Section 40A establishes duties of a subscriber in relation to an Electronic Signature Certificate. The subscriber's obligations are subject to prescribed requirements, with the particular duties to be specified through such prescription rather than set out within section 40A itself.

Section 36 adds requirements for the relationship between a subscriber's private key and the public key listed in a digital signature certificate. The subscriber must hold a private key capable of creating a digital signature, while the listed public key must be capable of verifying a signature created through that private key.

Section 17 modifies sub-section (4) of section 35 of the Information Technology Act, 2000. It omits the first proviso and replaces "Provided further" with "Provided" in the second proviso, aligning the remaining proviso's introductory language with its position after the omission.

Section 16 amends section 34(1)(a) of the Information Technology Act, 2000 by omitting wording describing a certificate as containing the public key corresponding to the private key used by a Certifying Authority to digitally sign another Digital Signature Certificate. The specified public-key content requirement is thereby removed from the clause.

Section 30 is amended by removing the conjunction after the existing function in clause (c) and inserting functions for maintaining a repository of all Electronic Signature Certificates issued under the Information Technology Act, 2000, and publishing information on certificate practices, certificates, and their current status. The changes establish centralised certificate recordkeeping and public availability of current certificate-related information.

Section 29(1) is amended by replacing the reference to contraventions of the Act, rules and regulations made under it with a reference confined to contraventions of the relevant Chapter. The provision's scope is thereby anchored to contraventions within that Chapter rather than contraventions under the Act generally or under subordinate rules and regulations.

The Information Technology (Amendment) Act, 2008 omits section 20 from the Information Technology Act, 2000. The amendment is confined to deletion of that provision and does not specify a replacement provision, qualification, transitional arrangement, or separate operative mechanism. The legal change consists solely of the omission of section 20 from the principal Act.

Section 17 of the Information Technology Act, 2000 is amended in subsections (1) and (4) to include other officers and employees alongside Assistant Controllers. The amendment broadens the statutory personnel categories expressly covered by the relevant wording in both subsections while retaining Assistant Controllers within those provisions.

Secure electronic signatures require signature-creation data to be under the signatory's exclusive control when the signature is affixed and to be stored and used in the prescribed exclusive manner. In digital signatures, such data is the subscriber's private key. The Central Government may prescribe security procedures and practices for secure electronic records and signatures, having regard to commercial circumstances, transaction nature and related factors.

Section 12(1) of the Information Technology Act, 2000 replaces the phrase "agreed with the addressee" with "stipulated", altering the wording governing the relevant condition under that provision.

Section 10A establishes that contracts are not unenforceable solely because proposals, acceptances, or their revocations are communicated electronically or through electronic records. It applies at the contract-formation stage to communications of proposals, acceptances, and revocations of proposals or acceptances, recognising electronic form and electronic-record means as legally valid for those purposes.

Electronic records audit is brought within the scope of any existing legal requirement for the audit of documents, records or information. Audit provisions under any law in force apply to documents, records and information processed and maintained in electronic form.

Section 6A authorises the appropriate Government to permit service providers to establish, maintain and upgrade computerised facilities and deliver notified public services through electronic means. Providers may include individuals, private entities, firms and other permitted agencies. Authorised providers may collect, retain and appropriate prescribed service charges from users, including where no express provision otherwise permits e-service charges. The appropriate Government must notify the applicable charge scale and may prescribe different scales for different service categories.

Section 3A permits authentication of electronic records through reliable electronic signatures or authentication techniques specified in the Second Schedule. Reliability depends on exclusive linkage and control of signature-creation or authentication data, detectability of alterations to signatures and authenticated information, and fulfilment of prescribed conditions. A verification procedure may be prescribed, and only reliable signatures or techniques may be added to the Second Schedule through Official Gazette notification.

Chapter II of the Information Technology Act, 2000 is retitled "Digital Signature and Electronic Signature", replacing its earlier heading through section 5 of the Information Technology (Amendment) Act, 2008.

Definitions are expanded to cover communication devices, interconnected computer networks, cyber cafes, cyber security, electronic signatures and Electronic Signature Certificates. Cyber security includes protection against unauthorised access, use, disclosure, disruption, modification or destruction. Electronic records include messages, and intermediaries include persons handling electronic records for others or providing related services, including telecom, internet, hosting, search, payment, auction, marketplace and cyber cafe services.

Section 1 excludes documents and transactions listed in the First Schedule from the application of the Information Technology Act, 2000. The Central Government may add or delete Schedule entries through notification in the Official Gazette, and each notification must be laid before both Houses of Parliament.

Section 2 replaces "digital signature" with "electronic signature" in identified provisions of the Information Technology Act, 2000. The substitution applies to specified clauses, sections, sub-sections, marginal headings, and chapter headings, including definition clauses, sections 5, 6, 10, 18, 19, 21, 25, 30, 34, 35, 64, 71, 73 and 74, Chapters V and VII, and specified clauses in section 87.

Information Technology (Amendment) Act, 2008 further amends the Information Technology Act, 2000. Commencement depends on a Central Government notification in the Official Gazette, and different provisions may take effect on different dates. References to commencement within a provision operate by reference to the effective date of that particular provision. Commencement was appointed from 27 October 2009.

Information Technology (Certifying Authorities) (Amendment) Rules, 2003 require a performance bond in the form of a banker's guarantee, replacing references that treated a performance bond and banker's guarantee as alternatives. The amendments reduce the prescribed security amounts under rule 8(2) and its proviso, revise rule 14(2) and Schedule I terminology, and take effect upon publication in the Official Gazette.