Licensing for issuing electronic signature Certificates requires an application to the Controller and satisfaction of prescribed qualifications, expertise, manpower, financial resources and infrastructure requirements. A licence remains valid for the prescribed period, cannot be transferred or inherited, and operates subject to regulatory terms and conditions.

Section 20 was omitted, removing the statutory framework under which the Controller served as repository for all Digital Signature Certificates. Before omission, the Controller was required to use secure hardware, software and procedures, observe prescribed standards protecting digital-signature secrecy and security, maintain a computerised database of public keys, and make that database and the public keys available to the public.

Recognition of foreign Certifying Authorities may be granted by the Controller, subject to regulatory conditions and restrictions, prior Central Government approval, and publication in the Official Gazette. Electronic signature certificates issued by a recognised foreign Certifying Authority are valid for statutory purposes. Recognition may be revoked where the Certifying Authority contravenes applicable conditions or restrictions, provided reasons are recorded in writing and the revocation is published in the Official Gazette.

Controller oversight of Certifying Authorities includes supervision, public-key certification, operational standards, employee qualifications, business conditions, electronic signature certificate requirements, account maintenance, and auditor conditions. The Controller may regulate electronic systems, prescribe dealings with subscribers, resolve conflicts of interest, define duties, and maintain a publicly accessible database of disclosure records. References to digital signatures have been replaced with electronic signatures.

Section 17 provides for appointment of a Controller of Certifying Authorities, Deputy Controllers, Assistant Controllers, other officers and employees through Official Gazette notification. The Controller acts under the general control and directions of the Central Government, and subordinate Controllers perform assigned functions under the Controller's superintendence and control. The Central Government prescribes service conditions, specifies and establishes Head and Branch Offices, and the Office of the Controller must have an official seal.

Security procedures and practices for secure electronic records and secure electronic signatures may be prescribed by the Central Government for the purposes of sections 14 and 15. Prescribing such measures requires regard to commercial circumstances, the nature of transactions, and other related factors considered appropriate.

Section 15 deems an electronic signature secure where signature creation data is exclusively controlled by the signatory at the time of signing and is stored and affixed in the prescribed exclusively controlled manner. In relation to a digital signature, the signature creation data is the subscriber's private key. The earlier framework for secure digital signatures also required uniqueness, subscriber identification, exclusive control, and linkage to the electronic record ensuring invalidation upon alteration.

An electronic record is deemed a secure electronic record when a security procedure is applied at a specific point in time. Its secure status continues from the time of application until verification. Chapter V addresses secure electronic records and secure electronic signatures, replacing the earlier reference to digital signatures.

Despatch occurs when an electronic record enters a computer resource outside the originator's control. Receipt depends on whether the addressee has designated a computer resource: entry into the designated resource constitutes receipt, while a record sent to an undesignated resource is received upon retrieval. Electronic records are deemed despatched and received at the respective parties' places of business, irrespective of the computer resource's physical location.

Section 12 permits acknowledgment of electronic records through any communication or conduct indicating receipt where no particular form or method is stipulated. If binding effect is expressly conditional on acknowledgment, non-receipt means the record is treated as never sent. Otherwise, after the specified, agreed, or reasonable time, the originator may issue notice, allow a reasonable further period, and treat the unacknowledged record as never sent if acknowledgment is still not received.

Attribution of electronic records to an originator arises where the record is sent personally by the originator, by a person authorised to act on the originator's behalf, or through an information system programmed by or for the originator to operate automatically. These modes allow the record to be treated as originating from that originator.

Electronic signature rule-making authority permits prescription of signature types, methods and formats of affixation, and procedures for identifying the signatory. It also permits control processes and procedures for maintaining the integrity, security and confidentiality of electronic records and payments, along with other matters required to give legal effect to electronic signatures.

Section 9 denies any person a right to compel government ministries, departments, or bodies established, controlled or funded by government to accept, issue, create, retain or preserve documents as electronic records, or to conduct monetary transactions electronically. Electronic-governance provisions therefore do not impose mandatory electronic acceptance or processing obligations on those public bodies.

Electronic Gazette publication is deemed to satisfy a legal requirement to publish a rule, regulation, order, bye-law, notification, or other matter in the Official Gazette. Where publication is made in the Official Gazette or Electronic Gazette, the legally deemed publication date is the date of the Gazette first published in any form. The earliest Gazette publication therefore determines the operative publication date where more than one Gazette form is used.

Retention requirements for documents, records or information are met through electronic form where the information remains accessible for later use, the record is preserved in its original or an accurately demonstrable equivalent format, and origin, destination, despatch and receipt details are available. Automatically generated information used only to enable despatch or receipt is excluded from the identifying-details requirement. The mechanism does not apply where a law expressly requires retention in electronic-record form.

Electronic governance allows prescribed electronic forms to satisfy statutory requirements for filing documents with government-controlled bodies, issuing licences or approvals, and receiving or making payments, notwithstanding contrary legal requirements. Appropriate Government may prescribe by rules the manner and format for filing, creating or issuing electronic records, as well as methods for paying related fees or charges.

Electronic signatures satisfy legal requirements for authentication, signing, or bearing a person's signature where affixed in the manner prescribed by the Central Government. "Signed" and related expressions include affixing a handwritten signature or any mark on a document, and "signature" is construed correspondingly. The terminology "electronic signatures" replaced "digital signature" through the 2008 amendment.

Legal recognition is granted to electronic records where any law requires information or other matters to be in writing, typewritten, or printed form. The requirement is satisfied if the information is rendered or made available electronically and is accessible for subsequent reference.

Section 3 permits a subscriber to authenticate an electronic record by affixing a digital signature. Authentication uses an asymmetric cryptosystem and hash function that transforms the initial electronic record. The hash function must consistently produce the same hash result for the same input while making reconstruction of the original record and matching results for two records computationally infeasible. Any person may verify the record using the subscriber's public key, which, with the unique private key, forms a functioning key pair.

GST liability of airport duty-free shops and the mechanism for refunding GST paid by an airport authority to the Department require clarification in light of a Supreme Court decision concerning non-imposition of indirect tax on such shops. Assistance and instructions have been sought on these issues, which remain listed for further hearing.