The Information Technology Act, 2000 grants legal recognition to electronic records and electronic/digital signatures, enables e‑governance, regulates Certifying Authorities, establishes adjudication and appellate mechanisms, and creates offences and safeguards tailored to the digital environment in India.

Definitions

• Key terms: The Act defines “computer,” “computer system,” “computer network,” “data,” “electronic record,” “electronic signature,” “intermediary,” and related expressions, framing scope for authentication, attribution, and liability across the digital ecosystem under Section 2.
• Electronic record and signature: An “electronic record” covers data, images, or communications stored or transmitted electronically; “electronic signature” (including digital signatures) denotes authentication methods recognized under Sections 3 and 3A, anchored in asymmetric cryptography and hash functions with reliability criteria.

Electronic governance

• Legal recognition: Sections 4 and 5 confer legal recognition on electronic records and electronic signatures, placing them at par with paper documents and handwritten signatures for most purposes, subject to exclusions and prescribed conditions.
• Government use and retention: Sections 6–7A enable submission, retention, and audit of electronic records by government and its agencies, including publication in an e‑Gazette, while Section 9 clarifies no absolute right to insist on electronic acceptance unless notified.
• E‑contracts: Section 10A validates contracts formed through electronic means, cementing enforceability of online agreements and transactions in alignment with UNCITRAL model law principles recognized by the statute and commentary.

Certifying authorities

• Controller and oversight: Section 17 creates the Controller of Certifying Authorities (CCA), with functions in Section 18 including licensing, standards, repository oversight, and supervision of electronic signature ecosystems.
• Licensing and compliance: Sections 21–26 set licensing, renewal, suspension, and revocation of CA licenses; sections 30–34 impose security and practice obligations, repository publication, and trustworthy systems for key and certificate lifecycle
• Foreign CAs: Section 19 allows recognition of foreign Certifying Authorities per prescribed criteria, facilitating cross‑border trust frameworks for e‑signatures.

Digital/electronic signature and certificates

• Authentication: Section 3 enables authentication of electronic records via digital signatures based on asymmetric crypto and hash functions; Section 3A recognizes electronic signatures more broadly, subject to reliability criteria and notified techniques.
• Secure records and signatures: Sections 14–16 define secure electronic records and secure electronic signatures, and mandate security procedures and practices for evidentiary weight and integrity assurance.
• Certificates lifecycle: Sections 35–39 govern issuance, suspension (including temporary suspension), and revocation of electronic signature/digital signature certificates, with representational safeguards for subscribers and publication duties in repositories.

Attribution, dispatch, and receipt

• Transaction plumbing: Sections 11–13 address attribution of electronic records, acknowledgments, and time/place rules for dispatch and receipt, underpinning risk allocation and evidence in e‑communications.

Penalties, adjudication, and appeal

• Civil penalties and offences: The Act prescribes penalties for contraventions causing damage to computer resources, unauthorised access, and specified cyber offences, complementing sectoral rules and subsequent amendments described in official and explanatory texts.
• Adjudication and tribunal: Decisions of Adjudicating Officers and the Controller are appealable to the specialized appellate forum constituted under the Act, with further appeal to the High Court, as summarized in leading overviews of the appellate pathway.
• Intermediary liability safe harbour: Section 79 affords conditional safe harbour to intermediaries for third‑party content when due diligence is observed and unlawful content is addressed upon actual knowledge or government notice per statutory standards.

Investigation powers

• Search and access: The Act empowers designated authorities to order interception, monitoring, or decryption and to access computer resources subject to statutory safeguards, while controllers and adjudicators exercise investigatory and supervisory functions per scheme of the Act and rules.
• Standards and procedures: MeitY‑notified rules elaborate technical and procedural requirements for investigations, security practices, and compliance, reinforcing integrity and admissibility of electronic evidence.

Critical Information Infrastructure and protected systems

• Critical infrastructure: The Act provides special protection for “Critical Information Infrastructure,” enabling designation of “Protected Systems” with heightened access controls, security mandates, and penal consequences for unauthorized access or damage as reflected in statutory text and government references.
• Operational safeguards: Designation triggers obligations for system owners, incident reporting, audits, and restricted access protocols, integrated with national nodal agencies and sectoral CERTs through rules and executive guidance.

Application to electronic and truncated cheques

• Statutory enablement: Amendments introduced via the Negotiable Instruments framework integrated the concept of “electronic cheque” and “truncated cheque,” enabling cheque truncation systems and end‑to‑end electronic presentment consistent with IT Act recognition of electronic records and signatures.
• Banking rails: These provisions support clearing and settlement efficiency by permitting image‑based presentment and digital authentication under RBI‑regulated railroads, harmonized with electronic record evidentiary rules in the IT Act.

Practice pointers for finance and governance

• Trust framework: For high‑assurance digital onboarding and agreements, prefer notified e‑signature methods and ensure certificate validity checks and repository verification at execution.
•  Compliance by CAs and RPs: Certifying Authorities must maintain intrusion‑free hardware, publish practice statements and CRLs, and meet repository obligations; relying parties should log validation events for audit trails
• Litigation readiness: Align retention and audit programs to Sections 7 and 7A; adopt secure procedures under Sections 14–16 to enhance evidentiary robustness in disputes and regulatory inspections.
• Cheque truncation: For CTS operations and digital presentment, maintain image integrity, signature verification logs, and exception handling mapped to NI Act procedures and IT Act record authenticity rules.

Related Post:

CTS: Cheque Truncation System in India