Section 32 — Voluntary Undertaking

Section 31 lets the Board route a complaint to mediation between the parties involved. Section 32 is a different kind of off-ramp — one that runs directly between the Board and the person under scrutiny, with no other party in the room at all.

What a voluntary undertaking is, and when it can be offered — 32(1)

At any stage of a proceeding under Section 28, the Board may accept a voluntary undertaking, from any person, on any matter related to observing the Act's provisions. There's no restriction to a particular stage of the inquiry — it can be offered early, before the Board has determined whether there are even sufficient grounds to proceed, or late, after an inquiry is well underway.

What it can include — 32(2)

The undertaking may include a commitment to take specified action within a time the Board determines, a commitment to refrain from taking some action, and — separately — publicising the undertaking itself. That last piece is worth reading carefully: publicising the undertaking is one of the things it "may include," not something the section makes automatic. Nothing in the text requires that an accepted voluntary undertaking becomes public by default.

Varying the terms — 32(3)

Once the Board has accepted an undertaking, it can vary its terms — but only with the consent of the person who gave it. Neither side can unilaterally rewrite the deal after the fact.

What accepting the undertaking buys — 32(4)

Acceptance of a voluntary undertaking bars further proceedings under the Act as regards the contents of that undertaking, except in the cases 32(5) covers. Functionally, this operates like a settlement: the specific matter the undertaking addresses is closed off from further Board action, so long as its terms hold.

What happens on breach — 32(5)

If the person fails to adhere to any term of the accepted undertaking, that failure is itself deemed a breach of the Act, and the Board may — after giving the person an opportunity of being heard — proceed under Section 33's penalty provisions. The published Penalties & Enforcement FAQs note that this penalty is capped, under Schedule item 6, at whatever would have applied to the original breach the undertaking was meant to resolve — so failing to honour the undertaking doesn't expose a person to a larger penalty than the one they were trying to avoid in the first place, only the same one, now imposed anyway.

Why this matters in practice

A voluntary undertaking is, functionally, a private settlement mechanism: the Board can close a matter based on a commitment from the person involved, without the process ever producing a published finding of breach, and without a monetary penalty attaching unless the undertaking is later broken. Because publicising the undertaking is optional rather than required, whether the outside world ever learns a matter was resolved this way depends entirely on what the Board and the person agree to include in the terms — there's no default public record comparable to a Section 33 penalty order or a Section 29 appeal decision. Whether that's the right design is a separate question from what the section actually says; what the text establishes is that a well-resourced party facing scrutiny has a route to resolve the matter that a party without the standing or resources to negotiate an undertaking may not practically have.

Illustration: a Data Fiduciary under a Section 28 inquiry for a data-quality lapse under Section 8(3) offers to fix its verification process within ninety days and to notify affected Data Principals directly, without agreeing to publicise the undertaking. The Board accepts. If the Fiduciary completes the fix as promised, the matter is closed under 32(4) with no penalty and no public order. If it doesn't, the missed deadline is itself treated as a breach of the Act, and the Board can proceed to a penalty under 32(5) and Section 33 for the underlying data-quality failure.

How Section 32 connects to the rest of the Act

A voluntary undertaking can be offered "at any stage of a proceeding under section 28," so it sits inside the same inquiry process Section 28 describes, as an alternative to that process running to a full finding. Section 33 is where the penalty lands if 32(5) is triggered by a broken undertaking. And Section 32 is narrower than Section 31's mediation in one specific way: it only bars proceedings "as regards the contents of the voluntary undertaking" — a targeted release tied to specific terms, not a blanket closure of the underlying matter.