Blocking of Access
The Central Government’s power to direct that access to a Data Fiduciary’s services in India be blocked.
Blocking of access is a last-resort power under Section 37. After repeated penalties, the Central Government can order that Indian users be cut off from a non-compliant organisation's website or app.
Meaning of Blocking of Access
Section 37 allows this where a fiduciary has been penalised in two or more instances and the Board advises blocking in the interest of the general public, after giving the fiduciary an opportunity to be heard.
Section 37 sets out a staged process, and each stage is a safeguard. The Board must first have imposed monetary penalties on the same Data Fiduciary in two or more instances. The Board must then send a written reference to the Central Government (or an officer it specially authorises), advising that blocking public access to a computer resource that enables the fiduciary to offer goods or services to Data Principals in India is in the interests of the general public. The Government must give the fiduciary an opportunity of being heard, be satisfied that blocking is necessary or expedient, and record its reasons in writing before it issues the order.
The order is directed at an agency of the Central Government or at an intermediary, such as an internet service provider, a hosting company, an app store or a domain intermediary. Section 37(2) says every intermediary that receives such a direction is bound to comply. The terms "computer resource", "information" and "intermediary" take their meanings from the Information Technology Act, 2000. In practice, the target is the thing that lets the fiduciary reach Indian users: a website, a mobile application, a platform or a service endpoint.
It helps to separate Section 37 from the blocking powers that already exist under the IT Act, notably Section 69A, which lets the Government direct blocking on grounds such as sovereignty, security and public order. Those grounds are about the content or activity being harmful to the State. Section 37 of the DPDP Act is different: its trigger is a record of data-protection non-compliance, proven through the Board's own penalty orders. It is a consequence for repeat offenders, not a way to take down individual pages.
The threshold of two penalty instances is deliberate. One heavy penalty, even at the ceiling of ₹250 crore, does not by itself open the door. The provision is aimed at the organisation that pays, carries on, and is penalised again, which is why it matters most to foreign and online-only businesses that have no Indian assets against which a penalty could be recovered.
Examples of Blocking of Access
After repeated penalties, the Government can direct internet intermediaries to block access to a non-compliant service.
A data broker with no Indian office is penalised twice for failing to protect Indian users' records, and ignores both orders. The Board refers the matter to the Government, which gives the broker a hearing and then directs intermediaries to block the broker's website in India.
A hosting company receives a Section 37 direction naming a specific platform's domain. Its legal desk verifies the order, blocks only the named domain rather than the whole server, and sends a confirmation to the authority with a time-stamped log.
A start-up app is penalised once after a breach and takes the order seriously. It hires a security lead, completes an external audit, and trains support staff, so that when the Board reviews its position there is a clear record of corrected conduct and no second penalty arises.
Why Blocking of Access matters
For a fiduciary, Section 37 changes the way a first penalty should be read. A single order is no longer just a one-time financial cost; it is the first count on a record that, once a second order follows, can be forwarded to the Government with advice to cut off the service. For businesses that depend on Indian users for revenue, such as apps, marketplaces and SaaS tools, loss of access would affect customers, partners and valuation far more than a fine.
For intermediaries, it adds a compliance duty. Hosting providers, network operators and app distribution platforms need a procedure to authenticate a Section 37 direction, implement it within the stated time and keep records. For Data Principals, it offers reassurance that persistently non-compliant services cannot ignore the law indefinitely, while the multiple checkpoints guard against arbitrary use.
How it works in practice
- 1If you are a Data Fiduciary, treat any penalty order as a trigger for a formal remediation plan. Identify the root cause named in the Board's order, fix it, test the fix, and keep documentary proof that you did so. This matters because the second penalty is what brings Section 37 into play.
- 2Consider whether the Act's other tools are available and appropriate for your situation, such as an appeal to the Appellate Tribunal within 60 days of an order, or a voluntary undertaking offered to the Board. Take legal advice before relying on either, since their effect on a penalty record depends on the specific order.
- 3Appoint a named person to receive official correspondence from the Board and the Government, including notices of hearing. A fiduciary based abroad should keep a reachable India contact so that a hearing notice is not missed.
- 4If a hearing is offered under Section 37(1), prepare a written submission showing what has been corrected, what governance changes have been made, and why a blocking order would be disproportionate. Bring evidence rather than assurances.
- 5If you are an intermediary, set up a legal-order intake process: verify the sender and the order, log the receipt time, identify exactly which resources the order covers, apply the block only to those, and keep evidence of compliance.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing a single penalty can lead to blocking. Section 37 requires two or more penalty instances plus a Board reference, so the first order is the moment to fix the problem, not to relax.
Confusing Section 37 with IT Act Section 69A. They have different triggers and processes. Treat each notice according to the provision it actually cites.
Ignoring hearing notices. The right to be heard exists in Section 37(1), but it is only useful if you attend with evidence. A missed notice can mean an order is made in your absence.
Blocking more than the order says. An intermediary that cuts off an entire hosting range when the order names one resource may face complaints from unrelated customers.
Compliance tips
Track penalty orders in a register with deadlines for appeal and remediation, and report that register to senior management quarterly.
Prepare a one-page "service continuity" brief that explains how a blocking order would affect revenue and customers. It makes the case for compliance investment easier.
Foreign businesses serving Indian users should designate an India-based contact and keep their registered details current.
Intermediaries should write a short standard operating procedure for blocking directions and test it, so staff know who can approve a block and how to confirm it.
Common questions about Blocking of Access
Can the government block my website after one DPDP penalty?
Not under Section 37. It requires the Board to have imposed monetary penalties on the same fiduciary in two or more instances, followed by a written Board reference advising blocking in the general public interest, and the Government's own satisfaction after giving you a hearing.
Who has to carry out a blocking order under the DPDP Act?
Section 37 lets the Government direct an agency of the Central Government or any intermediary to block public access. Section 37(2) says an intermediary that receives the direction is bound to comply. Intermediary has the same meaning as in the IT Act, 2000.
Do I get a chance to respond before access is blocked?
Yes. Section 37(1) requires the Central Government to give the Data Fiduciary an opportunity of being heard before it issues the order, and to record its reasons in writing. Prepare evidence of remediation, because a hearing is only useful with proof.
Is this the same as blocking under Section 69A of the IT Act?
No. Section 69A is about blocking information on grounds such as security and public order. Section 37 of the DPDP Act is tied to a fiduciary's repeated penalties for data-protection violations. They use different procedures and triggers.