Section 28 establishes an investigation mechanism for contraventions of the Information Technology Act, 2000, and of rules and regulations made under it. The Controller or an authorised officer must investigate such contraventions and exercise powers corresponding to those conferred on Income-tax authorities, subject to applicable statutory limitations.

Written authorisation enables the Controller to delegate any power exercisable under the Chapter regulating Certifying Authorities to a Deputy Controller, Assistant Controller, or any other officer. Delegation must be made in writing and permits the authorised officer to exercise those delegated Controller powers within the Chapter pursuant to that authorisation.

Suspension or revocation of a Certifying Authority's licence requires the Controller to publish notice in the maintained database and, where repositories are specified, in each repository. The database carrying the notice must remain accessible through a website on a round-the-clock basis. Further publicity may be given through appropriate electronic or other media where considered necessary.

Licensing control of Certifying Authorities permits the Controller to revoke a licence for materially false application particulars, breach of licence conditions, failure to maintain prescribed procedures and standards, or contravention of applicable legal requirements. Revocation requires a reasonable opportunity to show cause. Where reasonable cause exists for revocation, the licence may be suspended pending inquiry; suspension beyond ten days also requires such opportunity. No electronic signature certificates may be issued during suspension.

Licensing of Certifying Authorities requires the Controller to consider the documents accompanying a licence application and other appropriate factors before granting or rejecting it. Rejection is subject to procedural fairness, and cannot occur unless the applicant has been given a reasonable opportunity to present its case.

Renewal of a Certifying Authority licence requires an application in the prescribed form, accompanied by the prescribed fee subject to a maximum of five thousand rupees, and filed at least forty-five days before expiry of the licence validity period. The Central Government prescribes the applicable form and fee within that limit.

Applications for a licence must be made in the form prescribed by the Central Government and accompanied by a certification practice statement, applicant-identification procedures, the prescribed fee subject to the statutory ceiling, and other prescribed documents.

Licensing for the issuance of electronic signature Certificates is available upon application to the Controller, subject to prescribed eligibility requirements. Applicants must meet standards relating to qualifications, expertise, manpower, financial resources and infrastructure. Licences are valid for the prescribed period, are not transferable or heritable, and remain subject to regulatory conditions.

Section 20 concerning the Controller's role as repository for Digital Signature Certificates was omitted with effect from 27 October 2009. Before omission, the Controller was required to retain issued Digital Signature Certificates, use secure systems and procedures against intrusion and misuse, comply with prescribed security standards, and maintain a computerised database of public keys accessible to the public.

Recognition of foreign Certifying Authorities is subject to regulatory conditions and restrictions, prior governmental approval, and notification in the Official Gazette. A recognised foreign Certifying Authority may function for statutory purposes, and its electronic signature Certificates are valid for those purposes. Recognition may be revoked upon contravention of attached conditions or restrictions, provided written reasons are recorded and revocation is notified in the Official Gazette.

Section 18 empowers the Controller to supervise Certifying Authorities, certify public keys, prescribe operational standards, and regulate their business conditions, employee qualifications, electronic signature Certificates, advertising materials, accounts, and auditors. The Controller may regulate electronic systems and subscriber dealings, resolve conflicts of interest, lay down duties, and maintain a publicly accessible database of prescribed disclosure records for every Certifying Authority.

Section 17 empowers the Central Government to appoint a Controller of Certifying Authorities, along with Deputy Controllers, Assistant Controllers, officers and employees, through notification in the Official Gazette. The Controller functions under governmental control and direction, while Deputy and Assistant Controllers perform assigned functions under the Controller's superintendence. Service qualifications and conditions are prescribed by the Central Government, which also determines the locations of head and branch offices. The Office of the Controller is required to have a seal.

Security procedures and practices for secure electronic records and secure electronic signatures may be prescribed for the purposes of sections 14 and 15. Their formulation must take account of commercial circumstances, the nature of relevant transactions, and other related factors considered appropriate, linking electronic security measures to transaction-specific operational conditions.

An electronic signature is secure where its signature creation data is exclusively controlled by the signatory when affixed, and is stored and affixed in the prescribed exclusively controlled manner. In relation to a digital signature, signature creation data means the subscriber's private key.

An electronic record is deemed a secure electronic record when a security procedure is applied at a specific point in time. Its secure status begins from that point and continues until verification, linking the legal character of the record to the application and verification of the security procedure.

Despatch occurs when an electronic record enters a computer resource outside the originator's control. Where the addressee has designated a computer resource, receipt occurs on entry into that resource; where the record is sent to another computer resource of the addressee, receipt occurs upon retrieval. Electronic records are deemed dispatched at the originator's place of business and received at the addressee's place of business, irrespective of the physical location of the computer resource.

Acknowledgment of receipt of an electronic record may be given through any communication from the addressee or conduct indicating receipt where no particular form or method is stipulated. If acknowledgment is a condition for the record to be binding, non-receipt causes it to be deemed never sent. Otherwise, after notice of non-receipt and expiry of a reasonable specified period without acknowledgment, the originator may treat the record as never sent.

Attribution of electronic records to an originator arises where the record is sent personally by the originator, by a person authorised to act on the originator's behalf, or through an information system programmed by or for the originator to operate automatically. These modes allow the record to be treated as originating from that originator.

Rules governing electronic signatures may prescribe their type, the manner and format for affixing them, and procedures facilitating identification of the person affixing them. Rulemaking may also establish control processes and procedures to ensure the integrity, security and confidentiality of electronic records or payments, together with any other matter necessary to give electronic signatures legal effect.

Section 9 denies any person a right to compel government ministries, departments, or bodies established, controlled or funded by government to accept, issue, create, retain or preserve documents as electronic records, or to conduct monetary transactions electronically. Electronic-governance provisions therefore do not impose mandatory electronic acceptance or processing obligations on those public bodies.