Section 37 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 37 is the Act's most severe non-monetary step. If the Board has imposed monetary penalties on a Data Fiduciary in two or more instances, it may send the Central Government a written reference advising, in the interests of the general public, that public access to the information that enables the fiduciary to offer goods or services to Data Principals in India be blocked. The Government may then, after hearing the fiduciary, order blocking. Intermediaries must comply. If your business is under repeated inquiries, read this closely and consult our legal dispute resolution team.
Blocking needs a chain of steps: (1) the Board has imposed monetary penalty on the fiduciary in two or more instances; (2) the Board sends a written reference to the Central Government advising blocking in the interests of the general public; (3) the Government gives the fiduciary an opportunity of being heard; (4) the Government is satisfied it is necessary or expedient in the interests of the general public and records reasons in writing; (5) it orders an agency or intermediary to block. Every intermediary that receives a direction is bound to comply (37(2)).
The steps in section 37(1)
| Step | Who | What the text requires |
|---|---|---|
| 1 | Board | Imposition of monetary penalty on a Data Fiduciary "in two or more instances" |
| 2 | Board | A reference "in writing" that intimates those penalties and advises blocking "in the interests of the general public" |
| 3 | Central Government or an officer specially authorised | Receives the reference |
| 4 | Central Government or authorised officer | Gives the Data Fiduciary "an opportunity of being heard" |
| 5 | Central Government or authorised officer | Is satisfied it is "necessary or expedient so to do, in the interests of the general public", and records reasons in writing |
| 6 | Central Government or authorised officer | By order, directs "any agency of the Central Government or any intermediary" to block, or cause to be blocked, access by the public |
What can be blocked
The target is "any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals within the territory of India". Three features.
- Linked to the fiduciary's activity. The information must be what "enables" it to carry on the activity, such as its website or app listing.
- Goods or services to Data Principals in India. It is tied to the same activity that section 3(b) uses for extraterritorial reach. See section 3.
- "Blocking for access by the public". The text does not delete data or shut the fiduciary's business; it blocks public access. The Act does not say how long blocking lasts or how it is lifted.
"Computer resource", "information" and "intermediary" take their meanings from the Information Technology Act, 2000 (section 37(3)).
The trigger: two or more instances
The Board's reference must intimate "the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances". Observations:
- Penalty, not inquiry. The threshold is penalties imposed, not complaints or inquiries. The Act does not say the two must be for the same type of breach, or within a period.
- Is an appeal pending? The Act does not say whether a penalty under appeal counts. The text says "imposition", so take advice before assuming either way.
- Data Fiduciary only. The section concerns a "Data Fiduciary". A Data Processor or Consent Manager is not mentioned in section 37(1).
Hearing and reasons
Two safeguards: "after giving an opportunity of being heard to that Data Fiduciary" and "for reasons to be recorded in writing". The Board's reference is advice, and the Government must itself be satisfied that blocking is "necessary or expedient". The Act does not say what form the hearing takes or how long the fiduciary has. The threshold, "in the interests of the general public", appears twice: in the Board's advice and in the Government's satisfaction.
Who must comply: intermediaries
Section 37(2): "Every intermediary who receives a direction issued under sub-section (1) shall be bound to comply with the same." Enforcement sits in section 27(1)(e): on a reference by the Central Government about an intermediary's breach of section 37(2), the Board inquires and imposes penalty. There is no specific Schedule item for section 37(2). Item 7 (other provisions, up to fifty crore rupees) is the nearest head, and the Board decides after an inquiry that finds the breach significant.
Appeal and review
An order under section 37(1) is made by the Central Government, not the Board. Section 29(1) gives an appeal against "an order or direction made by the Board". The Act does not provide an appeal against the Government's blocking order. Section 39 bars civil courts from entertaining suits on matters within the Board's power, which is different from a Government order, and the Act is silent on the remedy. Whether other remedies under general law remain is not answered by the Act; take advice if you are served with such a direction.
How a fiduciary avoids reaching section 37
- Treat each penalty as a warning. The second one starts the clock for the reference.
- Fix root causes after the first penalty: security safeguards, breach response, consent records.
- Use the tools available in an inquiry: mitigation (section 33(2)(e)), a voluntary undertaking (section 32), and appeal (section 29).
- Keep a chronology of penalties, appeals and remediation in case the Board refers the matter.
- Prepare a hearing pack in advance: public interest arguments, proportionality and steps taken.
Example
A consumer app is penalised twice by the Board. The Board sends a written reference to the Central Government advising blocking. The Government gives the company a hearing, records reasons and orders blocking. The app's hosting provider and internet intermediaries must comply, and the app stops being publicly accessible.
What section 37 does not say
- No period for which blocking lasts, and no procedure for lifting.
- No definition of "general public interest".
- No statement whether appeal or review of the Government's order exists.
- No link between the nature of the two penalties.
- No penalty item in the Schedule for an intermediary's non-compliance.
Need help facing repeated Board proceedings?
If a penalty has been imposed, the next one changes your risk profile. Our legal dispute resolution team can help you plan the remediation, the appeal and the record that matters if a reference is made.
Key takeaways
- Blocking requires two or more penalties, a written Board reference, a hearing and reasons.
- It blocks public access to information that enables the fiduciary to offer goods or services to Data Principals in India.
- Intermediaries are bound to comply; non-compliance is inquired into by the Board.
- The Act does not provide a duration or an appeal against the Government's order.
- Remedy early: one penalty is enough to change your strategy.
Read next
- Section 27 of the DPDP Act, 2023: powers and functions of the Board
- Section 33 of the DPDP Act, 2023: monetary penalty and factors
- Section 32 of the DPDP Act, 2023: voluntary undertaking
- Penalties under the DPDP Act
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.