The Digital Personal Data Protection (DPDP) Act, 2023, introduces rules to protect digital personal data and hold organisations accountable for how they process it. While businesses often focus on consent, privacy notices, data security, and penalties, another important provision deserves attention: Section 37 of the DPDP Act, 2023.

Section 37 gives the Central Government the power to direct the blocking of public access to certain information that enables a Data Fiduciary to offer goods or services in India. This power is subject to specific statutory conditions, including a reference from the Data Protection Board of India, repeated monetary penalties, and considerations of public interest.

For businesses that depend on websites, mobile applications, online platforms, or digital services, understanding this provision is important for long-term DPDP compliance.

What Is Section 37 of the DPDP Act?

Section 37 deals with the power of the Central Government to issue blocking directions. It allows the Central Government, or an officer specifically authorised by it, to direct an agency of the Central Government or an intermediary to block public access to specified information connected with a Data Fiduciary’s activities in India.

The provision is not an automatic consequence of every data protection violation. It establishes a particular process involving the Data Protection Board of India and the Central Government.

Under Section 37, the Board must provide a written reference that meets the conditions set out in the provision. These include information about monetary penalties imposed on a Data Fiduciary in two or more instances and advice that blocking is warranted in the interests of the general public.

The Central Government must also be satisfied that blocking is necessary or expedient in the public interest, and its reasons must be recorded in writing.

When Can a Blocking Direction Be Issued Under Section 37?

Section 37 sets out specific conditions that must be considered before a blocking direction can be issued.

1. Monetary penalties in two or more instances

The Data Protection Board must make a written reference intimating that monetary penalties have been imposed on the Data Fiduciary in two or more instances.

This is an important distinction. A complaint, an allegation of non-compliance, or a single monetary penalty does not, by itself, satisfy the repeated-penalty condition specified in Section 37.

Businesses should therefore take every enforcement matter seriously and avoid treating an initial penalty as an isolated financial issue.

2. Advice in the interests of the general public

The Board must also advise that blocking public access to relevant information is appropriate in the interests of the general public.

The information covered by this provision may be generated, transmitted, received, stored, or hosted in a computer resource that enables the Data Fiduciary to offer goods or services to Data Principals in India.

The provision therefore concerns access to information associated with the organisation’s digital operations. It does not mean that every instance of non-compliance automatically results in the closure of an entire business or website.

3. Opportunity to be heard

Section 37 incorporates an opportunity for the affected Data Fiduciary to be heard before the blocking process proceeds.

This gives the organisation an opportunity to present relevant facts, explain corrective measures, and address why blocking may not be necessary or appropriate in the circumstances.

Businesses should prepare a clear, evidence-based response rather than relying on general statements about their commitment to privacy.

4. A decision based on public interest

The Central Government or its specifically authorised officer must be satisfied that blocking is necessary or expedient in the interests of the general public.

The reasons for the decision must be recorded in writing. The statutory process therefore involves more than simply counting penalties; it also requires consideration of the public-interest basis for blocking.

Who Has the Authority to Issue a Blocking Direction?

It is important to understand the separate roles of the Data Protection Board and the Central Government.

The Data Protection Board of India makes the written reference, identifies the relevant penalty history, and advises on blocking in the interests of the general public.

The Central Government or its specifically authorised officer may issue the blocking direction after considering the statutory requirements and recording the reasons for the decision.

Intermediaries and government agencies may be directed to implement the blocking measure. Under Section 37(2), every intermediary that receives a direction issued under Section 37(1) is bound to comply with it.

This distinction matters because the Board does not itself exercise the blocking power under Section 37. Its role is part of the process that may lead to a direction from the Central Government.

What Does a Blocking Direction Mean for Businesses?

A blocking direction can create significant operational and commercial challenges for a business that relies on digital channels to reach customers in India.

The actual impact will depend on the information covered by the direction and how the relevant digital services are structured.

Potential consequences may include:

• Reduced access to digital services: Users in India may lose access to information or services affected by the direction.
• Business disruption: Organisations that depend on online platforms, websites, or applications may experience interruptions in their operations.
• Revenue and customer impact: Restricted access may affect customer acquisition, transactions, support, and business relationships.
• Reputational concerns: Regulatory action can raise questions among customers, partners, and other stakeholders about the organisation’s privacy practices.
• Additional compliance costs: Businesses may need to invest in remediation, legal advice, internal reviews, and stronger data governance processes.

These are potential consequences, not guaranteed outcomes. Section 37 does not prescribe the same operational impact for every organisation.

How Can Businesses Prepare for Section 37?

Although Section 37 is a specific enforcement mechanism, preparing for it begins with sound data protection practices. Businesses should establish processes that help prevent repeated violations and support an effective response if the Board raises concerns.

1. Review your DPDP compliance framework

Assess your organisation’s personal data processing activities against the applicable requirements of the DPDP Act.

Review how personal data is collected, the purposes for which it is processed, how notices are provided, how consent is managed where required, and how security safeguards are maintained.

Document identified gaps and assign responsibility for resolving them.

