Section 18 empowers the Controller to supervise Certifying Authorities, certify public keys, prescribe operational standards, and regulate their business conditions, employee qualifications, electronic signature Certificates, advertising materials, accounts, and auditors. The Controller may regulate electronic systems and subscriber dealings, resolve conflicts of interest, lay down duties, and maintain a publicly accessible database of prescribed disclosure records for every Certifying Authority.

Section 17 empowers the Central Government to appoint a Controller of Certifying Authorities, along with Deputy Controllers, Assistant Controllers, officers and employees, through notification in the Official Gazette. The Controller functions under governmental control and direction, while Deputy and Assistant Controllers perform assigned functions under the Controller's superintendence. Service qualifications and conditions are prescribed by the Central Government, which also determines the locations of head and branch offices. The Office of the Controller is required to have a seal.

Security procedures and practices for secure electronic records and secure electronic signatures may be prescribed for the purposes of sections 14 and 15. Their formulation must take account of commercial circumstances, the nature of relevant transactions, and other related factors considered appropriate, linking electronic security measures to transaction-specific operational conditions.

An electronic signature is secure where its signature creation data is exclusively controlled by the signatory when affixed, and is stored and affixed in the prescribed exclusively controlled manner. In relation to a digital signature, signature creation data means the subscriber's private key.

Secure electronic record status attaches where a security procedure is applied to an electronic record at a specific point in time. The record is deemed secure from that point until verification, defining the temporal period during which the secure-record classification operates. The classification is linked to application of the security procedure and its continuation until verification.

Despatch occurs when an electronic record enters a computer resource outside the originator's control. Where the addressee has designated a computer resource, receipt occurs on entry into that resource; where the record is sent to another computer resource of the addressee, receipt occurs upon retrieval. Electronic records are deemed dispatched at the originator's place of business and received at the addressee's place of business, irrespective of the physical location of the computer resource.

Where the originator makes receipt of acknowledgment a condition for the electronic record to be binding, failure to receive acknowledgment results in the record being deemed never sent. Where no such condition is stipulated, the originator may, after non-receipt within the applicable period, notify the addressee and prescribe a reasonable further period. If acknowledgment remains outstanding, the originator may treat the electronic record as never sent.

Attribution of an electronic record to its originator arises where the originator personally sends it, where it is sent by a person authorised to act for the originator in relation to that record, or where an information system programmed by or for the originator automatically transmits it.

Central Government may prescribe electronic signature types, affixing methods and formats, and procedures to identify the signatory. Its rule-making power also covers control processes and procedures ensuring the integrity, security and confidentiality of electronic records or payments, as well as any other matter necessary to give electronic signatures legal effect.

Section 9 does not give any person a right to compel a Ministry, government department, statutory authority, or government-controlled or funded body to accept, issue, create, retain, or preserve documents as electronic records, or to conduct monetary transactions electronically. Electronic governance provisions operate without mandatory electronic acceptance or transaction obligations.

Electronic Gazette publication satisfies a legal requirement for publication in the Official Gazette. Rules, regulations, orders, bye-laws, notifications and other matters may be published in either the Official Gazette or the Electronic Gazette. The deemed publication date is the date of the Gazette first published in any form.

Electronic retention satisfies a statutory retention requirement where information remains accessible for subsequent reference, is preserved in its original or accurately reproducible format, and includes details identifying its origin, destination, and despatch or receipt timing. Automatically generated transmission information is excluded from the identification-details requirement. The framework does not apply where a law expressly provides for retention in electronic-record form.

Electronic governance treats statutory requirements for government filings, issuance of licences or approvals, and receipt or payment of money as satisfied when undertaken through electronic forms prescribed by the appropriate Government. The appropriate Government may prescribe rules on the manner and format for filing, creating or issuing electronic records, and on payment methods for related fees or charges.

Section 5 grants legal recognition to electronic signatures for statutory authentication and signing requirements. A legal requirement that information be authenticated by signature, or that a document be signed or bear a person's signature, is deemed satisfied where an electronic signature is affixed in the manner prescribed by the Central Government. "Signed" includes a handwritten signature or any mark on a document. References to digital signature were replaced with electronic signature.

Legal recognition is accorded to electronic records where a legal requirement calls for information or other matter to be in writing or in typewritten or printed form. That requirement is treated as satisfied when the information or matter is rendered or made available electronically and is accessible for use in a subsequent reference.

Electronic-record authentication permits a subscriber to authenticate an electronic record by affixing a digital signature. Authentication is effected through an asymmetric cryptographic system and a hash function. The hash function must consistently generate the same hash result for the same input and make reconstruction of the original record or generation of identical results for two records computationally infeasible. Verification may be performed using the subscriber's public key, which, together with the unique private key, forms a functioning key pair.

GST liability of airport duty-free shops and the mechanism for refunding GST paid by an airport authority to the Department require clarification in light of a Supreme Court decision concerning non-imposition of indirect tax on such shops. Assistance and instructions have been sought on these issues, which remain listed for further hearing.

Section 2 defines electronic records, computer resources, electronic signatures, digital signatures, certification arrangements, intermediaries and cyber security. Electronic authentication includes digital signatures created through a private key and verified through the corresponding public key, with verification addressing both signature origin and record integrity. Intermediaries include service providers that receive, store, transmit or provide services relating to electronic records. Cyber security protects information, devices and computer resources from unauthorised access, use, disclosure, disruption, modification or destruction, while secure systems must provide reliable operation and follow generally accepted security procedures.

Section 1 extends the Information Technology Act, 2000 throughout India and, unless otherwise provided, applies to offences or contraventions committed outside India by any person. Different provisions may commence on separate dates appointed by Central Government notification. Documents and transactions specified in the First Schedule are excluded from application, and the Central Government may amend that Schedule through Official Gazette notification subject to laying before both Houses of Parliament.

Inter-CFS movement of LCL export cargo from authorised originating CFSs to Allcargo Terminals Ltd. CFS is permitted after grant of a Let Export Order, with cargo moved in Customs-sealed containers for consolidation or assimilation and subsequent export. Each Shipping Bill must move in full; stuffing, sealing, document transfer, gate-out, unloading, de-stuffing, re-stuffing and final removal require Customs supervision, seal verification, endorsements and bond debits. Destination operations require tally records, shipment within 30 days, periodic reporting, safe custody and segregation of cargo. Custodians remain liable for losses, unlawful substitution and non-compliance.