Licensing for the issuance of electronic signature Certificates is available upon application to the Controller, subject to prescribed eligibility requirements. Applicants must meet standards relating to qualifications, expertise, manpower, financial resources and infrastructure. Licences are valid for the prescribed period, are not transferable or heritable, and remain subject to regulatory conditions.

Section 20 concerning the Controller's role as repository for Digital Signature Certificates was omitted with effect from 27 October 2009. Before omission, the Controller was required to retain issued Digital Signature Certificates, use secure systems and procedures against intrusion and misuse, comply with prescribed security standards, and maintain a computerised database of public keys accessible to the public.

Recognition of foreign Certifying Authorities is subject to regulatory conditions and restrictions, prior governmental approval, and notification in the Official Gazette. A recognised foreign Certifying Authority may function for statutory purposes, and its electronic signature Certificates are valid for those purposes. Recognition may be revoked upon contravention of attached conditions or restrictions, provided written reasons are recorded and revocation is notified in the Official Gazette.

Section 18 empowers the Controller to supervise Certifying Authorities, certify public keys, prescribe operational standards, and regulate their business conditions, employee qualifications, electronic signature Certificates, advertising materials, accounts, and auditors. The Controller may regulate electronic systems and subscriber dealings, resolve conflicts of interest, lay down duties, and maintain a publicly accessible database of prescribed disclosure records for every Certifying Authority.

Section 17 empowers the Central Government to appoint a Controller of Certifying Authorities, along with Deputy Controllers, Assistant Controllers, officers and employees, through notification in the Official Gazette. The Controller functions under governmental control and direction, while Deputy and Assistant Controllers perform assigned functions under the Controller's superintendence. Service qualifications and conditions are prescribed by the Central Government, which also determines the locations of head and branch offices. The Office of the Controller is required to have a seal.

Security procedures and practices may be prescribed for secure electronic records and secure electronic signatures, having regard to commercial circumstances, transaction nature, and other related factors considered appropriate. The earlier model additionally identified technological capacity, comparable transaction volume, rejected alternatives, alternative costs, and generally used procedures for similar transactions or communications.

Secure electronic signature status depends on signature creation data being under the signatory's exclusive control when the signature is affixed. The data must also be stored and affixed in the prescribed exclusively controlled manner. For digital signatures, signature creation data means the subscriber's private key.

An electronic record is deemed a secure electronic record when a security procedure is applied at a specific point in time. Its secure status begins from that point and continues until verification, linking the legal character of the record to the application and verification of the security procedure.

Despatch occurs when an electronic record enters a computer resource outside the originator's control. Receipt depends on whether the addressee has designated a computer resource: entry into the designated resource constitutes receipt, while a record sent to an undesignated resource is received upon retrieval. Electronic records are deemed despatched and received at the respective parties' places of business, irrespective of the computer resource's physical location.

Acknowledgment of receipt of an electronic record may be given through any communication from the addressee or conduct indicating receipt where no particular form or method is stipulated. If acknowledgment is a condition for the record to be binding, non-receipt causes it to be deemed never sent. Otherwise, after notice of non-receipt and expiry of a reasonable specified period without acknowledgment, the originator may treat the record as never sent.

Attribution of electronic records to an originator arises where the record is sent personally by the originator, by a person authorised to act on the originator's behalf, or through an information system programmed by or for the originator to operate automatically. These modes allow the record to be treated as originating from that originator.

Rules governing electronic signatures may prescribe their type, the manner and format for affixing them, and procedures facilitating identification of the person affixing them. Rulemaking may also establish control processes and procedures to ensure the integrity, security and confidentiality of electronic records or payments, together with any other matter necessary to give electronic signatures legal effect.

Section 9 denies any person a right to compel government ministries, departments, or bodies established, controlled or funded by government to accept, issue, create, retain or preserve documents as electronic records, or to conduct monetary transactions electronically. Electronic-governance provisions therefore do not impose mandatory electronic acceptance or processing obligations on those public bodies.

Electronic Gazette publication is deemed to satisfy a legal requirement to publish a rule, regulation, order, bye-law, notification, or other matter in the Official Gazette. Where publication is made in the Official Gazette or Electronic Gazette, the legally deemed publication date is the date of the Gazette first published in any form. The earliest Gazette publication therefore determines the operative publication date where more than one Gazette form is used.

Retention requirements for documents, records or information are met through electronic form where the information remains accessible for later use, the record is preserved in its original or an accurately demonstrable equivalent format, and origin, destination, despatch and receipt details are available. Automatically generated information used only to enable despatch or receipt is excluded from the identifying-details requirement. The mechanism does not apply where a law expressly requires retention in electronic-record form.

Section 6 treats prescribed electronic forms as satisfying legal requirements for government filings, licences, permits, sanctions, approvals, receipts and payments, notwithstanding contrary requirements under other applicable law. The appropriate Government may prescribe the manner and format for filing, creating or issuing electronic records, and may determine payment methods for related fees and charges.

Legal recognition of electronic signatures allows statutory authentication and signature requirements to be satisfied through an electronic signature affixed in the manner prescribed by the Central Government. The rule applies where information must be authenticated or a document must be signed or bear a signature. "Signed" includes a handwritten signature or any mark on a document, and "signature" is construed accordingly. Earlier references to digital signatures were replaced with electronic signatures by the 2008 amendment.

Legal recognition is granted to electronic records where any law requires information or other matters to be in writing, typewritten, or printed form. The requirement is satisfied if the information is rendered or made available electronically and is accessible for subsequent reference.

Authentication of electronic records may be undertaken by a subscriber by affixing a digital signature. Authentication is effected through an asymmetric cryptosystem and hash function. The hash function must consistently produce the same hash result for identical input, while making reconstruction of the original record and generation of matching results by different records computationally infeasible. An electronic record may be verified using the subscriber's public key, which, together with the unique private key, forms a functioning key pair.

GST liability of airport duty-free shops and the mechanism for refunding GST paid by an airport authority to the Department require clarification in light of a Supreme Court decision concerning non-imposition of indirect tax on such shops. Assistance and instructions have been sought on these issues, which remain listed for further hearing.