2. Maintain a record of regulatory matters

Keep a central record of complaints, regulatory communications, inquiries, monetary penalties, remediation activities, and internal decisions.

Where a monetary penalty has been imposed, record the findings, the response taken, the corrective actions completed, and the evidence supporting those actions.

This information can help the organisation understand recurring problems and respond more effectively to future regulatory proceedings.

3. Correct the underlying issues promptly

If an inquiry identifies a compliance failure, address the root cause rather than making only a temporary fix.

For example, if an organisation has inadequate consent records, it should review its consent collection process, update relevant systems, establish audit trails, and test whether the revised process works correctly.

Corrective actions should be documented and independently verified where appropriate.

4. Map your digital services and systems

Maintain an updated inventory of websites, mobile applications, digital platforms, hosting environments, and other computer resources that support services offered in India.

Identify the information and systems associated with each service, along with the teams and third parties responsible for them.

This mapping can help the organisation assess operational dependencies and respond more precisely to any future direction.

5. Prepare a regulatory response process

Establish an internal process for handling regulatory communications. Assign responsibility to the privacy or compliance team, legal counsel, information security personnel, and senior management.

The process should explain how evidence will be collected, how submissions will be reviewed, and how corrective actions will be approved and tracked.

If a potential blocking direction arises, obtain qualified legal advice promptly and prepare a response supported by relevant records.

6. Evaluate remediation and public-interest considerations

If the Board considers advising blocking, the organisation should be ready to explain the steps it has taken to correct the identified issues.

Relevant evidence may include completed remediation, independent assessments, improved safeguards, and measures designed to prevent recurrence.

The organisation may also explain the practical effects of blocking on users and the availability of less disruptive ways to address the identified concerns. Such arguments should be supported by facts and do not guarantee that a blocking direction will be avoided.

Common Mistakes Businesses Should Avoid

Businesses should avoid the following assumptions when assessing Section 37:

• Assuming one penalty automatically leads to blocking: The provision specifies monetary penalties in two or more instances, along with additional requirements.
• Treating blocking as the Board’s direct decision: The Board makes the reference and advises; the Central Government or an authorised officer may issue the direction.
• Ignoring the opportunity to be heard: Affected organisations should prepare a timely and evidence-based response.
• Keeping incomplete compliance records: Poor documentation can make it harder to demonstrate remediation and address regulatory concerns.
• Focusing only on financial penalties: Organisations should also assess the potential operational and commercial effects of blocking.
• Delaying corrective action: Repeated compliance failures can create greater regulatory exposure and undermine the organisation’s ability to demonstrate effective governance.

When Will Section 37 Come Into Force?

The commencement notification dated 13 November 2025 provides for Section 37 to come into force 18 months after publication of the notification. This places its scheduled commencement in May 2027.

Accordingly, as of October 2026, Section 37 is not yet in force under that commencement schedule. Businesses should distinguish between preparing for the provision and treating it as an operative enforcement power.

Organisations should monitor official notifications for any subsequent changes to the commencement position and review their compliance plans accordingly.

Conclusion

Section 37 of the DPDP Act, 2023, introduces a potential consequence that extends beyond monetary penalties: blocking public access to information connected with a Data Fiduciary’s ability to offer goods or services in India.

However, blocking is not automatic. The provision sets out conditions involving monetary penalties in two or more instances, a written reference from the Data Protection Board, an opportunity to be heard, and a decision based on the interests of the general public.

For businesses, the most practical approach is to strengthen DPDP compliance, document remediation, maintain accurate records, and establish a clear regulatory response process. These steps can help reduce the risk of repeated violations and improve preparedness for future enforcement.

Preparing early can help organisations protect their digital operations while building stronger data protection practices.

Frequently Asked Questions (FAQs)

1. What is Section 37 of the DPDP Act, 2023?

Section 37 empowers the Central Government or a specifically authorised officer to issue directions to block public access to certain information connected with a Data Fiduciary’s activities in India, subject to the conditions set out in the Act.

2. Can the Data Protection Board directly block a website?

No. Under Section 37, the Board makes a written reference and advises on blocking. The Central Government or its specifically authorised officer may issue the direction in accordance with the statutory requirements.

3. Does one monetary penalty trigger a blocking direction?

No. Section 37(1)(a) refers to monetary penalties imposed on a Data Fiduciary in two or more instances. The other requirements of the provision must also be considered.

4. Can a business present its case before blocking?

Section 37 provides an opportunity for the Data Fiduciary to be heard. The organisation can use this opportunity to present relevant facts, remediation evidence, and its position on the proposed blocking measure.

5. Are intermediaries required to comply with a blocking direction?

Yes. Section 37(2) states that every intermediary receiving a direction issued under Section 37(1) is bound to comply with it.

6. When does Section 37 of the DPDP Act become effective?

Under the commencement notification dated 13 November 2025, Section 37 is scheduled to come into force 18 months after publication, in May 2027. Businesses should check official notifications for any subsequent changes.

Disclaimer: This article is intended for general informational purposes and does not constitute legal advice. Businesses should consult a qualified legal professional for advice specific to their circumstances.