Information Technology Law: Digital Signature, E-Governance and Electronic Records

The Information Technology Act 2000 (Act 21 of 2000) was enacted on 9 June 2000 (assent) and came into force on 17 October 2000. It is based on the UNCITRAL Model Law on Electronic Commerce 1996 (adopted by UN General Assembly Resolution 51/162 of 30 January 1997) and was amended by the Information Technology (Amendment) Act 2008 (in force 27 October 2009), which introduced electronic signatures (technology neutral), Section 66A–66F, 67A–67C, 69A–69B, 70A–70B, Section 43A, Section 79 (intermediary) and the "reasonable security practices" regime.

Objectives (preamble): to provide legal recognition for transactions carried out by electronic data interchange and other means of electronic communication ("electronic commerce"), to facilitate electronic filing of documents with Government agencies, and to amend the IPC, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the RBI Act 1934.

Extent and application (Section 1): extends to the whole of India and, Section 75, applies also to any offence or contravention committed outside India by any person if the act involves a computer, computer system or computer network located in India. Section 1(4) + First Schedule: the Act does not apply to: (a) a negotiable instrument other than a cheque; (b) a power of attorney; (c) a trust; (d) a will; (e) a contract for the sale or conveyance of immovable property.

Important definitions (Section 2(1)): access (a); addressee (b); adjudicating officer (c); affixing electronic signature (d); asymmetric crypto system (f); Certifying Authority (g); computer (i); computer network (j); computer resource (k); computer system (l); Controller (m); cyber cafe (na); cyber security (nb); data (o); digital signature (p); Digital Signature Certificate (q); electronic form (r); electronic record (t); electronic signature (ta); electronic signature certificate (tb); information (v); intermediary (w) (any person who on behalf of another receives, stores or transmits that record or provides any service with respect to it, including telecom service providers, network service providers, ISPs, web-hosting service providers, search engines, online payment sites, online-auction sites, online marketplaces and cyber cafes); key pair (x); originator (za); private key (zc); public key (zd); secure system (ze); security procedure (zf); subscriber (zg).

Digital signature (Section 2(1)(p), Section 3): authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with Section 3. A digital signature is created using an asymmetric crypto system and a hash function: the subscriber's private key transforms (encrypts) the hash (message digest) of the record; the public key (certified in a Digital Signature Certificate) is used by the recipient to verify both authenticity (who signed) and integrity (record unchanged). It is technology-specific (PKI-based).

Electronic signature (Section 2(1)(ta), Section 3A, inserted by the 2008 Amendment): authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule, and includes a digital signature. It is technology neutral and reflects the UNCITRAL Model Law on Electronic Signatures 2001. Conditions for a reliable electronic signature (Section 3A(2)): (a) the signature creation data are, within the context in which they are used, linked to the signatory and to no other person; (b) the data were, at the time of signing, under the exclusive control of the signatory; (c) any alteration to the electronic signature after affixing is detectable; and (d) any alteration to the information authenticated after affixing is detectable. The Second Schedule was amended in 2015 to include e-KYC/Aadhaar-based e-Sign ("Aadhaar e-Sign").

Legal recognition: Section 4: where any law requires information to be in writing/typewritten/printed, the requirement is satisfied if it is in electronic form and accessible for subsequent reference. Section 5: where any law requires information or a document to be authenticated by affixing a signature, the requirement is satisfied by a digital/electronic signature. Section 10A (2008): contracts formed through electronic means are valid and enforceable (proposals, acceptance and revocation expressed in electronic form). Sections 11–13: attribution, acknowledgement and the time and place of dispatch and receipt of electronic records (dispatch occurs when the record enters a computer resource outside the control of the originator; receipt occurs when it enters the designated computer resource; the place of dispatch/receipt is the place of business of the originator/addressee). Sections 14–16: secure electronic records and secure electronic signatures, and the security procedure prescribed by the Central Government.

