Sections 35–44: Blocking Orders, Rules, Overriding Effect and Amendments

Statutory Text (Official Gazette)

Section 35. Protection of action taken in good faith

35. No suit, prosecution or other legal proceedings shall lie against the Central Government, the Board, its Chairperson and any Member, officer or employee thereof for anything which is done or intended to be done in good faith under the provisions of this Act or the rules made thereunder.

Section 36. Power to call for information

36. The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.

Section 37. Power of Central Government to issue directions

37. (1) The Central Government or any of its officers specially authorised by it in this behalf may, upon receipt of a reference in writing from the Board that—

(a) intimates the imposition of monetary penalty by the Board on a Data Fiduciary in two or more instances; and

(b) advises, in the interests of the general public, the blocking for access by the public to any information generated, transmitted, received, stored or hosted, in any computer resource that enables such Data Fiduciary to carry on any activity relating to offering of goods or services to Data Principals within the territory of India, after giving an opportunity of being heard to that Data Fiduciary, on being satisfied that it is necessary or expedient so to do, in the interests of the general public, for reasons to be recorded in writing, by order, direct any agency of the Central Government or any intermediary to block for access by the public or cause to be blocked for access by the public any such information.

(2) Every intermediary who receives a direction issued under sub-section (1) shall be bound to comply with the same.

(3) For the purposes of this section, the expressions “computer resource”, “information” and “intermediary” shall have the meanings respectively assigned to them in the Information Technology Act, 2000.

Section 38. Consistency with other laws

38. (1) The provisions of this Act shall be in addition to and not in derogation of any other law for the time being in force.

(2) In the event of any conflict between a provision of this Act and a provision of any other law for the time being in force, the provision of this Act shall prevail to the extent of such conflict.

Section 39. Bar of jurisdiction

39. No civil court shall have the jurisdiction to entertain any suit or proceeding in respect of any matter for which the Board is empowered under the provisions of this Act and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power under the provisions of this Act.

Section 40. Power to make rules

40. (1) The Central Government may, by notification, and subject to the condition of previous publication, make rules not inconsistent with the provisions of this Act, to carry out the purposes of this Act.

(2) In particular and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:—

(a) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (1) of section 5;

(b) the manner in which the notice given by the Data Fiduciary to a Data Principal shall inform her, under sub-section (2) of section 5;

(c) the manner of accountability and the obligations of Consent Manager under sub-section (8) of section 6;

(d) the manner of registration of Consent Manager and the conditions relating thereto, under sub-section (9) of section 6;

(e) the subsidy, benefit, service, certificate, licence or permit for the provision or issuance of which, personal data may be processed under clause (b) of section 7;

(f) the form and manner of intimation of personal data breach to the Board under sub-section (6) of section 8;

(g) the time period for the specified purpose to be deemed as no longer being served, under sub-section (8) of section 8;

(h) the manner of publishing the business contact information of a Data Protection Officer under sub-section (9) of section 8;

(i) the manner of obtaining verifiable consent under sub-section (1) of section 9;

(j) the classes of Data Fiduciaries, the purposes of processing of personal data of a child and the conditions relating thereto, under sub-section (4) of section 9;

(k) the other matters comprising the process of Data Protection Impact Assessment under sub-clause (i) of clause (c) of sub-section (2) of section 10;

(l) the other measures that the Significant Data Fiduciary shall undertake under sub-clause (iii) of clause (c) of sub-section (2) of section 10;

(m) the manner in which a Data Principal shall make a request to the Data Fiduciary to obtain information and any other information related to the personal data of such Data Principal and its processing, under sub-section (1) of section 11;

(n) the manner in which a Data Principal shall make a request to the Data Fiduciary for erasure of her personal data under sub-section (3) of section 12;

(o) the period within which the Data Fiduciary shall respond to any grievances under sub-section (2) of section 13;

(p) the manner of nomination of any other individual by the Data Principal under sub-section (1) of section 14;

(q) the standards for processing the personal data for exemption under clause (b) of sub-section (2) of section 17;

(r) the manner of appointment of the Chairperson and other Members of the Board under sub-section (2) of section 19;

(s) the salary, allowances and other terms and conditions of services of the Chairperson and other Members of the Board under sub-section (1) of section 20;

(t) the manner of authentication of orders, directions and instruments under sub-section (1) of section 23;

(u) the terms and conditions of appointment and service of officers and employees of the Board under section 24;

(v) the techno-legal measures to be adopted by the Board under sub-section (1) of section 28;

(w) the other matters under clause (d) of sub-section (7) of section 28;

(x) the form, manner and fee for filing an appeal under sub-section (2) of section 29;

(y) the procedure for dealing an appeal under sub-section (8) of section 29;

(z) any other matter which is to be or may be prescribed or in respect of which provision is to be, or may be, made by rules.

