Section 37 of the Digital Personal Data Protection Act, 2023 - Power of Central Government to Issue Directions

Updated for the notified implementation framework available as of September 2026.

Commencement status: Section 37 is not yet in force. Under the Central Government's commencement notification, this provision is in the group scheduled to commence eighteen months from publication of the notification. The commonly calculated date is 13 May 2027; because the notification states a period rather than a calendar date, users should verify the Gazette position before relying on that calculated date.
In brief: Section 37 creates a statutory mechanism under which the Central Government, or a specially authorised officer, may direct blocking of public access to specified information connected with a Data Fiduciary. The power is conditional: it begins with a written reference from the Data Protection Board of India, requires the statutory circumstances described below, includes an opportunity of hearing, and requires reasons to be recorded in writing.

What Section 37 provides

Section 37 is part of Chapter IX of the Digital Personal Data Protection Act, 2023. It deals with blocking directions concerning information available through a computer resource where a Data Fiduciary has faced monetary penalties from the Board in two or more instances and the Board advises blocking in the interests of the general public.

Section 37(1) - Conditions for a blocking direction

The Central Government, or an officer specially authorised by it, may act after receiving a written reference from the Board which:

(a) intimates that the Board has imposed a monetary penalty on a Data Fiduciary in two or more instances; and

(b) advises, in the interests of the general public, blocking public access to information generated, transmitted, received, stored or hosted in a computer resource that enables that Data Fiduciary to carry on an activity relating to offering goods or services to Data Principals within India.

Before issuing an order, the Data Fiduciary must be given an opportunity of being heard. The authority must also be satisfied that blocking is necessary or expedient in the interests of the general public and must record reasons in writing. It may then direct a Central Government agency or an intermediary to block, or cause to be blocked, public access to the relevant information.

Section 37(2) - Duty of intermediary

An intermediary receiving a direction issued under sub-section (1) is bound to comply with that direction.

Section 37(3) - Information Technology Act definitions

For Section 37, the expressions "computer resource", "information" and "intermediary" carry the meanings assigned to them in the Information Technology Act, 2000.

Key legal requirements before the power can be exercised

The structure of Section 37 shows that blocking is not triggered merely because a Data Fiduciary has been penalised once. The statutory route requires monetary penalties in two or more instances, a written reference and advice from the Board, an opportunity of hearing for the Data Fiduciary, satisfaction of the Central Government or specially authorised officer on the public-interest necessity or expediency of blocking, and written reasons.

Meaning of important terms

Data Fiduciary: Under the DPDP Act, this is a person who, alone or together with others, determines the purpose and means of processing personal data.

Data Principal: The individual to whom the personal data relates. Where the individual is a child, the expression includes the child's parents or lawful guardian; for a person with disability, it includes the lawful guardian acting on that person's behalf, as provided by the Act.

Board: The Data Protection Board of India established under the DPDP Act. Section 37 specifically requires the blocking process to begin with the Board's written reference.

Computer resource, information and intermediary: Section 37(3) expressly adopts the meanings assigned to these expressions in the Information Technology Act, 2000, linking the blocking mechanism to the established IT-law terminology.

Practical effect of Section 37

Once operational, Section 37 will provide a targeted enforcement consequence beyond monetary penalties. It does not itself authorise an automatic website or service block after repeated penalties. The statutory preconditions, Board reference, hearing, public-interest assessment and written reasons must first be satisfied. An intermediary becomes legally bound to comply only when it receives a direction issued under sub-section (1).

Current implementation position

The Digital Personal Data Protection Act, 2023 has been brought into force in stages. The Central Government's 2025 commencement framework placed Section 37 in the group that comes into force eighteen months from publication of the relevant Gazette notification. Accordingly, as of September 2026, Section 37 should be presented as a provision enacted by Parliament but not yet operational.

The Digital Personal Data Protection Rules, 2025 have also been notified with a phased implementation framework. Readers dealing with compliance should therefore check the commencement status of the particular Act provision and rule relevant to their issue rather than assume that the entire statutory scheme commenced on one date.

Related provisions

Section 36 concerns the Central Government's power to call for information. Section 38 addresses consistency of the DPDP Act with other laws. Section 40 confers rule-making power on the Central Government. These provisions should be read with the definitions and enforcement structure of the Act where relevant.

Note: This page is an explanatory legal reference. For an official or litigation-related purpose, verify the latest Gazette notifications and the text published by the Government of India.