Voluntary Undertaking

A voluntary undertaking is a legally binding agreement in which an organization promises to take specific actions to rectify non-compliance with data protection laws. It is typically submitted to the supervisory authority and may include commitments to stop certain practices, implement new safeguards, strengthen governance, or remediate specific control gaps as part of a regulatory resolution. In practice, organizations often treat the undertaking as a time-bound corrective action plan with assigned owners, milestones, and evidence; WatchDog Security GRC Wiki’s Compliance Center can help track these remediation tasks and map supporting evidence into an exportable package to demonstrate completion.

An organization can typically offer a voluntary undertaking at any stage of a regulatory proceeding, from the initial inquiry to before a final order is passed. It is most effective when offered early, such as when self-reporting a breach or immediately after receiving a notice of inquiry, to demonstrate accountability and a willingness to cooperate.

The primary benefit is the potential mitigation of penalty, as regulators often view the undertaking as a mitigating factor that reduces the need for harsh fines. It also helps in avoiding litigation costs, shortening the duration of investigations, and preserving the organization's reputation by framing the resolution as a proactive compliance commitment rather than a punitive defeat.

While the specific legal terminology varies by jurisdiction, offering a voluntary undertaking generally implies an admission of the factual basis of the non-compliance. The organization usually must acknowledge that a violation or gap occurred to propose a valid corrective action plan, which functions effectively as an admission for the purpose of the settlement.

Yes, the supervisory authority has the discretion to reject a voluntary undertaking if they believe the terms are insufficient to address the harm caused, if the violation is too severe to be settled, or if the organization has a history of repeat offenses. In such cases, the regulator will proceed with standard enforcement action and adjudication.

If an organization fails to adhere to the terms of the voluntary undertaking, it is treated as a separate and often more serious violation. The supervisory authority typically revokes the settlement, reinstates the original proceedings, and may impose significantly higher penalties for the breach of the undertaking itself, viewing it as a failure of good faith.

A successful voluntary undertaking often leads to a reduction or suspension of monetary penalties. By committing to specific remedial measures and bearing the cost of compliance improvements, the organization provides an alternative form of accountability that the regulator may accept in lieu of, or as a reduction to, a direct financial fine.

In many jurisdictions, voluntary undertakings are made public to ensure transparency and deter other entities from similar non-compliance. The supervisory authority may publish the terms of the agreement on their website, detailing the nature of the breach and the steps the organization has committed to taking to fix it.