Section 39
Voluntary undertakings
of Personal Data Protection Order, 2025
(1)
Without affecting sections 36, 37(1) and 43(1), where the Authority has reasonable grounds to believe that an organisation has not complied, is not complying or is likely not to comply with any provision of Part 3, 4, 5, 6 or 7, the organisation concerned may give, and the Authority may accept, a written voluntary undertaking.
(2)
Without limiting the matters to which the voluntary undertaking may relate, the voluntary undertaking may include any of the following undertakings by the organisation concerned -
fa} an undertaking to take specified action within a specified time;
(b)
an undertaking to refrain from taking specified action;
{c) an undertaking to publicise the voluntary undertaking.
(3)
Subject to subsection (4), the Authority may, after accepting the voluntary undertaking and with the agreement of the organisation who gave the voluntary undertaking -
(a} vary the terms of any undertaking included m the voluntary undertaking; or
(b)
include, in the voluntary undertaking, any additional undertaking mentioned in subsection (2).
(4)
Where an organisation fails to comply with any undertaking in a voluntary undertaking -
(a} the Authority may give the organisation concerned any direction that the Authority thinks fit in the circumstances to ensure the compliance of the organisation with that undertaking; and
(b)
section 38(1), (3), (4), (5), (6) and (7) applies to the direction given under paragraph (a) as if the direction were given under section 36.
(5)
In addition, where an organisation fails to comply with an undertaking mentioned in subsection (2){c}, the Authority may publicise the voluntary undertaking in accordance with the undertaking, and recover the costs and expenses so incurred from the organisation as a debt due to the Authority.