Jurisprudence, Interpretation and General Laws · Law relating to Information Technology

Regulation of Certifying Authorities and the Controller under IT Act

Updated 11 October 2026 · Fact-checked

The Controller of Certifying Authorities is appointed by the Central Government to supervise Certifying Authorities, the licensed bodies that issue electronic signature certificates. To answer, state the provision: who appoints the Controller, what the Controller does, how a licence is granted, suspended or revoked, and how certificates are issued. Then give a clear conclusion.

Understand Regulation of Certifying Authorities and Controller

An electronic signature is only trusted if someone reliable vouches for the person who uses it. That someone is a Certifying Authority (CA). A CA issues an electronic signature Certificate that links a public key to a named subscriber. The IT Act, 2000 builds a regulatory chain to keep CAs honest: the Central Government, the Controller, and then the CAs.

The Central Government appoints a Controller of Certifying Authorities by notification in the Official Gazette (Section 17). It may also appoint Deputy Controllers, Assistant Controllers, other officers and employees. The Controller works under the general control and directions of the Central Government. Deputy and Assistant Controllers perform the functions the Controller assigns, under the Controller's superintendence. The Controller's office has a seal. Its head office and branch offices are at places the Central Government specifies.

The Controller is the supervisor of CAs. Section 18 lists the functions. They fall into groups: supervision and standards (supervising CAs, certifying their public keys, laying down standards, qualifications of employees, conditions of business, duties of CAs); form and content (of certificates, keys, advertisements and accounts); audit and dealings (auditor terms, dealings with subscribers, resolving conflicts of interest between CAs and subscribers); and transparency (a public database of every CA's disclosure record). The Controller may also facilitate and regulate electronic systems set up by CAs, and may recognise a foreign CA with the Central Government's previous approval (Section 19).

A CA cannot start work freely. Any person may apply to the Controller for a licence, but the applicant must meet the requirements prescribed by the Central Government for qualification, expertise, manpower, financial resources and infrastructure (Section 21). The licence is valid for the prescribed period, is not transferable or heritable, and is subject to terms and conditions in the regulations.

Once licensed, the CA must follow procedures (Section 30). It issues certificates on application (Section 35). Misconduct can lead to suspension or revocation of the licence (Section 25). Subscribers also have duties, covered below. In the exam, treat the topic as a lifecycle: appointment, licence, conduct, certificate issue, discipline.

Key rules to remember

Appointment of Controller (Section 17): Central Government + notification in Official Gazette → Controller, Deputy Controllers, Assistant Controllers, other officers; The Controller acts subject to the general control and directions of the Central Government. Qualifications and service terms are as prescribed by the Central Government.
Licence to issue certificates (Section 21): Application to Controller + prescribed requirements met → licence; Requirements cover qualification, expertise, manpower, financial resources and infrastructure. The licence is not transferable or heritable and is valid for a prescribed period.
Revocation of licence (Section 25(1)): Inquiry + one of four grounds + reasonable opportunity of showing cause → revoke; Grounds: false or incorrect material statement in the application for issue or renewal; failure to comply with licence terms; failure to maintain the procedures and standards of Section 30; contravention of the Act, rules, regulations or orders.
Suspension of licence (Section 25(2) and (3)): Reasonable cause to believe a ground for revocation exists → suspend pending enquiry; no show-cause needed up to 10 days; A suspension beyond ten days needs a reasonable opportunity of showing cause. During suspension the CA cannot issue any certificate.
Duties of a CA (Section 30): Secure hardware, software and procedures + reasonable reliability + security of secrecy and privacy of signatures + repository of certificates + publish practices and certificate status + other standards in regulations; Use this as a checklist when a question asks what a CA must do.
Issue of certificate (Section 35): Application in prescribed form + fee not exceeding ₹25,000 + certification practice statement → grant, or reject with written reasons after show-cause; Different fees may be prescribed for different classes of applicants. Rejection needs reasons recorded in writing and a reasonable opportunity to show cause.
Recognition of foreign CA (Section 19): Controller + previous approval of Central Government + Gazette notification → recognition; A certificate issued by a recognised foreign CA is valid for the purposes of the Act. The Controller may revoke recognition for breach of conditions, giving reasons in writing, by notification.

