Section 37 — Power of Central Government to Issue Directions

Section 37 is the Act's most severe sanction, and it isn't monetary at all. It lets the Central Government — or an officer it specially authorises — direct that public access to a Data Fiduciary's services be blocked, once a specific two-part condition is met, on a written reference from the Board.

The trigger — both parts required

The Board's reference has to satisfy two things at once: first, that the Board has already imposed a monetary penalty on the Data Fiduciary in two or more instances; and second, that the Board advises, in the interests of the general public, blocking access to whatever information is generated, transmitted, received, stored or hosted in the computer resource that lets the Fiduciary offer goods or services to Data Principals in India. This is explicitly a repeat-offender mechanism — a single penalty under Section 33, however large, doesn't on its own get a Fiduciary anywhere near this section.

Procedure the Government still has to follow

Even once that threshold is crossed, the Government can't act unilaterally. It has to give the Data Fiduciary an opportunity of being heard, be satisfied that blocking is necessary or expedient in the interests of the general public, and record its reasons in writing before directing any Central Government agency or intermediary to block public access. Every intermediary that receives such a direction is bound to comply with it under 37(2).

Terms borrowed from the IT Act — scoped to this section

Section 37(3) states that "computer resource," "information" and "intermediary" carry the meanings assigned to them in the Information Technology Act, 2000, but it says so "for the purposes of this section" specifically — this borrowed definition doesn't automatically extend to how the same words are used elsewhere in the Act, such as in Section 36.

Why this matters in practice

This section is why the Schedule's monetary ceilings aren't the whole story of enforcement risk. Two penalties on the same organisation — even two moderate ones, not necessarily two ₹250 crore maximums — can put access blocking on the table, a sanction that affects market access rather than the balance sheet directly. Boards and leadership teams tracking DPDPA exposure should watch penalty count, not just penalty size, once a first monetary penalty has already landed.

Illustration: a Data Fiduciary draws a moderate penalty under Section 33 for a breach-notification failure, and then a second, unrelated penalty months later for a separate security-safeguards lapse. That second penalty alone crosses the "two or more instances" threshold in 37(1)(a) — the Board can now refer the matter for blocking consideration, regardless of whether either individual penalty was itself especially large.

How Section 37 connects to the rest of the Act

Section 33 is where each individual penalty that eventually accumulates toward this section's threshold gets imposed. Section 36 sits alongside this as a separate, broader Central Government information power, without this section's own repeat-offender trigger or its scoped IT Act definitions.