India DPDPA: Article 32 – Voluntary Undertaking
32. Voluntary Undertaking
(1) The Board may accept a voluntary undertaking in respect of any matter related to observance of the provisions of this Act from any person at any stage of a proceeding under section 28.
(2) The voluntary undertaking referred to in sub-section (1) may include an undertaking to take such action within such time as may be determined by the Board, or refrain from taking such action, and or publicising such undertaking.
(3) The Board may, after accepting the voluntary undertaking and with the consent of the person who gave the voluntary undertaking vary the terms included in the voluntary undertaking.
(4) The acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking, except in cases covered by sub-section (5).
(5) Where a person fails to adhere to any term of the voluntary undertaking accepted by the Board, such breach shall be deemed to be breach of the provisions of this Act and the Board may, after giving such person an opportunity of being heard, proceed in accordance with the provisions of section 33.
What Article 32 Means for Your Business
Article 32 allows a person who is the subject of Board proceedings to offer a voluntary undertaking, a commitment to take specific remedial action, cease a particular practice, or implement compliance measures. Accepted undertakings can lead to the closure or suspension of proceedings.
- A voluntary undertaking is a proactive tool, offering one early in proceedings demonstrates good faith and may result in more favourable treatment than waiting for a penalty to be imposed.
- The Board can accept, modify, or reject a voluntary undertaking, prepare a well-evidenced proposal that demonstrates genuine commitment to remediation.
- If the undertaking is accepted and subsequently breached, the Board may resume proceedings and take the breach into account as an aggravating factor when determining penalties.
- Consider a voluntary undertaking as part of your incident response toolkit, it is not an admission of liability but a pragmatic compliance mechanism.