• Controller of Certifying Authorities (CCA) (Section 17): appointed by the Central Government (under MeitY); functions in Section 18 (supervising CAs, certifying public keys, laying down standards and conditions, specifying qualifications of CAs, maintaining the Repository, resolving conflicts of interest). The CCA operates the Root Certifying Authority of India (RCAI), the root of trust for the Indian PKI.

• Licence (Sections 21–24): a CA must hold a licence from the Controller (application with CPS, security documents, fees); licence valid for a prescribed period (renewable) and suspended or revoked (Sections 25–26) for contravention. Section 19: recognition of foreign Certifying Authorities (by the Controller with Central Government approval).

• Duties of Certifying Authorities (Sections 30–34): use hardware/software and procedures secure from intrusion and misuse; provide a reasonable level of reliability; adhere to security procedures; ensure compliance with the Act and rules (Section 31); display the licence (Section 32); surrender the licence on suspension/revocation (Section 33); disclose the CPS, certificate, revocation notice, and any event materially affecting its operation (Section 34).

• Digital Signature Certificate (Chapter VII): Section 35: CA issues DSC on application (with fee and a certification practice statement) after satisfying itself that the applicant holds the private key and the corresponding public key; Section 36: representations upon issuance (the CA certifies it has complied with the Act, the subscriber holds the private key, etc.); Section 37: suspension of DSC (on request, or in public interest, for not more than 15 days without hearing); Section 38: revocation of DSC (on request, death, dissolution of company, or when a material fact is false); Section 39: notice of suspension or revocation.

• Section 40: Generating key pair: where any DSC the public key of which is to be listed in the certificate has been accepted by the subscriber, the subscriber must generate the key pair by applying the security procedure. Section 40A (2008): duties of subscribers of Electronic Signature Certificate: to comply with the prescribed requirements and exercise due diligence and reasonable care to retain control of the signature creation data.

• Section 41: Acceptance of Digital Signature Certificate: the subscriber accepts a DSC if he publishes or authorises its publication to one or more persons or in a repository, or otherwise demonstrates approval. By acceptance, the subscriber certifies to all who reasonably rely on it that (a) he holds the private key corresponding to the public key listed; (b) all representations made to the CA and all material relevant to the certificate are true; and (c) all information in the certificate that is within his knowledge is true.

• Section 42: Control of private key: every subscriber shall exercise reasonable care to retain control of the private key corresponding to the public key listed in his DSC and take all steps to prevent its disclosure to a person not authorised to affix his digital signature. If the private key has been compromised, he must communicate the same without any delay to the Certifying Authority in the manner specified by regulations. He is liable until he has informed the CA.

• Penalties linked to subscriber/CA conduct: Section 71 (misrepresentation to the Controller/CA: up to 2 years or fine up to ₹1 lakh or both); Section 73 (publishing a DSC with false particulars; up to 2 years or fine up to ₹1 lakh); Section 74 (publication for fraudulent purpose: up to 2 years or fine up to ₹1 lakh).

Electronic record (2(1)(t)): data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer-generated micro fiche.

• Section 7: Retention of electronic records: where a law requires documents/records/information to be retained, the requirement is met if the electronic record is accessible for later reference, retained in the format in which it was originally generated, sent or received (or a format that accurately represents it), and the details of origin, destination and date/time of despatch or receipt are retained. Section 7A: audit of documents maintained in electronic form.

• Section 8: publication of rules, regulations and notifications in the Electronic Gazette (legally valid, if published also in the official Gazette in the prescribed manner).

• Section 6: Use of electronic records and electronic signatures in Government and its agencies: the appropriate Government may (permissive, not mandatory) allow filing of forms/applications, issue of licences/permits, receipt/payment of money in electronic form. Section 6A (2008): delivery of services by service providers (e.g. through Common Service Centres) on behalf of the Government. Section 9: no right to insist that any Ministry/Department/Government agency must accept, issue, create, retain or preserve documents in electronic form.

