Section 21 of IT Act 2000: Licence to issue Electronic Signature Certificates

Section 21(1)

Subject to the provisions of sub-section (2), any person may make an application, to the Controller, for a licence to issue electronic signature Certificates.

Section 21(2)

No licence shall be issued under sub-section (1), unless the applicant fulfils such requirements with respect to qualification, expertise, manpower, financial resources and other infrastructure facilities, which are necessary to issue electronic signature Certificates as may be prescribed by the Central Government.

Section 21(3)

A licence granted under this section shall—

(a) be valid for such period as may be prescribed by the Central Government;

(b) not be transferable or heritable;

(c) be subject to such terms and conditions as may be specified by the regulations.

Explained:

Section 21(1): Application for a licence

Subsection (1) provides that any person may apply to the Controller for a licence to issue Electronic Signature Certificates, subject to the requirements mentioned in subsection (2).

The Controller of Certifying Authorities (CCA) is responsible for regulating Certifying Authorities under the Information Technology Act.

This provision creates an opportunity for eligible individuals and organisations to establish themselves as licensed Certifying Authorities. However, merely submitting an application does not give an applicant the right to issue Electronic Signature Certificates.

Example: A company intending to provide electronic signature certification services must apply to the Controller and obtain the necessary licence before commencing its regulated operations.

Section 21(2): Eligibility and infrastructure requirements

Subsection (2) establishes the essential eligibility conditions for obtaining a licence. The Central Government prescribes the requirements that applicants must satisfy.

The provision identifies five important areas:

• Qualification: The applicant must satisfy the prescribed qualification requirements.
• Expertise: Adequate technical and professional knowledge is necessary to operate certification services.
• Manpower: The organisation must have appropriately qualified personnel to manage its operations.
• Financial resources: Sufficient financial capacity is required to maintain reliable certification services.
• Infrastructure facilities: Appropriate technical, physical and operational facilities must be available.

These conditions ensure that electronic signature certificates are issued by organisations capable of maintaining appropriate security and reliability standards.

The Controller of Certifying Authorities also examines the applicant’s infrastructure and supporting documents, including technical arrangements and security procedures. CCA+1

Section 21(3): Conditions attached to the licence

Subsection (3) explains the legal conditions applicable to a licence granted under Section 21.

Clause (a): Validity of licence

A licence remains valid for the period prescribed by the Central Government. A Certifying Authority must comply with the applicable renewal requirements to continue its authorised operations.

Clause (b): Licence is not transferable or heritable

A licence granted under Section 21 cannot be transferred to another person or inherited by legal heirs.

This restriction ensures that the authority to issue Electronic Signature Certificates remains with the person or organisation assessed and approved by the Controller.

For example, if a licensed company undergoes a change in ownership or business structure, the licence cannot simply be transferred to another entity without following the applicable legal requirements.

Clause (c): Terms and conditions of licence

The licence is subject to the terms and conditions specified by the relevant regulations.

The Certifying Authority must follow the applicable provisions of the Information Technology Act, the Information Technology (Certifying Authorities) Rules, 2000, and the relevant regulations.

Failure to comply may result in regulatory action, including suspension or revocation of the licence under Section 25.

Related Provisions of the Information Technology Act, 2000

To understand Section 21 completely, readers should also examine the following provisions:

Important Judgments

A distinction should be maintained between judgments directly interpreting Section 21 and decisions dealing with the broader legal framework of electronic transactions. The following judgments provide useful legal context.

1. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010)

The Supreme Court considered whether contractual negotiations conducted through email communications could result in a binding agreement.

The Court recognised that an agreement may be concluded through electronic communications when the essential requirements of a valid contract are satisfied.

Relevance: The judgment demonstrates the growing legal importance of electronic transactions and communications in commercial activities.

2. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

Relevance: The judgment explains the importance of complying with evidentiary requirements when electronic records are produced before courts. It provides useful context for understanding the legal reliability of electronic documentation, although it does not directly interpret Section 21.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements relating to certificates for electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Relevance: The decision highlights the importance of authentication and proper handling of electronic records. It is relevant to disputes involving digitally maintained documents and electronic communications.

The Bharatiya Sakshya Adhiniyam, 2023, which came into force on 1 July 2024, now provides the applicable framework for electronic evidence in proceedings governed by that legislation.

There is limited reported higher-court authority directly interpreting Section 21 itself. These cases are therefore cited for their relevance to electronic transactions and evidence, not as direct interpretations of its licensing conditions.

Conclusion

Section 21 of the Information Technology Act, 2000, establishes the licensing framework for issuing Electronic Signature Certificates in India. It ensures that individuals and organisations intending to operate as Certifying Authorities satisfy prescribed requirements relating to qualifications, technical expertise, manpower, financial resources and infrastructure.

Its three subsections establish the application process, eligibility conditions and legal characteristics of the licence. By regulating who can issue Electronic Signature Certificates, the provision contributes to the security and reliability of electronic transactions.