/The Act · Chapter IX · Miscellaneous
Section 37: Power of Central Government to issue directions
DPDP Act, 2023 (No. 22 of 2023). Comes into force on 13 May 2027.
- Provision
- Section 37 of The Digital Personal Data Protection Act, 2023
- Status
- Comes into force on 13 May 2027 (phase 3) G.S.R. 843(E)
- Rules made under it
- None identified
- Source
- Ministry of Law and Justice (Legislative Department) · 11 August 2023 · Official PDF
The Central Government or any of its officers specially authorised by it in this behalf may, upon receipt of a reference in writing from the Board that—
intimates the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances; and
advises, in the interests of the general public, the blocking for access by the public to any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals within the territory of India,
after giving an opportunity of being heard to that Data Fiduciary, on being satisfied that it is necessary or expedient so to do, in the interests of the general public, for reasons to be recorded in writing, by order, direct any agency of the Central Government or any intermediary to block for access by the public or cause to be blocked for access by the public any such information.
Every intermediary who receives a direction issued under sub-section (1) shall be bound to comply with the same.
For the purposes of this section, the expressions “computer resource”, “information” and “intermediary” shall have the meanings respectively assigned to them in the Information Technology Act, 2000.
Section 37 gives the Central Government the power to block the public from accessing a Data Fiduciary's information or platforms. This process starts if the Board sends a written notice to the government. The Board can only send this notice if it has already penalized the Data Fiduciary (the entity determining the purpose and means of processing personal data) with monetary fines on two or more separate occasions.
In its notice, the Board must advise that blocking the Data Fiduciary's information is in the interest of the general public. This applies to information on any computer resource that allows the Data Fiduciary to offer goods or services to Data Principals (the individuals to whom the personal data relates) within India.
Before issuing a blocking order, the Central Government must give the Data Fiduciary a chance to be heard. If the government decides that blocking is necessary for the public interest, it must record its reasons in writing. It can then direct any government agency or intermediary to block public access to the information. Any intermediary that receives this order is legally required to follow it.
Key points
- The Central Government can order the blocking of a Data Fiduciary's information if the Board sends a written reference advising it. [(1)]
- The Board can only advise blocking if it has already imposed monetary penalties on the Data Fiduciary in two or more instances. [(1)(a)]
- The Central Government must give the Data Fiduciary an opportunity to be heard before issuing a blocking order. [(1)]
- The government must record its reasons in writing and be satisfied that the block is in the interest of the general public. [(1)]
- Any intermediary that receives a blocking direction from the government is bound to comply with it. [(2)]
Common misreadings
- The Central Government cannot initiate a blocking order on its own; it must first receive a written reference from the Board.
- A single penalty is not enough to trigger a blocking order; the Board must have imposed monetary penalties on the Data Fiduciary in two or more instances.
Interpretation prepared from the official text only, 9 September 2026. The official text above prevails.
/MYND · DPDP practice
Putting this into practice?
MYND runs DPDP compliance programmes for the data that flows through HR, payroll, finance and vendor operations: readiness assessments, consent and notice design, processor contracts and breach playbooks. Tell us what you are working on and a compliance lead will reply within one working day.