Section 30 IT Act: Certifying Authority to follow certain procedures

Information Technology Act, 2000

Section 30 IT Act at a Glance

Section 30 IT Act sets mandatory security, reliability, storage, and disclosure procedures for every Certifying Authority. Each Certifying Authority must use secure systems, protect electronic signature secrecy and privacy, act as a certificate repository, publish certificate status, and follow regulations.

Section 30 IT Act Bare Act Text

30. Certifying Authority to follow certain procedures.
Every Certifying Authority shall,—
(a) make use of hardware, software and procedures that are secure from intrusion and misuse;
(b) provide a reasonable level of reliability in its services which are reasonably suited to the performance of intended functions;
(c) adhere to security procedures to ensure that the secrecy and privacy of the electronic signatures are assured; ***
(ca) be the repository of all electronic signature Certificates issued under this Act;
(cb) publish information regarding its practices, electronic signature Certificates and current status of such certificates; and
(d) observe such other standards as may be specified by regulations.

Amendments to this section

Subs. by Act 10 of 2009, s. 2, for "digital signature" (w.e.f. 27-10-2009).
The word "and" omitted by s. 15, ibid. (w.e.f. 27-10-2009).
Ins. by s. 15, ibid. (w.e.f. 27-10-2009).

Section 30 IT Act in Simple Words

Section 30 IT Act lists the mandatory technical, security, and transparency procedures that every Certifying Authority must follow under Chapter VI of the IT Act.

The first three duties focus on system security and service quality. Under Section 30(a) IT Act, a Certifying Authority must use hardware, software, and procedures that are secure from intrusion and misuse. Under Section 30(b) IT Act, it must provide a reasonable level of reliability in its services, reasonably suited to performing intended functions. Under Section 30(c) IT Act, it must follow security procedures that assure the secrecy and privacy of electronic signatures.

The remaining duties cover certificate storage, public disclosure, and regulatory standards. Under Section 30(ca) IT Act, a Certifying Authority must act as the repository (central record store) of all electronic signature Certificates issued under the IT Act. Under Section 30(cb) IT Act, it must publish information about its practices, electronic signature Certificates, and the current status of those certificates. Under Section 30(d) IT Act, it must also observe any other standards specified by regulations.

Section 30 IT Act was amended by Act 10 of 2009 with effect from 27 October 2009. Within Chapter VI, Section 29 IT Act empowers searches when a Chapter VI contravention is reasonably suspected, and Section 31 IT Act requires a Certifying Authority to ensure compliance by people it employs or engages.

When Section 30 IT Act Applies

Use hardware, software, and procedures that are secure from intrusion and misuse (Section 30(a) IT Act).
Provide a reasonable level of reliability in services, reasonably suited to performing intended functions (Section 30(b) IT Act).
Adhere to security procedures so that the secrecy and privacy of electronic signatures are assured (Section 30(c) IT Act).
Act as the repository of all electronic signature Certificates issued under the IT Act (Section 30(ca) IT Act).
Publish information regarding practices, electronic signature Certificates, and the current status of those certificates (Section 30(cb) IT Act).
Observe any other standards specified by regulations (Section 30(d) IT Act).

Example of Section 30 IT Act

A licensed Certifying Authority operating in Dibrugarh issues electronic signature Certificates under the IT Act. To comply with Section 30 IT Act, the Certifying Authority runs hardware, software, and procedures hardened against intrusion and misuse, delivers reliable services suited to intended functions, and enforces security steps that protect the secrecy and privacy of electronic signatures. The Certifying Authority also maintains the repository of electronic signature Certificates issued under the IT Act and publishes its operating practices, electronic signature Certificates, and the current status of those certificates online, alongside meeting other standards set by regulations. When Aparna in Dibrugarh checks whether a certificate remains active, the published status record required by Section 30(cb) IT Act lets Aparna see its current status.

FAQs on Section 30 IT Act

What is Section 30 IT Act?▼

Section 30 IT Act sets out six mandatory procedures and standards that every Certifying Authority must follow. These duties cover secure hardware and software, reliable services, secrecy and privacy of electronic signatures, acting as a certificate repository, publishing practices and certificate status, and following standards set by regulations.

Must a Certifying Authority publish the current status of electronic signature Certificates under Section 30 IT Act?▼

Yes. Under Section 30(cb) IT Act, every Certifying Authority must publish information regarding its practices, electronic signature Certificates, and the current status of those certificates.

What security duties does Section 30 IT Act place on a Certifying Authority?▼

Secure systems and signature privacy protection. Under Section 30(a) IT Act, the Certifying Authority must use hardware, software, and procedures secure from intrusion and misuse, and under Section 30(c) IT Act, it must follow security procedures that assure the secrecy and privacy of electronic signatures.

Can regulations add more standards for Certifying Authorities under Section 30 IT Act?▼

Yes. Under Section 30(d) IT Act, every Certifying Authority must observe such other standards as may be specified by regulations.

Have questions about Section 30 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·