Section 32 of Digital Personal Data Protection Act, 2023 - Voluntary Undertaking

Updated: 24 September 2026

Commencement status: Section 32 is part of sections 28 to 34 that the Central Government has notified to come into force eighteen months from the publication of G.S.R. 843(E), dated 13 November 2025. Accordingly, Section 32 is not yet operative as on 24 September 2026. The statutory text below remains part of the enacted Digital Personal Data Protection Act, 2023.

Section 32 of the Digital Personal Data Protection Act, 2023 (Act 22 of 2023) creates a mechanism for a person involved in a proceeding before the Data Protection Board of India to offer a voluntary undertaking. In practical terms, an accepted undertaking can record corrective action, restraint from specified action, or publication of the undertaking. Once accepted, it can bar further proceedings concerning its contents, subject to compliance with its terms.

The provision should be read with Section 28, procedure to be followed by the Board, because an undertaking may be accepted at any stage of a proceeding under that section, and with Section 33, penalties, because breach of an accepted undertaking can lead the Board to proceed under Section 33 after giving an opportunity of being heard.

Meaning and purpose of a voluntary undertaking under Section 32

A voluntary undertaking is a commitment offered to the Board concerning observance of the DPDP Act. The provision gives the Board flexibility to accept commitments intended to secure compliance without continuing proceedings over matters covered by an accepted undertaking. The undertaking may require positive action within a specified period, restraint from specified conduct, or publication of the undertaking.

Section 32 - Bare Act text

32. Voluntary undertaking.

(1) The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28.

(2) The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking.

(3) The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking.

(4) The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5).

(5) Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33.

Key legal effects of Section 32

Who may give an undertaking: The provision uses the expression "any person" in connection with a proceeding under Section 28.
When it may be accepted: The Board may accept it at any stage of a proceeding under Section 28.
Possible terms: The undertaking may require an action within a time fixed by the Board, require a person to refrain from an action, or involve publication of the undertaking.
Variation: After acceptance, the Board may vary the terms only with the consent of the person who gave the undertaking.
Effect of acceptance: Acceptance bars proceedings under the Act regarding the contents of the undertaking, subject to sub-section (5).
Breach: Failure to comply with an accepted term is deemed a breach of the Act. The Board must give the person an opportunity of being heard before proceeding under Section 33.

Section 32 and the Data Protection Board of India

The "Board" referred to in Section 32 means the Data Protection Board of India established under Section 18. The Central Government established the Board by G.S.R. 844(E), dated 13 November 2025. However, the commencement notification places Sections 28 to 34, including Section 32, in the later eighteen-month phase.

Digital Personal Data Protection Rules, 2025

The Central Government notified the Digital Personal Data Protection Rules, 2025 through G.S.R. 846(E), dated 13 November 2025. The Rules also have phased commencement. Readers should therefore check the commencement status of the relevant Act provision and rule before relying on them for a current compliance step.

Official sources

For authoritative and updated material, see the India Code portal, the Ministry of Electronics and Information Technology page for the Digital Personal Data Protection Rules, 2025, and the official Gazette commencement notification G.S.R. 843(E).

Note: This page is a general legal information resource. For a specific proceeding or compliance decision, consult the current statutory text, applicable notifications and professional advice.