In force · As amended up to 2026-08
4. The first proviso omitted by s. 17, ibid . (w.e.f. 27-10-2009).
5. Subs. by s. 17, ibid ., for "Provided further" (w.e.f. 27-10-2009).
(c) the subscriber holds the private key corresponding to the public key, listed in the Digital Signature Certificate;
1 [(ca) the subscriber holds a private key which is capable of creating a digital signature;
(cb) the public key to be listed in the certificate can be used to verify a digital signature affixed by the private key held by the subscriber;]
- (d) the subscriber's public key and private key constitute a functioning key pair;
(e) the information contained in the Digital Signature Certificate is accurate; and
(f) it has no knowledge of any material fact, which if it had been included in the Digital Signature Certificate would adversely affect the reliability of the representations in clauses (a) to (d).
THE FOURTH SCHEDULE. [ Omitted. ]
THE INFORMATION TECHNOLOGY ACT, 2000
ACT NO. 21 OF 2000
[9 th June , 2000.]
- An Act to provide legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication, commonly referred to as "electronic commerce", which involve the use of alternatives to paper-based methods of communication and storage of information, to facilitate electronic filing of documents with the Government agencies and further to amend the Indian Penal Code, the Indian Evidence Act, 1872, the Banker's Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934 and for matters connected therewith or incidental thereto;
WHEREAS the General Assembly of the United Nations by resolution A/RES/51/162, dated the 30th January, 1997 has adopted the Model Law on Electronic Commerce adopted by the United Nations Commission on International Trade Law;
AND WHEREAS the said resolution recommends inter alia , that all States give favourable consideration to the said Model Law when they enact or revise their laws, in view of the need for uniformity of the law applicable to alternatives to paper-based methods of communication and storage of information;
AND WHEREAS it is considered necessary to give effect to the said resolution and to promote efficient delivery of Government services by means of reliable electronic records.
4. Serial number 5 and the entries relating thereto Omitted by S.O. 4720(E), Dated 26-9-2022.
1[THE SECOND SCHEDULE
[ See sub-section (1) of section 3A]
ELECTRONIC SIGNATURE OR ELECTRONIC AUTHENTICATION TECHNIQUE AND PROCEDURE
BE it enacted by Parliament in the Fifty-first Year of the Republic of India as follows:-
|Sl. No.|Description|Procedure|
|---|---|---|
|(1)|(2)|(3)|
|2[1.|e-authentication technique using Aadhaar3[or|Authentication of an electronic record|
||other] e-KYC services|by e-authentication Technique which|
|||shall be done by—|
|||(a)<br>the<br>applicable<br>use<br>of<br>e-|
|||authentication, hash, and asymmetric|
|||crypto system techniques, leading to|
|||issuance of Digital Signature Certificate|
|||by Certifying Authority|
|||(b) a trusted third party service by|
|||subscriber's key pair-generation, storing|
|||of key pairs4[* * *] and creation of|
|||digital signature provided that the|
|||trusted third party shall be offered by|
|||the certifying authority. The trusted|
|||third party shall send application form|
|||and certificate signing request to the|
|||Certifying Authority for issuing a|
|||Digital Signature Certificate to the|
|||subscriber.|
|||(c)<br>Issuance<br>of<br>Digital<br>Signature|
|||Certificate by Certifying Authority shall|
|||be based on e-authentication, particulars|
|||specified in Form C of Schedule IV of|
|||the Information Technology (Certifying|
|||Authorities)<br>Rules,<br>2000,<br>digitally|
|||signed<br>verified<br>information<br>from|
|||Aadhaar5[or other] e-KYC services and|
|||electronic consent of Digital Signature|
|||Certificate applicant.|
|||(d) The manner and requirements for e-|
|||authentication shall be as issued by the|
|||Controller from time to time.|
|||(e) The security procedure for creating|
|||the subscriber's key pair6[and other e-|
|||KYC services] shall be in accordance|
|||with the e-authentication guidelines|
|||issued by the Controller.|
|||(f) The standards referred to in Rule 6 of|
|||the Information Technology (Certifying|
|||Authorities)Rules,2000 shallbe|
1. Subs. by Act 10 of 2009, s. 49, (w.e.f. 27-10-2009).
2. Ins. by G.S.R. 61(E), dated 27-1-2015 (w.e.f. 28-1-2015).
3. Ins. by S.O. 1119(E), dated 1-3-2019.
4. The words "on hardware security module" omitted by G.S.R. 539(E), dt. 30-6-2015 (w.e.f. 6-7-2015).
5. Ins. by S.O. 1119(E), dated 1-3-2019.
6. Ins. by S.O. 1119(E), dated 1-3-2019.
||||complied with, in so far as they relate to|
|---|---|---|---|
||||the certification function of public key|
||||of<br>Digital<br>Signature<br>Certificate|
||||applicant.|
||||1[(g)<br>The<br>manner<br>in<br>which<br>the|
||||information is authenticated by means|
||||of digital signature shall comply with|
||||the manner and standards specified in|
||||Rules 3 to 12 of the Digital Signature|
||||(End entity) Rules, 2015 in so far as|
||||they relate to the creation, storage, and|
||||verification of Digital Signature]|
|2[2.|e-authentication technique and procedure for||Authentication of an electronic record|
||creating and accessing subscriber's signature||by e-authentication technique which|
||key facilitated by trusted third party||shall be done by—|
||||(a)<br>the<br>applicable<br>use<br>of|
||||e-authentication, hash and asymmetric|
||||crypto system techniques leading to|
||||issuance of Digital Signature Certificate|
||||by Certifying Authority, provided that|
||||Certifying Authority shall ensure the|
||||subscriber identity verification, secure|
||||storage of the keys by trusted third party|
||||and subscriber's sole authentication|
||||control to the signature key.|
||||(b) Identity verification of Digital|
||||Signature Certificate applicant shall be|
||||in<br>accordance<br>with<br>the<br>Identity|
||||Verification<br>Guidelines<br>issued<br>by|
||||Controller from time-to-time.|
||||(c) The requirement to operate as trusted|
||||third party shall be specified under e-|
||||authentication guidelines issued by the|
||||Controller.|
||||(d) a trusted third party shall|
||||(i) facilitate Identity verification of|
||||Digital Signature Certificate applicant;|
||||(ii) establish secure storage for|
||||subscriber to have sole control for|
||||creation and subsequent usage of|
||||subscriber's signature key by sole|
||||authentication of subscriber;|
||||(iii) facilitate key pair-generation,|
||||secure storage of subscriber's signature|
||||key and facilitate signature creation|
||||functions;|
||||(vi) facilitate the submission of DSC|
||||application form and certificate signing|
||||request to the Certifying Authority for|
||||issuing a Digital Signature Certificate to|
||||the DSC applicant, and|
of
1. Subs. by G.S.R. 446(E), for "(g)" dated 27-4-2016 (w.e.f. 27-4-2016)."
Source: India Code