Compensation quantum is adjudged by the adjudicating officer with due regard to quantifiable unfair gain or advantage resulting from the default, loss caused to any person by the default, and the repetitive nature of the default.

Qualified adjudicating officers may be appointed to inquire into contraventions of applicable statutory provisions, rules, regulations, directions and orders. The concerned person must receive a reasonable opportunity to make representations before a penalty or compensation is imposed. Where multiple officers are appointed, their subject-matter and territorial jurisdiction must be specified. Adjudicating officers exercise specified civil-court powers, and their proceedings are treated as judicial proceedings.

Section 45 establishes a residuary penalty for contravention of rules or regulations made under the Information Technology Act, 2000 where no separate penalty is prescribed. The contravener may be required to pay compensation to the affected person or a penalty, with either liability capped at twenty-five thousand rupees.

Where a person does not file a prescribed return or furnish required information, books or other documents within the time specified by regulations, liability may extend to a daily penalty not exceeding five thousand rupees for as long as the failure continues. Failure to maintain mandated books of account or records attracts a separate daily penalty not exceeding ten thousand rupees during the continuing default.

Section 43 imposes compensatory liability for unauthorised access to computer resources, extraction of data, introduction of contaminants or viruses, and damage to computer systems, networks, data or programmes. It also covers disruption, denial of access to authorised users, assistance in unlawful access, and fraudulent charging of services to another person's account through manipulation of computer resources. Damages by way of compensation are payable to the affected person, subject to the prescribed maximum.

Subscribers must exercise reasonable care to retain control of the private key corresponding to the public key in their Digital Signature Certificate and prevent unauthorised disclosure. A compromised private key must be promptly reported to the Certifying Authority in the prescribed manner. Liability continues until the Certifying Authority is informed of the compromise.

Acceptance of a Digital Signature Certificate is deemed where a subscriber publishes or authorises its publication, places it in a repository, or otherwise demonstrates approval. The subscriber thereby certifies to reasonable relying parties that the corresponding private key is held lawfully, representations and material information given to the Certifying Authority are true, and information in the certificate within the subscriber's knowledge is true.

A subscriber accepting a Digital Signature Certificate that lists a public key corresponding to the subscriber's private key must generate the associated key pair by applying the security procedure. This duty links certificate acceptance to secure generation of the public and private keys underlying the certificate.

Suspension or revocation of a Digital Signature Certificate requires the Certifying Authority to publish a corresponding notice in the repository identified in that certificate for such publication. Where the certificate specifies one or more repositories, the notice must be published in every repository so specified. This mandatory repository-publication requirement applies to each instance of suspension or revocation affecting the certificate.

A Digital Signature Certificate may be revoked upon the subscriber's request, death, insolvency, or cessation of existence, and where material information is false or concealed, issuance requirements were unmet, or certificate reliability is materially affected by a security compromise. Revocation requires an opportunity of being heard for the subscriber. The Certifying Authority must communicate the revocation to the subscriber.

Suspension of a Digital Signature Certificate may be undertaken upon a request from the listed subscriber or a person duly authorised to act for that subscriber, or where suspension is considered necessary in the public interest. Suspension may not continue beyond fifteen days unless the subscriber has been afforded an opportunity to be heard. Once suspension is effected, it must be communicated to the subscriber.

A Certifying Authority issuing a Digital Signature Certificate must certify compliance with the Act and rules and regulations, certificate availability to a relying person, and subscriber acceptance. It must confirm that the subscriber holds the corresponding private key, the public and private keys form a functioning key pair, and certificate information is accurate. It must also lack knowledge of material facts adversely affecting the reliability of these representations.

Applications for a Digital Signature Certificate must be made in the prescribed form, with the prescribed fee and a certification practice statement or other required statement. Issuance depends on verification that the applicant holds a functional private key corresponding to the listed public key and that the public key can verify signatures created by that private key. Rejection requires recorded reasons and a reasonable opportunity for the applicant to show cause.

Certifying Authorities must disclose their Digital Signature Certificate and corresponding public key, relevant certification practice statement, revocation or suspension of their certificate, and material adverse facts affecting issued certificates or service capability. Where an event may adversely affect computer-system integrity or conditions governing a Digital Signature Certificate, they must reasonably notify affected persons or follow the procedure in their certification practice statement.

Section 33 requires every Certifying Authority whose licence is suspended or revoked to immediately surrender the licence to the Controller. Failure to do so constitutes an offence by the person in whose favour the licence was issued, punishable by imprisonment for up to six months, a fine up to ten thousand rupees, or both.

Every Certifying Authority must conspicuously display its licence at the premises where it carries on business. This requirement ensures that the authority's authorisation is visibly available at its operational location.

Certifying Authorities must ensure that every person employed or otherwise engaged by them complies, during such employment or engagement, with the Information Technology Act, its rules, regulations, and orders made under it. The obligation requires each Certifying Authority to secure personnel compliance with the applicable statutory and regulatory framework.

Certifying Authorities must use hardware, software and procedures secure against intrusion and misuse, provide reasonably reliable services suited to intended functions, and maintain security procedures assuring the secrecy and privacy of digital signatures. They must also comply with further operational and security standards prescribed through regulations.

Where reasonable cause exists to suspect a contravention of the Information Technology Act, its rules, or regulations, authorised access may be made to computer systems, connected apparatus, data, and other material to search for information or data. Persons operating or otherwise concerned with the relevant system or material may be ordered to provide reasonable technical and other assistance necessary for that access and search.

Investigation of contraventions is entrusted to the Controller or an officer authorised for that purpose. They must investigate breaches of applicable statutory provisions, rules, or regulations, and may exercise powers corresponding to those available to income-tax authorities, subject to the limitations governing those powers.