Section 38 IT Act: Revocation of Digital Signature Certificate
Information Technology Act, 2000
Section 38 IT Act at a Glance
Section 38 IT Act lists when a Certifying Authority may revoke a Digital Signature Certificate issued by that Certifying Authority. Revocation requires giving the subscriber a prior opportunity of being heard and communicating the revocation to the subscriber.
Section 38 IT Act Bare Act Text
38. Revocation of Digital Signature Certificate.
(1) A Certifying Authority may revoke a Digital Signature Certificate issued by it—
(a) where the subscriber or any other person authorised by him makes a request to that effect; or
(b) upon the death of the subscriber; or
(c) upon the dissolution of the firm or winding up of the company where the subscriber is a firm or a company.
(2) Subject to the provisions of sub-section (3) and without prejudice to the provisions of sub-section (1), a Certifying Authority may revoke a Digital Signature Certificate which has been issued by it at any time, if it is of opinion that—
(a) a material fact represented in the Digital Signature Certificate is false or has been concealed;
(b) a requirement for issuance of the Digital Signature Certificate was not satisfied;
(c) the Certifying Authority's private key or security system was compromised in a manner materially affecting the Digital Signature Certificate's reliability;
(d) the subscriber has been declared insolvent or dead or where a subscriber is a firm or a company, which has been dissolved, wound-up or otherwise ceased to exist.
(3) A Digital Signature Certificate shall not be revoked unless the subscriber has been given an opportunity of being heard in the matter.
(4) On revocation of a Digital Signature Certificate under this section, the Certifying Authority shall communicate the same to the subscriber.
Section 38 IT Act in Simple Words
Section 38 IT Act sets out when and how a Certifying Authority may revoke a Digital Signature Certificate issued by that Certifying Authority. Under Section 38(1) IT Act, the Certifying Authority may revoke the certificate in three situations: when the subscriber or a person authorised by the subscriber requests revocation, upon the subscriber's death, or, where the subscriber is a firm or a company, upon the dissolution of the firm or the winding up of the company.
Under Section 38(2) IT Act, without prejudice to (meaning without limiting) Section 38(1) IT Act and subject to Section 38(3) IT Act, the Certifying Authority may also revoke a Digital Signature Certificate issued by it at any time if the Certifying Authority forms a specific opinion. Those grounds are: (a) a material fact stated in the Digital Signature Certificate is false or has been concealed; (b) a requirement for issuing the certificate was not satisfied; (c) the Certifying Authority's private key or security system was compromised in a manner that materially affects the certificate's reliability; or (d) the subscriber has been declared insolvent or dead, or a firm or company subscriber has been dissolved, wound up, or has otherwise ceased to exist.
Section 38(3) IT Act sets a mandatory safeguard before revocation. A Digital Signature Certificate must not be revoked unless the subscriber has been given an opportunity of being heard (a chance to present the subscriber's case) in the matter. Under Section 38(4) IT Act, once the Certifying Authority revokes a Digital Signature Certificate under Section 38 IT Act, the Certifying Authority must communicate that revocation to the subscriber.
While Section 37 IT Act deals with suspending a Digital Signature Certificate, Section 38 IT Act governs revoking it. Once a Digital Signature Certificate is revoked under Section 38 IT Act, Section 39 IT Act also requires the Certifying Authority to publish a notice of revocation in every repository specified in the certificate.
When Section 38 IT Act Applies
- The Digital Signature Certificate was issued by the Certifying Authority taking revocation action.
- A ground under Section 38(1) IT Act exists (request by the subscriber or an authorised person, death of the subscriber, or dissolution or winding up of a firm or company subscriber) or the Certifying Authority holds an opinion on a ground under Section 38(2) IT Act (false or concealed material fact, unmet issuance requirement, compromise materially affecting certificate reliability, or insolvency, death, dissolution, winding up, or cessation of existence).
- The subscriber is given an opportunity of being heard in the matter before the Digital Signature Certificate is revoked (Section 38(3) IT Act).
- The Certifying Authority exercises its power to revoke the Digital Signature Certificate.
- Upon revocation, the Certifying Authority communicates the revocation to the subscriber (Section 38(4) IT Act).
Example of Section 38 IT Act
When Section 38 IT Act Does Not Apply
- A Digital Signature Certificate cannot be revoked under Section 38 IT Act unless the subscriber has been given an opportunity of being heard in the matter (Section 38(3) IT Act).
FAQs on Section 38 IT Act
What is Section 38 IT Act?▼
Section 38 IT Act sets out the grounds and procedure for a Certifying Authority to revoke a Digital Signature Certificate issued by that Certifying Authority. Section 38 IT Act requires giving the subscriber an opportunity of being heard before revocation and communicating the revocation to the subscriber afterward.
Can a subscriber ask the Certifying Authority to revoke a Digital Signature Certificate under Section 38 IT Act?▼
Yes. Under Section 38(1)(a) IT Act, a Certifying Authority may revoke a Digital Signature Certificate when the subscriber, or another person authorised by the subscriber, makes a request for revocation.
Can a Certifying Authority revoke a Digital Signature Certificate under Section 38 IT Act without hearing the subscriber?▼
No. Section 38(3) IT Act states that a Digital Signature Certificate must not be revoked unless the subscriber has been given an opportunity of being heard in the matter.
Does a minor security incident at a Certifying Authority allow revocation under Section 38(2)(c) IT Act?▼
No. Section 38(2)(c) IT Act applies when the Certifying Authority is of the opinion that its private key or security system was compromised in a manner materially affecting the Digital Signature Certificate's reliability.
Must the Certifying Authority inform the subscriber after revoking a Digital Signature Certificate under Section 38 IT Act?▼
Yes. Under Section 38(4) IT Act, on revoking a Digital Signature Certificate, the Certifying Authority must communicate the revocation to the subscriber.
Have questions about Section 38 IT Act?
Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.
Ask NyayGuru →Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.
Sources: Bare Act Text, Information Technology Act, 2000 ·