Section 30 of IT Act 2000: Certifying Authority to follow certain procedures.

Every Certifying Authority shall,—

(a) make use of hardware, software and procedures that are secure from intrusion and misuse;

(b) provide a reasonable level of reliability in its services which are reasonably suited to the performance of intended functions;

(c) adhere to security procedures to ensure that the secrecy and privacy of the electronic signatures are assured;

(ca) be the repository of all electronic signature Certificates issued under this Act;

(cb) publish information regarding its practices, electronic signature Certificates and current status of such certificates; and

(d) observe such other standards as may be specified by regulations.

Explained:

Section 30 prescribes six important statutory obligations for Certifying Authorities. These requirements are intended to maintain trust in electronic authentication systems and protect the interests of subscribers and persons relying on electronic signatures.

1. Clause (a): Secure Hardware, Software and Procedures

Clause (a) requires every Certifying Authority to use hardware, software and procedures that are secure against intrusion and misuse.

This provision emphasises the importance of cybersecurity in electronic authentication. Certifying Authorities handle sensitive information and digital credentials. Any unauthorised access, hacking or manipulation may affect the reliability of electronic signatures and certificates.

For example, a Certifying Authority must maintain appropriate security arrangements to protect its computer systems, certificate-generation infrastructure and confidential information against cyberattacks.

2. Clause (b): Reasonable Level of Reliability

Clause (b) requires Certifying Authorities to provide a reasonable level of reliability in their services, suited to the functions they are intended to perform.

Reliability is essential because individuals, businesses and government departments depend on electronic signatures for important transactions.

For instance, when a company uses an Electronic Signature Certificate for an official filing, the authentication service should function accurately and consistently. Technical failures, incorrect certificate information or unreliable verification procedures may create legal and operational difficulties.

The provision therefore requires Certifying Authorities to maintain dependable services appropriate to their responsibilities.

3. Clause (c): Secrecy and Privacy of Electronic Signatures

Clause (c) requires Certifying Authorities to follow security procedures that ensure the secrecy and privacy of electronic signatures.

Electronic authentication involves sensitive information, including private credentials and security-related data. If such information is disclosed or misused, unauthorised persons may attempt to impersonate legitimate users.

This clause therefore requires appropriate confidentiality and security safeguards.

For example, a Certifying Authority should protect sensitive authentication information against unauthorised disclosure and maintain procedures that prevent misuse of electronic signing credentials.

4. Clause (ca): Repository of Electronic Signature Certificates

Clause (ca) requires every Certifying Authority to act as the repository of all Electronic Signature Certificates issued under the Act.

Maintaining certificate records is important for verification, administration and accountability. A proper repository helps establish whether a certificate was issued by the relevant authority and provides a reliable record of certificate-related information.

This requirement supports the transparency and traceability of electronic authentication services.

5. Clause (cb): Publication of Information Regarding Certificates

Clause (cb) requires Certifying Authorities to publish information concerning their practices, Electronic Signature Certificates and the current status of those certificates.

This obligation promotes transparency and enables subscribers and persons relying on electronic signatures to obtain relevant certificate information.

For example, information about whether a certificate is valid, suspended or revoked can be important before accepting an electronically authenticated document.

Such information helps reduce the possibility of relying on invalid or compromised certificates.

6. Clause (d): Compliance with Other Prescribed Standards

Clause (d) requires Certifying Authorities to observe other standards specified by regulations.

Technology and cybersecurity requirements continue to develop. This clause allows the regulatory framework to prescribe additional standards relevant to the secure operation of Certifying Authorities.

These standards may concern technical security, certificate management, operational procedures and other requirements necessary for maintaining reliable electronic authentication services.

Importance of Section 30 in Digital Transactions

Section 30 plays an important role in maintaining confidence in India’s electronic signature infrastructure. Its practical importance can be understood through the following applications.

1. Security of electronic transactions: The provision requires Certifying Authorities to maintain secure hardware, software and operating procedures, helping protect electronic authentication systems against cyberattacks.

2. Protection against identity misuse: Security and privacy requirements help reduce the risk of unauthorised use of electronic signatures and identity-related information.

3. Reliable digital documentation: Electronic Signature Certificates provide a mechanism for authenticating individuals in permitted electronic transactions. Proper certificate management supports the reliability of these transactions.

4. Transparency and accountability: Maintaining certificate repositories and publishing certificate-related information helps subscribers and relying parties verify relevant certificate details.

5. Trust in online services: Reliable certification services are important for digital governance, banking, corporate documentation and online commercial transactions.

Important Judgments

There is an important distinction between judgments directly interpreting Section 30 and judgments dealing with the broader legal framework of electronic transactions and electronic evidence. The following decisions provide relevant legal context. They should not be treated as direct interpretations of every clause of Section 30.

1. State of Maharashtra v. Dr. Praful B. Desai (2003)

The Supreme Court considered the use of video conferencing in judicial proceedings and recognised that technological methods could be used to record evidence, subject to legal requirements.

Relevance: The judgment demonstrates the judiciary’s acceptance of technology in legal processes. It provides broader context for the increasing importance of reliable electronic systems, although it does not directly concern the statutory duties of Certifying Authorities under Section 30.

2. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010)

The Supreme Court considered whether contractual negotiations conducted through email communications could result in a binding agreement.

The Court recognised that an enforceable contract could be formed through electronic communications when the essential requirements of a valid contract were satisfied.

Relevance: The decision illustrates the growing importance of electronic communications in commercial transactions. Reliable electronic authentication services, including those governed by Section 30, support confidence in digital business activities.

3. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

Relevance: The judgment highlights the importance of maintaining reliable electronic records and complying with applicable evidentiary requirements. Although Section 30 deals with Certifying Authorities, the broader principle of maintaining the reliability and authenticity of electronic information is relevant.

4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements for producing electronic evidence under Section 65B of the Indian Evidence Act, 1872, particularly the certificate required for certain electronic records.

Relevance: This decision is significant when electronic records are produced in court. It explains the distinction between the technical reliability of electronic systems and the legal requirements for proving electronic evidence.

The Bharatiya Sakshya Adhiniyam, 2023, replaced the Indian Evidence Act, 1872, with effect from 1 July 2024. Therefore, the applicable evidentiary provisions must be considered according to the proceeding concerned.

Note: The above judgments provide related legal principles; they are not presented as direct rulings on Section 30. No direct judicial interpretation of Section 30 is identified in the cited statutory material.

Relationship Between Section 30 and Other Provisions of the IT Act

Section 30 should be understood alongside other provisions regulating Certifying Authorities and electronic signatures.

These provisions collectively establish the regulatory framework for licensing, supervising and monitoring Certifying Authorities in India. India Code+1

Conclusion

Section 30 of the Information Technology Act, 2000, establishes essential security, reliability and transparency obligations for Certifying Authorities in India. Its six clauses address secure technology, dependable services, protection of electronic signatures, certificate management, publication of certificate information and compliance with prescribed standards.

The provision is particularly important in an environment where electronic authentication is widely used for business agreements, government services, financial transactions and digital documentation.

By requiring Certifying Authorities to follow appropriate technical and operational procedures, Section 30 strengthens confidence in electronic signatures and supports the secure development of India’s digital economy.