Corporate and Economic Laws · Laws and Regulations related to Cyber Security and Data Privacy

Digital Signature and Electronic Governance under the IT Act, 2000

Updated 11 October 2026 · Fact-checked

Under the IT Act, 2000, an electronic record is authenticated by a digital signature (Section 3), electronic records and signatures are legally equal to paper and handwritten ones (Sections 4 and 5), and Certifying Authorities issue, suspend and revoke certificates (Sections 35 to 41). Solve questions by identifying the section, then applying its exact conditions.

Understand Digital Signature and Electronic Governance

Before the IT Act, many laws asked for information in writing, in print, or with a signature. That blocked electronic contracts and filings. The Act removes this barrier by giving electronic records and electronic signatures the same legal footing.

Section 4 says that where a law requires information to be in writing, typewritten or printed, the requirement is deemed satisfied if the information is (a) rendered or made available in electronic form and (b) accessible so as to be usable for a subsequent reference. Both conditions must be met.

Section 5 does the same for signatures. Where a law requires authentication by signature, the requirement is deemed satisfied if the information is authenticated by an electronic signature affixed in the manner prescribed by the Central Government. The Explanation says "signed" means affixing a handwritten signature or any mark.

Section 3 deals with the digital signature. A subscriber may authenticate an electronic record by affixing a digital signature. This is done through an asymmetric crypto system and a hash function. Anyone can verify the record with the subscriber's public key. The private key and public key are unique to the subscriber and form a functioning key pair. Think of it this way: the electronic signature is the broad legal concept in Section 5; the digital signature is one specific technology (public key cryptography) described in Section 3.

A Certifying Authority (CA) is the trusted body that issues the certificate linking a person to a key pair. The Controller supervises CAs (Section 18). The CA follows security and reliability procedures (Section 30), issues certificates on application (Section 35), makes representations when issuing (Section 36), and can suspend (Section 37) or revoke (Section 38) certificates. The subscriber's acceptance and its effect are in Section 41. Misuse of a bad certificate is punished under Section 73. A foreign CA can be recognised under Section 19.

Key rules to remember

Section 4: electronic records: Electronic form + accessible for subsequent reference = writing/typed/printed requirement satisfied; Both conditions are needed. Applies where a law requires writing, typewritten or printed form.
Section 5: electronic signatures: Electronic signature affixed in the manner prescribed by the Central Government = signature requirement satisfied; "Signed" means a handwritten signature or any mark on a document.
Section 3: digital signature: Authentication = asymmetric crypto system + hash function; verification by the subscriber's public key; Private and public keys are unique to the subscriber and form a functioning key pair.
Section 35: application for certificate: Application in prescribed form + fee not exceeding ₹25,000 + certification practice statement (or other statement); The CA may grant, or reject for reasons recorded in writing. No rejection without a reasonable opportunity to show cause. Fees may differ for different classes of applicants.
Section 36: CA's representations: CA certifies compliance, publication and acceptance, key holding, functioning key pair, accurate information, no adverse material fact; Covers clauses (a) to (f), including that the subscriber holds a private key capable of creating a digital signature.
Section 37: suspension: Suspension on request of subscriber or authorised person, or in public interest; not beyond 15 days without a hearing; The CA must communicate the suspension to the subscriber.
Section 38: revocation: Revocation on request, death, dissolution/winding up, or on grounds in sub-section (2); hearing required; Revocation needs an opportunity of being heard. The CA must communicate it to the subscriber.
Section 41: acceptance: Publishing or authorising publication, or showing approval = deemed acceptance; The subscriber then certifies that the key is held, and that representations and information within their knowledge are true.
Section 73: false certificate: Imprisonment up to 2 years, or fine up to ₹1,00,000, or both; Applies to publishing a certificate knowing it was not issued by the CA, not accepted by the subscriber, or is revoked or suspended. Exception: publication to verify a signature created before suspension or revocation.

How to solve Digital Signature and Electronic Governance questions

Use this method for theory questions and for case-based MCQs on digital signatures and electronic governance.

1Read the facts and identify the issue: recognition of a record, recognition of a signature, issue of a certificate, suspension or revocation, or an offence.
2Name the section that governs it (3, 4, 5, 35, 36, 37, 38, 41 or 73).
3State the rule in plain words, with every condition. For Section 4, give both conditions.
4Match each fact to a condition. Note who acts (subscriber, CA, Controller) and whether a hearing or time limit is involved.
5Check for exceptions, such as the Section 73 exception for verifying earlier signatures.
6State the conclusion clearly, with the consequence (valid, deemed satisfied, penalty).
7For differences, write a short two-column style comparison in bullets: scope, technology, section.

Quickest way: Trigger-word mapping

When to use it: For Section A MCQs where you have under two minutes per question.

"Writing, printed" points to Section 4. Look for electronic form plus later accessibility.
"Signature" requirement points to Section 5. Look for electronic signature in prescribed manner.
"Hash function" or "public key" points to Section 3.
"Fifteen days" points to suspension (Section 37). "Opportunity of being heard" appears in both 37 and 38.
"Twenty-five thousand" points to the Section 35 fee cap. "Two years or one lakh" points to Section 73.
Eliminate options that overstate, such as "always" or "without hearing".