How to solve Regulation of Certifying Authorities and Controller questions

Use this method for any question on the Controller, licensing, CAs or subscribers. It keeps your answer in the provision, facts, conclusion format that ICSI expects.

1Identify the actor in the question: Central Government, Controller, Certifying Authority, subscriber or applicant. The rule depends on who is acting.
2Identify the stage: appointment, licence application, conduct of business, certificate issue, or discipline (suspension or revocation).
3State the provision in plain words and cite the section, for example Section 25 for revocation and suspension.
4Apply the exact conditions to the facts: ground for action, inquiry, show-cause opportunity, time limit of ten days, fee cap of ₹25,000, written reasons.
5Check what is forbidden or mandatory, such as no certificate issue during suspension, or no transfer of a licence.
6Write a clear conclusion that answers the question asked, for example whether the order is valid or the application can be rejected.
7For a list question, group the points under heads such as supervision, standards, form and content, and dealings with subscribers.
8 Add subscriber duties briefly where the question mentions subscribers: secure key generation, acceptance of the certificate, control of the private key and prompt notice of compromise.

Quickest way: Lifecycle line and show-cause check

When to use it: Use when you have little time or the question is a short note or a quick validity problem.

Write the lifecycle in one line: Appoint (S.17) → Functions (S.18) → Licence (S.21) → Duties (S.30) → Certificate (S.35) → Discipline (S.25).
For any adverse action (revoke, suspend beyond ten days, reject an application), ask: was a reasonable opportunity of showing cause given?
Add the special points: written reasons for rejection, ten-day limit for suspension without hearing, no certificates during suspension, licence not transferable or heritable.
Close with a one-line conclusion.

Common mistakes in Regulation of Certifying Authorities and Controller

Saying the Controller is appointed by the President or by Parliament.
Students mix this with constitutional offices.
Fix: Remember Section 17: the Central Government appoints the Controller by notification in the Official Gazette.
Saying a licence can be suspended for any period without a hearing.
The word suspension suggests an immediate, final power.
Fix: Under Section 25(2), suspension pending enquiry beyond ten days needs a reasonable opportunity of showing cause. Revocation always needs it.
Treating the licence as transferable or inheritable like property.
Students think of a licence as a business asset.
Fix: Section 21(3) says a licence is not transferable or heritable. Learn it as a fixed point.
Forgetting that a CA must record reasons in writing when rejecting an application for a certificate.
Students remember only the show-cause rule.
Fix: Under Section 35(4), rejection needs both written reasons and a reasonable opportunity of showing cause.
Giving the fee cap wrongly or saying the CA fixes the fee itself.
The numbers are easy to blur.
Fix: Section 35(2): the fee is prescribed by the Central Government and cannot exceed ₹25,000. Different classes of applicants may pay different fees.
Writing 'digital signature' as the current term in every place.
Old notes and the old Act text use that term.
Fix: The Act now says electronic signature Certificate, substituted in 2009. Use the current term.

Worked examples

Example 1

Describe how a person becomes a Certifying Authority and the conditions attached to the licence under the IT Act, 2000.

Show the solution

Provision: Under Section 21, any person may apply to the Controller for a licence to issue electronic signature Certificates.
Eligibility: The licence cannot be issued unless the applicant meets the requirements prescribed by the Central Government for qualification, expertise, manpower, financial resources and other infrastructure.
Nature of the licence: It is valid for the period prescribed by the Central Government. It is not transferable or heritable. It is subject to the terms and conditions specified in the regulations.
Continuing duties: Under Section 30 the CA must use secure hardware, software and procedures, give reasonably reliable service, protect the secrecy and privacy of electronic signatures, act as repository of the certificates it issues, publish its practices and certificate status, and observe other standards in regulations.
Discipline: Under Section 25 the Controller may revoke the licence after inquiry on grounds such as a false material statement in the application, breach of licence terms, failure to maintain Section 30 standards or contravention of the Act.
Conclusion: A person becomes a CA only by obtaining a licence from the Controller after meeting the prescribed requirements, and keeps it only by complying with the conditions and duties.

