Section 37: Power of Central Government to Issue Directions
Section 37 is the Act's most consequential public-interest power: after a Board reference showing repeated penalties against a Data Fiduciary, the Central Government can, after hearing that Fiduciary, order any intermediary to block public access to the information tied to its goods or services.
Quick summary
What Section 37 says
- Sub-section (1) — the Central Government, or any officer specially authorised by it, may, on receiving a written reference from the Board that (a) intimates the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances, and (b) advises, in the interests of the general public, the blocking of public access to any computer resource that enables the Data Fiduciary to carry on any activity relating to offering goods or services to Data Principals within India, after giving that Data Fiduciary an opportunity of being heard, and if satisfied it is necessary or expedient to do so in the interests of the general public, by order, direct any agency of the Central Government or any intermediary to block, or cause to be blocked, public access to that information, for reasons to be recorded in writing.
- Sub-section (2) — every intermediary receiving a direction issued under sub-section (1) shall be bound to comply with it.
- Sub-section (3) — for this section, “computer resource,” “information” and “intermediary” have the meanings respectively assigned to them in the Information Technology Act, 2000.
Breaking it down
This is a serious, multi-step escalation, not a routine enforcement tool. Getting to this point requires: the Board penalising a Data Fiduciary in two or more separate instances; the Board itself making a written reference specifically advising that blocking is in the public interest; and then the Central Government independently being satisfied it's necessary or expedient, after giving the Data Fiduciary its own hearing. Each stage is a checkpoint, not a formality.
The “two or more instances” threshold is a repeat-offender trigger. A single penalty, however severe, doesn't on its own meet the threshold for this power — it specifically requires a track record of at least two separate penalty instances against the same Data Fiduciary.
The blocking targets the mechanism enabling the business activity, not just an abstract entity. Sub-section (1) is framed around blocking access to a “computer resource that enables” the Fiduciary's goods-or-services activity toward Indian Data Principals — in practice, this could mean blocking access to a website, app, or platform, effectively cutting off the Fiduciary's ability to reach Indian users through that resource.
The Data Fiduciary gets a hearing before any blocking order, not after. The requirement to give the Fiduciary an opportunity of being heard sits within sub-section (1) itself, before the Central Government's order, alongside the requirement for the Central Government to record its own reasons in writing separately from the Board's reference.
Compliance by intermediaries is mandatory, not discretionary. Sub-section (2) leaves no room for an intermediary to decline a properly issued direction — once issued, compliance is compulsory.
Why this section matters
Section 37 is the Act's ultimate escalation point for a Data Fiduciary that repeatedly fails to comply despite being penalised — a mechanism to cut off its ability to keep operating toward Indian users at all, where the public interest genuinely warrants it. It's a significant power precisely because it can affect public access to a service, which is exactly why the Act builds in multiple layers of process (Board reference, Central Government's own satisfaction, a hearing for the Fiduciary, and written reasons) before it can be exercised.
Real-world example
A hypothetical escalation to Section 37
Consider a foreign-based data broker repeatedly penalised for serious, uncorrected breaches affecting Indian users.
- First penalty — the Board penalises the company for a significant breach under Section 33. This alone doesn't trigger Section 37.
- Second penalty, for a similar or unrelated significant breach — now the “two or more instances” threshold in sub-section (1)(a) is met.
- The Board's reference — given the pattern, the Board makes a written reference to the Central Government, specifically advising that blocking public access to the company's platform is in the public interest.
- The Central Government's process — before acting, it gives the company an opportunity to be heard, and if still satisfied blocking is necessary or expedient in the public interest, issues a written, reasoned order directing intermediaries to block public access to the platform.
Who needs to care about this section
- Data Fiduciaries with a pattern of repeated penalties — this section is the escalation point that follows a poor compliance track record, not a first-offense risk.
- Intermediaries (as defined under the IT Act, 2000) — bound to comply with any direction issued under this section.
- Legal and policy teams tracking public-interest enforcement powers — this is one of the Act's most consequential tools, worth understanding even though it's reserved for repeat, serious non-compliance.
Common questions
Can the government block a company's platform after just one penalty from the Board?
Does the affected Data Fiduciary get a chance to respond before a blocking order is made?
What does “intermediary” mean in this context?
Related sections
Section 38 — Consistency with Other Laws
Continue to the next section in sequence.
Read Section 38Section 36 — Power to Call for Information
Go back to the previous section.
Read Section 36Chapter IX — Miscellaneous
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sections