Section 15 IT Act: Secure electronic signature

Information Technology Act, 2000

Section 15 IT Act at a Glance

Section 15 IT Act states the two conditions under which an electronic signature is deemed a secure electronic signature, requiring exclusive control and prescribed storage and affixing of signature creation data.

Section 15 IT Act Bare Act Text

15. Secure electronic signature.

An electronic signature shall be deemed to be a secure electronic signature if—

(i) the signature creation data, at the time of affixing signature, was under the exclusive control of signatory and no other person; and

(ii) the signature creation data was stored and affixed in such exclusive manner as may be prescribed.

Explanation.—In case of digital signature, the “signature creation data” means the private key of the subscriber.

Amendments to this section
  • Subs. by s 11, ibid., for sections 15 and 16 (w.e.f. 27-10-2009).

Section 15 IT Act in Simple Words

Section 15 IT Act sets out when an electronic signature is deemed (treated by law) to be a secure electronic signature. Both conditions in Section 15 IT Act must be met together. Under clause (i), at the time of affixing the signature, the signature creation data must have been under the exclusive control of the signatory and no other person. Under clause (ii), the signature creation data must have been stored and affixed in such exclusive manner as may be prescribed.

The Explanation to Section 15 IT Act clarifies what "signature creation data" means in the specific case of a digital signature: for a digital signature, "signature creation data" means the private key of the subscriber.

Section 2 IT Act defines the Act's terms, while Section 14 IT Act covers secure electronic records and Section 16 IT Act deals with security procedures and practices for Sections 14 and 15 IT Act.

When Section 15 IT Act Applies

  • Exclusive control at the time of signing under Section 15(i) IT Act: the signature creation data, at the time of affixing the signature, was under the exclusive control of the signatory and no other person.
  • Prescribed exclusive storage and affixing under Section 15(ii) IT Act: the signature creation data was stored and affixed in such exclusive manner as may be prescribed.
  • Rule for digital signatures under the Explanation to Section 15 IT Act: in the case of a digital signature, 'signature creation data' means the private key of the subscriber.

Example of Section 15 IT Act

Farooq in Guwahati signs an electronic vendor contract using a digital signature whose private key is stored and affixed in the prescribed exclusive manner, while Farooq also shares access to that private key with an office assistant, Radhika, at the time of affixing the signature. When a dispute arises over whether Farooq's electronic signature qualifies as a secure electronic signature, the Explanation to Section 15 IT Act treats Farooq's private key as the signature creation data. Because Radhika also had access at the time of affixing the signature, the private key was not under the exclusive control of Farooq and no other person as required by Section 15(i) IT Act. As a result, Farooq's electronic signature is not deemed to be a secure electronic signature under Section 15 IT Act.

When Section 15 IT Act Does Not Apply

  • Shared control at the time of signing: under Section 15(i) IT Act, an electronic signature is not deemed a secure electronic signature if any person other than the signatory also had control over the signature creation data at the time of affixing the signature.
  • Non-prescribed storage or affixing: under Section 15(ii) IT Act, an electronic signature is not deemed a secure electronic signature if the signature creation data was not stored and affixed in the prescribed exclusive manner.

FAQs on Section 15 IT Act

What is Section 15 IT Act?▼

Section 15 IT Act states when an electronic signature counts in law as a secure electronic signature. Section 15 IT Act requires both exclusive control of the signature creation data by the signatory alone at the time of signing and storage and affixing of that data in the prescribed exclusive manner.

Must both clauses of Section 15 IT Act be met for a secure electronic signature?▼

Yes. Section 15 IT Act joins clause (i) and clause (ii) with 'and', so both exclusive control by the signatory at the time of signing and prescribed exclusive storage and affixing must be satisfied.

What does signature creation data mean for a digital signature under Section 15 IT Act?▼

The private key of the subscriber. The Explanation to Section 15 IT Act states that in the case of a digital signature, signature creation data means the private key of the subscriber.

Does an electronic signature qualify under Section 15 IT Act if an assistant also controls the private key at the time of signing?▼

No. Section 15(i) IT Act requires that the signature creation data, at the time of affixing the signature, be under the exclusive control of the signatory and no other person.

Which section deals with prescribing security procedures for Section 15 IT Act?▼

Section 16 IT Act. Section 16 IT Act covers security procedures and practices for the purposes of Section 14 and Section 15 IT Act.

Have questions about Section 15 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·