Answer: A person applies to the Controller under Section 21 and must meet the prescribed requirements. The licence is time-limited, non-transferable and non-heritable, and is subject to regulations. The CA must follow Section 30 and risks revocation under Section 25.

Example 2

The Controller believes that Suraksha Digital Services Ltd, a licensed Certifying Authority, gave false material information when it applied for renewal of its licence. The Controller orders suspension of the licence for 15 days pending enquiry, without giving the company any hearing. During this period the company issues certificates to customers. Examine the validity of the Controller's order and the company's conduct.

Show the solution

Provision: Under Section 25(1)(a), a statement that is incorrect or false in material particulars in the application for issue or renewal is a ground for revoking the licence. Under Section 25(2), the Controller, if there is reasonable cause to believe a ground for revocation exists, may suspend the licence by order pending the enquiry.
Facts and analysis: The Controller's belief about the false statement is a valid basis for suspension. But the proviso to Section 25(2) says a licence cannot be suspended for more than ten days unless the CA has been given a reasonable opportunity of showing cause.
Application: The suspension is for 15 days and no hearing was given. So the suspension is valid only up to ten days. The period beyond ten days is not valid unless the company is first given a reasonable opportunity to show cause.
Company's conduct: Under Section 25(3), a CA whose licence is suspended cannot issue any electronic signature Certificate during the suspension. Issuing certificates in that period breaches the Act and can itself be a ground for action as a contravention.
Conclusion: The order is valid for ten days only. After that the Controller must give the company a hearing. The company's issue of certificates during the suspension was not permitted.

Answer: The Controller may suspend under Section 25(2), but not beyond ten days without a reasonable opportunity of showing cause, so the 15-day order is valid only for ten days. The company must not issue certificates during any valid suspension (Section 25(3)).

Exam tips

Learn Sections 17, 18, 21, 25, 30 and 35 with one anchor fact each: Gazette notification, public database, non-transferable licence, ten days, repository, ₹25,000 cap.
In problem questions, always check the show-cause requirement first. Most traps turn on it.
For a long answer on Controller's functions, group the Section 18 list under four heads rather than copying fourteen items, but include supervision, standards, public database and conflict resolution.
Section 25 is headed suspension but its first sub-section deals with revocation. Cover both in your answer.
The supplied official text does not carry the sections on subscriber duties, so describe those in plain words (secure key generation, control of private key, notice of compromise) and cite a section only if you are sure of it.

Practice questions from Law relating to Information Technology

Regulation of Certifying Authorities and Controller: frequently asked questions

Who appoints the Controller of Certifying Authorities?

The Central Government appoints the Controller by notification in the Official Gazette under Section 17. It can also appoint Deputy Controllers, Assistant Controllers, other officers and employees. The Controller works under the general control and directions of the Central Government.

What are the main functions of the Controller?

Section 18 lists them. They include supervising Certifying Authorities, certifying their public keys, laying down standards, qualifications and conditions of business, specifying the form of certificates and accounts, resolving conflicts between CAs and subscribers, and keeping a public database of every CA's disclosure record.

Can a Certifying Authority transfer its licence to another person?

No. Under Section 21(3) a licence is not transferable or heritable. It is valid for the period prescribed by the Central Government and is subject to the terms and conditions in the regulations.

For how long can the Controller suspend a licence without a hearing?

Not more than ten days. Under the proviso to Section 25(2), a longer suspension needs a reasonable opportunity of showing cause. A CA cannot issue any certificate while its licence is suspended.

What are the duties of subscribers under the IT Act?

In plain terms, a subscriber must generate the key pair using a secure system, accept the certificate only after checking its contents, exercise reasonable care to keep the private key under control, and tell the CA promptly if the key is compromised. Check your ICSI study material for the exact section numbers.