• Section 10: power of the Central Government to make rules on digital signatures (type, manner, format, procedure, control of processes). Section 87: rule-making power.

• Electronic evidence: the Indian Evidence Act 1872 (amended by the IT Act): Section 3 ("evidence" includes electronic records), Section 65B (admissibility of electronic records with a certificate). Under the Bharatiya Sakshya Adhiniyam 2023 (in force 1 July 2024), the corresponding provision is Section 63 (certificate in Part A and Part B, including hash value and expert's certification). Anvar P.V. v. P.K. Basheer (SC 2014) held the certificate mandatory for secondary electronic evidence; Shafhi Mohammad v. State of H.P. (2018) relaxed it; Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (SC 2020) overruled Shafhi and restored the mandatory certificate requirement. Section 79A IT Act: Central Government may notify Examiner of Electronic Evidence.

• E-governance in India: National e-Governance Plan (NeGP) (2006), Digital India (2015), e-Courts, Aadhaar, DigiLocker, UMANG, e-Sign. Types: G2C, G2B, G2G, G2E. Justice K.S. Puttaswamy v. Union of India (2017, 9-judge bench) recognised the right to privacy as a fundamental right under Article 21; Puttaswamy (Aadhaar) (2018) upheld the Aadhaar Act (with Section 57 struck down and limited private use).

• Data protection: Section 43A (compensation for failure to protect sensitive personal data) and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 are being replaced by the Digital Personal Data Protection Act 2023 (assent 11 August 2023), which makes consent the principal basis for processing digital personal data, creates Data Fiduciary / Data Principal / Data Protection Board of India, and provides penalties up to ₹250 crore; the DPDP Rules 2025 (notified November 2025) bring the Act into force in phases (verify current commencement status). Section 44(2) of the DPDP Act omits Section 43A of the IT Act.

• Section 79 (safe harbour): an intermediary is not liable for third-party information, data or communication link made available or hosted by it if (a) its function is limited to providing access to a communication system; (b) it does not initiate the transmission, select the receiver or select or modify the information; and (c) it observes due diligence and the Central Government's guidelines. The protection is lost if the intermediary conspires, abets, aids or induces the unlawful act, or on receiving actual knowledge (or being notified by the appropriate Government) fails to expeditiously remove or disable access.

• Shreya Singhal v. Union of India (SC, 24 March 2015): the Court read down Section 79(3)(b) and the Intermediary Guidelines Rules 2011 (Rule 3(4)): "actual knowledge" means a court order or notification by the appropriate Government relating to Article 19(2) matters. (It also struck down Section 66A and upheld Section 69A with the Blocking Rules 2009.)

• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (notified 25 February 2021; amended 2022 and 2023): due diligence, significant social media intermediaries (SSMIs) (5 million registered users) must appoint a Chief Compliance Officer, Nodal Contact Person and Resident Grievance Officer (resident in India), enable first originator identification (Rule 4(2)) for messaging services, and comply with a three-tier grievance mechanism for digital media/OTT platforms; Grievance Appellate Committees (from 2022).

• Promotion and Regulation of Online Gaming Act 2025 (assent 22 August 2025): prohibits online money games, creates a regulatory authority; promotes e-sports (verify implementing rules).

Quick facts for revision (Section 9). IT Act: 2000 (in force 17 Oct 2000); Amendment 2008 (in force 27 Oct 2009). Model Law: UNCITRAL 1996. Digital signature: Sections 2(1)(p), 3; electronic signature: 3A; legal recognition: 4, 5; contracts: 10A; retention: 7; e-Gazette: 8; e-governance: 6, 6A; CCA: Section 17; CA duties: 30–34; DSC: 35–39; Subscriber duties: 40–42; First Schedule exclusions (5 items); Act applies abroad: Section 75; Shreya Singhal (2015).