressed. A person who offers an undertaking and does not deliver may be worse off than one who defended the case, because the delay itself shows a poor attitude to compliance.
It should be distinguished from nearby ideas. Mediation under Section 31 is a process in which the Board directs parties, usually a Data Principal and a fiduciary, to try to resolve a complaint with a mediator; an undertaking is a commitment made to the Board by the person under inquiry. A direction under Section 27 is imposed by the Board; an undertaking is offered by the person. And a penalty under Section 33 is a sanction, while an undertaking is a remedy that may avoid one.
Examples of Voluntary Undertaking
A company that discovers a consent-handling gap offers an undertaking to fix it by a set date, and the Board accepts it.
An online retailer discovers that its marketing emails went to customers who had withdrawn consent. When the Board begins an inquiry, the retailer offers to fix its suppression list within sixty days and to audit it quarterly, and the Board accepts, ending proceedings on that issue.
A hospital's front desk shared appointment lists with a vendor without a proper contract. It undertakes to sign data processing agreements, restrict the data fields shared and train staff. The undertaking is accepted because the steps are specific and time-bound.
A fintech app offers to rebuild its logging within ninety days but the engineering team knows it needs far longer. The compliance lead insists on a realistic date and a milestone plan, because failing a promise would be treated as a fresh breach under Section 32(5).
Why Voluntary Undertaking matters
For an organisation, an undertaking is often the cheapest route out of a difficult situation. It allows the business to define the fix on its own timeline and in terms it can deliver, instead of waiting for the Board to impose directions and a penalty. It also helps manage reputation: a public statement that the company has committed to remedy a lapse can look better than a penalty order on the Board's record.
The risk is over-promising. An undertaking that commits to a system rebuild in thirty days when the work needs six months sets the company up for a second breach. Management must be able to show how each promise will be met, with owners and dates, before the paper is submitted.
How it works in practice
- 1When a Board notice or inquiry arrives, first work out the exact facts and what went wrong. An undertaking is only credible when the root cause has been found.
- 2Draft the commitments in measurable terms: what will be done, by which date, who is responsible and how completion will be evidenced to the Board.
- 3Have counsel review the draft for the risk that an admission could be used elsewhere, such as in customer claims, and decide whether to publicise the undertaking as Section 32(2) allows.
- 4Submit the undertaking at a time that suits the facts. Because it can be offered at any stage of the proceeding, there is room to complete the investigation first, but earlier action usually looks better.
- 5After acceptance, run the commitments as a project with weekly tracking, keep proof of completion, and report to the Board as the terms require. If a deadline is at risk, seek a variation by consent before it passes.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating an undertaking as an admission-free way out. It is a formal commitment to the Board, and failing to meet it is itself a breach.
Offering vague promises such as "we will improve security". The Board is likelier to accept specific, verifiable steps.
Assuming acceptance is automatic. The Board decides whether to accept and may vary terms only with consent.
Assuming an undertaking covers every issue. The bar applies only to the contents of the undertaking, so unrelated breaches remain open.
Compliance tips
Pre-plan the process: decide in advance who can authorise an undertaking and who drafts it.
Run an internal gap review regularly, so problems can be corrected before they become a Board matter.
Make every commitment testable, with an evidence file that can be shown to the Board.
Keep management updated, as an undertaking binds the whole organisation.
Common questions about Voluntary Undertaking
What is a voluntary undertaking under the DPDP Act?
It is a commitment given to the Data Protection Board under Section 32 to take or avoid specified action. If the Board accepts it, further proceedings on the matters it covers are barred, unless the person later fails to comply with it.
Can I offer an undertaking at any time?
Yes, at any stage of a proceeding under Section 28. There is no fixed window. Offering one early, after finding the root cause, usually presents the organisation as cooperative.
What happens if I break a voluntary undertaking?
Under Section 32(5) the failure is treated as a breach of the Act. The Board can proceed to a penalty after a hearing, subject to the ceiling the Schedule gives for that breach.
Is a voluntary undertaking the same as mediation?
No. Mediation under Section 31 is a process between parties to resolve a complaint. An undertaking is a commitment by the person under inquiry to the Board, which, once accepted, ends proceedings on its contents.