Section 16 IT Act: Security Procedures and Practices

Understand Security Procedures and Practices (Section 16)

Key rules to remember

Section 16 power

Central Government may prescribe security procedures and practices for the purposes of sections 14 and 15

It is an enabling power ("may"). The detail comes from rules, not from section 16 itself.

Proviso to section 16

Regard to commercial circumstances + nature of transactions + other related factors considered appropriate

Write all three limbs in your answer. This shows that the standard is flexible.

Secure electronic record (section 14)

Security procedure applied at a specific point of time → record deemed secure from that point to the time of verification

The record is deemed secure for that period only.

Rule-making link (section 87)

Section 87(2)(ea): security procedures and practices under section 16

Rules are made by notification in the Official Gazette and in the Electronic Gazette under section 87(1). Rules are laid before each House of Parliament under section 87(3).

Section 43A contrast

Negligence in implementing and maintaining reasonable security practices + wrongful loss or gain → damages by way of compensation

Applies to a body corporate handling sensitive personal data. It is separate from section 16.

How to solve Security Procedures and Practices (Section 16) questions

1. 1Identify what is asked: the power under section 16, the meaning of a secure electronic record, or a fact-based problem on security procedures.
2. 2State the provision in plain words: the Central Government may prescribe security procedures and practices for the purposes of sections 14 and 15.
3. 3Add the proviso: regard to commercial circumstances, nature of transactions and other related factors.
4. 4Link section 14 if records are involved: a security procedure applied at a specific point of time makes the record a secure electronic record until verification.
5. 5Mention the rule-making route: section 87(2)(ea), with notification in the Official Gazette and in the Electronic Gazette.
6. 6Apply to the facts. Check whether a prescribed procedure was applied, when it was applied, and whether the question is about verification.
7. 7Conclude clearly. Say whether the record is deemed secure, or whether the matter falls under section 43A instead.
8. 8Keep drafting or compliance points short: document the procedure applied, the date and time, and the verification record.

Quickest way: Three-line recall for section 16

Common mistakes in Security Procedures and Practices (Section 16)

• Saying section 16 itself lists the security measures.

  The heading sounds like a code of practices.

  Fix: Say it is an enabling section. The Central Government prescribes the procedures through rules.

• Leaving out the proviso on commercial circumstances and nature of transactions.

  Students remember the main power and skip the proviso.

  Fix: Always write the proviso as a separate sentence. It carries marks.

• Mixing section 16 with section 43A.

  Both use the words security practices.

  Fix: Section 16 supports secure records and signatures. Section 43A gives compensation from a negligent body corporate handling sensitive personal data.

• Saying a record is secure forever once a procedure is applied.

  The time limit in section 14 is overlooked.

  Fix: State that it is deemed secure from the specific point of time to the time of verification.

• Saying section 16 applies only to electronic signatures.

  The word signature is stressed in the topic title.

  Fix: Section 16 covers the purposes of both section 14 (records) and section 15 (signatures).

Worked examples