Section 25 of IT Act 2000:

Section 25(1)

The Controller may, if he has reasonable cause to believe that any Certifying Authority has—

(a) made a statement in, or in relation to, the application for the issue or renewal of the licence, which is incorrect or false in material particulars; or

(b) failed to comply with the terms and conditions subject to which the licence was granted;

revoke the licence.

Section 25(2)

The Controller shall not revoke a licence unless the Certifying Authority has been given a reasonable opportunity of showing cause against the proposed revocation.

Section 25(3)

The Controller may, instead of revoking a licence under sub-section (1), suspend such licence for a period not exceeding ten days:

Provided that no such licence shall be suspended unless the Certifying Authority has been given a reasonable opportunity of being heard in the matter.

Section 25(4)

The Controller shall publish notice of such suspension or revocation, as the case may be, in the database maintained by him.

Explained:

Section 25 contains three sub-sections. It provides the legal grounds for revoking a Certifying Authority’s licence, the procedure for temporary suspension and the restriction on issuing electronic signature certificates during suspension.

Sub-section (1): Grounds for revocation of licence

Sub-section (1) empowers the Controller of Certifying Authorities to revoke a licence after conducting an inquiry and being satisfied that one or more statutory grounds exist.

There are four grounds under this provision.

Clause (a): False or incorrect statements in the licence application

If a Certifying Authority provides incorrect or false information in material particulars while applying for a new licence or renewal, the Controller may take action.

For example, if an applicant submits false financial details, incorrect organisational information or misleading particulars concerning its technical capabilities, such conduct may constitute grounds for revocation.

Clause (b): Failure to comply with licence conditions

A Certifying Authority must follow the terms and conditions attached to its licence. Failure to comply with those conditions can result in regulatory action.

For instance, if a licensed authority fails to maintain the required operational arrangements or disregards conditions imposed by the Controller, its licence may be at risk.

Clause (c): Failure to maintain procedures and standards under Section 30

This clause requires a Certifying Authority to maintain the procedures and standards prescribed under Section 30 of the Act.

Section 30 requires Certifying Authorities to use secure hardware, software and procedures, maintain a high level of security in their services and comply with prescribed standards. Failure to follow these requirements can affect the reliability of electronic signature certificates.

Clause (d): Contravention of the Information Technology Act or rules

A licence may also be revoked where a Certifying Authority violates any provision of the Information Technology Act, 2000, or any rule, regulation or order made under it.

This clause ensures that Certifying Authorities remain accountable for compliance with the entire regulatory framework.

Proviso – Reasonable opportunity to show cause

Before revoking a licence, the Controller must give the Certifying Authority a reasonable opportunity to explain why the proposed revocation should not take place.

This safeguard protects the organisation from arbitrary regulatory action and supports the principles of natural justice.

Sub-section (2): Suspension of licence pending inquiry

Sub-section (2) empowers the Controller to suspend a licence where there is reasonable cause to believe that grounds for revocation exist.

Suspension may be ordered while an inquiry is pending. It is an interim regulatory measure intended to address concerns before a final decision on revocation is made.

The proviso establishes an important safeguard: a licence cannot remain suspended for more than ten days unless the Certifying Authority has been given a reasonable opportunity to show cause against the proposed suspension.

Thus, the ten-day provision is not an absolute maximum duration for every suspension. A longer suspension is possible after the required opportunity to respond has been provided.

Sub-section (3): Restriction on issuing electronic signature certificates

Sub-section (3) provides that a Certifying Authority whose licence has been suspended cannot issue any Electronic Signature Certificate during the suspension period.

This restriction is important because it prevents an authority operating under a suspended licence from continuing to issue certificates.

For example, if a Certifying Authority’s licence is suspended following serious compliance concerns, it cannot continue issuing new Electronic Signature Certificates while that suspension remains effective.

This provision helps protect subscribers and users who depend on reliable electronic authentication services.

Important Judgments

There appears to be limited reported judicial interpretation directly addressing the specific requirements of Section 25. The following Supreme Court judgments explain the principles of natural justice and reasoned administrative decisions that are relevant when authorities exercise statutory powers affecting licences.

1. State of Orissa v. Dr. (Miss) Binapani Dei (1967)

The Supreme Court emphasised that an administrative decision involving civil consequences must comply with the principles of natural justice. A person affected by such a decision should receive a fair opportunity to present their case.

Relevance to Section 25: The requirement to provide a Certifying Authority an opportunity to show cause before revocation reflects this principle.

2. Canara Bank v. Debasis Das (2003)

The Supreme Court explained the importance of procedural fairness and the right to a reasonable opportunity of hearing in administrative decision-making.

Relevance to Section 25: The Controller must follow the statutory hearing safeguards before taking action that affects a Certifying Authority’s licence.

3. Kranti Associates Pvt. Ltd. v. Masood Ahmed Khan (2010)

The Supreme Court discussed the importance of recording reasons in judicial and administrative decisions. Reasoned orders help ensure transparency and allow affected parties to understand the basis of a decision.

Relevance to Section 25: Regulatory decisions concerning suspension or revocation should be supported by proper consideration of the relevant facts and applicable law.

These judgments explain general administrative-law principles; they should not be represented as direct judicial interpretations of Section 25.

Difference Between Suspension and Revocation of Licence

Although both actions restrict a Certifying Authority, they have different legal consequences.

Related Provisions of the Information Technology Act, 2000

Section 25 should be read with other provisions dealing with the regulation of Certifying Authorities.

• Section 17: Appointment of Controller and other officers.
• Section 21: Licence to issue Electronic Signature Certificates.
• Section 22: Application for licence.
• Section 24: Procedure for grant or rejection of licence.
• Section 26: Notice of suspension or revocation of licence.
• Section 30: Certifying Authority to follow certain procedures.
• Section 31: Certifying Authority to ensure compliance with the Act.
• Section 33: Surrender of licence.

The Information Technology (Certifying Authorities) Rules, 2000, also contain provisions concerning licensing and suspension, particularly Rule 14. IndiaCode+2

Practical Importance

Section 25 is important for maintaining confidence in India’s electronic authentication system. Its provisions ensure that Certifying Authorities operate according to prescribed technical and legal standards.

It protects electronic transactions by allowing regulatory intervention where an authority provides false information, violates licensing conditions or fails to maintain prescribed security procedures.

For subscribers, businesses and government organisations, this regulatory mechanism helps maintain confidence in Electronic Signature Certificates. It also discourages negligence and non-compliance among licensed Certifying Authorities.

Conclusion

Section 25 of the Information Technology Act, 2000, establishes an important regulatory mechanism for the suspension and revocation of licences granted to Certifying Authorities. It empowers the Controller to take action against authorities that provide incorrect information, violate licence conditions, fail to maintain prescribed procedures or contravene the Act and its rules.

The three sub-sections address the grounds for revocation, interim suspension during an inquiry and the prohibition on issuing Electronic Signature Certificates during suspension.

At the same time, the provision protects Certifying Authorities through reasonable opportunities to present their explanations. By balancing regulatory powers with procedural safeguards, Section 25 contributes to the security, accountability and reliability of India’s electronic signature infrastructure.