Section 41. Laying of rules and certain notifications

41. Every rule made and every notification issued under section 16 and section 42 of this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the rule or notification or both Houses agree that the rule or notification should not be made or issued, the rule or notification shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule or notification.

Section 42. Power to amend Schedule

42. (1) The Central Government may, by notification, amend the Schedule, subject to the restriction that no such notification shall have the effect of increasing any penalty specified therein to more than twice of what was specified in it when this Act was originally enacted.

(2) Any amendment notified under sub-section (1) shall have effect as if enacted in this Act and shall come into force on the date of the notification.

Section 43. Power to remove difficulties

43. (1) If any difficulty arises in giving effect to the provisions of this Act, the Central Government may, by order published in the Official Gazette, make such provisions not inconsistent with the provisions of this Act as may appear to it to be necessary or expedient for removing the difficulty.

(2) No order as referred to in sub-section (1) shall be made after the expiry of three years from the date of commencement of this Act.

(3) Every order made under this section shall be laid, as soon as may be after it is made, before each House of Parliament.

Section 44. Amendments to certain Acts

44. (1) In section 14 of the Telecom Regulatory Authority of India Act, 1997, in clause (c), for sub-clauses (i) and (ii), the following sub-clauses shall be substituted, namely:—

“(i) the Appellate Tribunal under the Information Technology Act, 2000;

(ii) the Appellate Tribunal under the Airports Economic Regulatory Authority of India Act, 2008; and

(iii) the Appellate Tribunal under the Digital Personal Data Protection Act, 2023.”.

(2) The Information Technology Act, 2000 shall be amended in the following manner, namely:—

(a) section 43A shall be omitted;

(b) in section 81, in the proviso, after the words and figures “the Patents Act, 1970”, the words and figures “or the Digital Personal Data Protection Act, 2023” shall be inserted; and

(c) in section 87, in sub-section (2), clause (ob) shall be omitted.

(3) In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:—

“(j) information which relates to personal information;”.

What Sections 35 to 44 Mean in Plain English

1. Good faith protection (Section 35): No case can be brought against the government or the Board for actions taken in good faith under the Act.
2. Information demands (Section 36): The government can require the Board, any Data Fiduciary or any intermediary to provide information. Rule 23 and the Seventh Schedule say who can ask and for what, and the government can bar you from telling affected users in national security cases.
3. Blocking orders (Section 37): If the Board has penalised a Data Fiduciary in two or more instances and advises blocking in the public interest, the government can, after a hearing, order your app or website blocked in India. Intermediaries must comply.
4. Overriding effect (Section 38): The Act adds to other laws, but if there is a conflict, the DPDP Act wins. Stricter sectoral rules, such as RBI data localisation, still apply where there is no conflict.
5. No civil court cases (Section 39): Matters the Board can handle cannot be taken to civil courts, and no court can grant an injunction against action under the Act.
6. Rules (Sections 40 and 41): The government makes rules on the matters listed in Section 40(2). The DPDP Rules, 2025 are those rules. Rules must be laid before Parliament.
7. Changing the Schedule (Section 42): The government can amend the penalty Schedule but cannot raise any penalty above twice its original amount.
8. Removal of difficulties (Section 43): The government can issue orders to fix problems in applying the Act, but only within three years of commencement. The 2026 Removal of Difficulties Order was issued under this power.
9. Amendments to other laws (Section 44):
   • TRAI Act: TDSAT becomes the appeal tribunal under the DPDP Act.
   • IT Act: Section 43A (compensation for negligent handling of sensitive data) and the related rule-making power are removed. This takes effect on May 13, 2027, so the SPDI Rules, 2011 apply until then.
   • RTI Act: Section 8(1)(j) now exempts all “information which relates to personal information”, without the old public-interest test. This took effect on November 13, 2025 and has been criticised by transparency campaigners.

Why This Chapter Matters

• Repeat offenders can be blocked: Two penalties can put your platform’s availability in India at risk.
• No private compensation route: With Section 43A removed and penalties going to the government (Section 34), affected users lose the IT Act route to compensation.
• The Act prevails: Where another law conflicts, plan to the DPDP standard.