Applications for a licence must be made in the form prescribed by the Central Government and accompanied by a certification practice statement, applicant-identification procedures, the prescribed fee subject to the statutory ceiling, and other prescribed documents.

Licensing for the issuance of electronic signature Certificates is available upon application to the Controller, subject to prescribed eligibility requirements. Applicants must meet standards relating to qualifications, expertise, manpower, financial resources and infrastructure. Licences are valid for the prescribed period, are not transferable or heritable, and remain subject to regulatory conditions.

Section 20 concerning the Controller's role as repository for Digital Signature Certificates was omitted with effect from 27 October 2009. Before omission, the Controller was required to retain issued Digital Signature Certificates, use secure systems and procedures against intrusion and misuse, comply with prescribed security standards, and maintain a computerised database of public keys accessible to the public.

Recognition of foreign Certifying Authorities is subject to regulatory conditions and restrictions, prior governmental approval, and notification in the Official Gazette. A recognised foreign Certifying Authority may function for statutory purposes, and its electronic signature Certificates are valid for those purposes. Recognition may be revoked upon contravention of attached conditions or restrictions, provided written reasons are recorded and revocation is notified in the Official Gazette.

Section 18 empowers the Controller to supervise Certifying Authorities, certify public keys, prescribe operational standards, and regulate their business conditions, employee qualifications, electronic signature Certificates, advertising materials, accounts, and auditors. The Controller may regulate electronic systems and subscriber dealings, resolve conflicts of interest, lay down duties, and maintain a publicly accessible database of prescribed disclosure records for every Certifying Authority.

Section 17 empowers the Central Government to appoint a Controller of Certifying Authorities, along with Deputy Controllers, Assistant Controllers, officers and employees, through notification in the Official Gazette. The Controller functions under governmental control and direction, while Deputy and Assistant Controllers perform assigned functions under the Controller's superintendence. Service qualifications and conditions are prescribed by the Central Government, which also determines the locations of head and branch offices. The Office of the Controller is required to have a seal.

Security procedures and practices for secure electronic records and secure electronic signatures may be prescribed by the Central Government for the purposes of sections 14 and 15. Prescribing such measures requires regard to commercial circumstances, the nature of transactions, and other related factors considered appropriate.

Section 15 deems an electronic signature secure where signature creation data is exclusively controlled by the signatory at the time of signing and is stored and affixed in the prescribed exclusively controlled manner. In relation to a digital signature, the signature creation data is the subscriber's private key. The earlier framework for secure digital signatures also required uniqueness, subscriber identification, exclusive control, and linkage to the electronic record ensuring invalidation upon alteration.

An electronic record is deemed a secure electronic record when a security procedure is applied at a specific point in time. Its secure status continues from the time of application until verification. Chapter V addresses secure electronic records and secure electronic signatures, replacing the earlier reference to digital signatures.

Despatch occurs when an electronic record enters a computer resource outside the originator's control. Receipt depends on whether the addressee has designated a computer resource: entry into the designated resource constitutes receipt, while a record sent to an undesignated resource is received upon retrieval. Electronic records are deemed despatched and received at the respective parties' places of business, irrespective of the computer resource's physical location.

Section 12 permits acknowledgment of electronic records through any communication or conduct indicating receipt where no particular form or method is stipulated. If binding effect is expressly conditional on acknowledgment, non-receipt means the record is treated as never sent. Otherwise, after the specified, agreed, or reasonable time, the originator may issue notice, allow a reasonable further period, and treat the unacknowledged record as never sent if acknowledgment is still not received.

Attribution of electronic records to an originator arises where the record is sent personally by the originator, by a person authorised to act on the originator's behalf, or through an information system programmed by or for the originator to operate automatically. These modes allow the record to be treated as originating from that originator.

Electronic signature rule-making authority permits prescription of signature types, methods and formats of affixation, and procedures for identifying the signatory. It also permits control processes and procedures for maintaining the integrity, security and confidentiality of electronic records and payments, along with other matters required to give legal effect to electronic signatures.

Section 9 denies any person a right to compel government ministries, departments, or bodies established, controlled or funded by government to accept, issue, create, retain or preserve documents as electronic records, or to conduct monetary transactions electronically. Electronic-governance provisions therefore do not impose mandatory electronic acceptance or processing obligations on those public bodies.

Electronic Gazette publication is deemed to satisfy a legal requirement to publish a rule, regulation, order, bye-law, notification, or other matter in the Official Gazette. Where publication is made in the Official Gazette or Electronic Gazette, the legally deemed publication date is the date of the Gazette first published in any form. The earliest Gazette publication therefore determines the operative publication date where more than one Gazette form is used.

Retention requirements for documents, records or information are met through electronic form where the information remains accessible for later use, the record is preserved in its original or an accurately demonstrable equivalent format, and origin, destination, despatch and receipt details are available. Automatically generated information used only to enable despatch or receipt is excluded from the identifying-details requirement. The mechanism does not apply where a law expressly requires retention in electronic-record form.

Electronic governance allows prescribed electronic forms to satisfy statutory requirements for filing documents with government-controlled bodies, issuing licences or approvals, and receiving or making payments, notwithstanding contrary legal requirements. Appropriate Government may prescribe by rules the manner and format for filing, creating or issuing electronic records, as well as methods for paying related fees or charges.

Electronic signatures satisfy legal requirements for authentication, signing, or bearing a person's signature where affixed in the manner prescribed by the Central Government. "Signed" and related expressions include affixing a handwritten signature or any mark on a document, and "signature" is construed correspondingly. The terminology "electronic signatures" replaced "digital signature" through the 2008 amendment.

Legal recognition is granted to electronic records where any law requires information or other matters to be in writing, typewritten, or printed form. The requirement is satisfied if the information is rendered or made available electronically and is accessible for subsequent reference.

Section 3 permits a subscriber to authenticate an electronic record by affixing a digital signature. Authentication uses an asymmetric cryptosystem and hash function that transforms the initial electronic record. The hash function must consistently produce the same hash result for the same input while making reconstruction of the original record and matching results for two records computationally infeasible. Any person may verify the record using the subscriber's public key, which, with the unique private key, forms a functioning key pair.