Common mistakes in Digital Signature and Electronic Governance

Treating digital signature and electronic signature as identical.
Both words are used loosely in daily life.
Fix: Remember the 2009 amendment made Section 5 technology-neutral (electronic signature), while Section 3 describes the digital signature using asymmetric crypto and hash function.
Stating Section 4 with only the electronic form condition.
Students recall only the headline of legal recognition.
Fix: Always add the second condition: accessible so as to be usable for a subsequent reference.
Saying a certificate can be suspended for any length of time.
Confusion between suspension and revocation.
Fix: Suspension cannot exceed 15 days unless the subscriber has been heard. Revocation always needs a hearing.
Thinking a CA can reject an application without notice.
Students focus on the CA's power to grant or reject.
Fix: Rejection needs reasons recorded in writing and a reasonable opportunity to show cause.
Applying Section 73 penalty to every use of a revoked certificate.
The exception is missed.
Fix: Publication to verify a signature created before suspension or revocation is not an offence under Section 73(1).
Mixing up the Controller's functions (Section 18) with the CA's duties (Section 30).
Both lists involve standards and supervision.
Fix: The Controller supervises, sets standards and certifies CAs' public keys. The CA uses secure systems, is a repository of certificates and publishes certificate status.

Worked examples

Example 1

A statute requires a notice to be given in writing. Meera Textiles Pvt Ltd sends it as a PDF by email, and the recipient can open and save it for later reference. Does the notice satisfy the law? Cite the relevant provision.

Show the solution

Issue: the law requires information in writing.
Governing provision: Section 4 of the IT Act, 2000.
Condition (a): the information is made available in electronic form. A PDF by email satisfies it.
Condition (b): it is accessible so as to be usable for a subsequent reference. The recipient can open and save it, so this is satisfied.
Both conditions are met, so the requirement of writing is deemed satisfied.

Answer: Yes. Under Section 4, the PDF notice is deemed to satisfy the writing requirement because it is in electronic form and accessible for subsequent reference.

Example 2

Rohan's Digital Signature Certificate was issued by a Certifying Authority. The CA proposes to revoke it because it believes a material fact in the certificate was concealed. Can it do so immediately? Also, if Rohan asks for suspension instead, what is the limit?

Show the solution

Revocation is governed by Section 38. Under sub-section (2)(a), a CA may revoke if it is of opinion that a material fact represented in the certificate is false or has been concealed.
Sub-section (3) says a certificate shall not be revoked unless the subscriber has been given an opportunity of being heard.
So the CA cannot revoke immediately. It must first hear Rohan.
After revoking, under sub-section (4), the CA must communicate the revocation to the subscriber.
Suspension is under Section 37. On Rohan's request, the CA may suspend the certificate.
Under Section 37(2), suspension cannot exceed fifteen days unless the subscriber has been given an opportunity of being heard.

Answer: No. The CA may revoke on the concealment ground only after giving Rohan an opportunity of being heard, and must then communicate the revocation to him. A suspension cannot exceed fifteen days unless he is heard.

Exam tips

Learn the section-to-topic map: 3 authentication, 4 records, 5 signatures, 35 issue, 36 CA representations, 37 suspension, 38 revocation, 41 acceptance, 73 penalty.
Numbers are favourite MCQ options: 15 days, ₹25,000 fee cap, 2 years, ₹1,00,000. Memorise their sections.
In a case scenario, look for who is acting: subscriber, CA or Controller. Many wrong options swap them.
For a 14-mark answer, give the rule, conditions, exception and a one-line conclusion for each section you cite.
Use plain words for the law. Quote sub-section numbers only when sure.

Practice questions from Laws and Regulations related to Cyber Security and Data Privacy

Digital Signature and Electronic Governance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Digital Signature and Electronic Governance: frequently asked questions

What is the difference between a digital signature and an electronic signature under the IT Act?

Section 5 gives legal recognition to electronic signatures, authenticated in the manner prescribed by the Central Government. Section 3 describes the digital signature, which uses an asymmetric crypto system and a hash function. The digital signature is one technology within the wider idea of authentication by electronic means.

What does Section 4 of the IT Act say?

It says that where any law requires information to be in writing, typewritten or printed, the requirement is deemed satisfied if the information is available in electronic form and accessible for subsequent reference. Both conditions must be met.

How is a Digital Signature Certificate issued?

An applicant applies to the Certifying Authority in the prescribed form with a fee not exceeding ₹25,000 and a certification practice statement or other prescribed statement. The CA may grant it, or reject it for reasons recorded in writing after giving the applicant a reasonable chance to show cause (Section 35).

What are the functions of the Controller regarding Certifying Authorities?

Under Section 18, the Controller supervises CAs, certifies their public keys, lays down standards, qualifications and conditions of business, and specifies the form and content of certificates. The Controller also maintains a public database of CA disclosure records and resolves conflicts of interest between CAs and subscribers.