Section 87 IT Act: Power of Central Government to make rules

Information Technology Act, 2000

Section 87 IT Act at a Glance

Section 87 IT Act empowers the Central Government to make rules under the Act by notification in the Official Gazette and the Electronic Gazette. Every rule must be laid before each House of Parliament for a total of 30 days.

Section 87 IT Act Bare Act Text

87. Power of Central Government to make rules.

(1) The Central Government may, by notification in the Official Gazette and in the Electronic Gazette, make rules to carry out the provisions of this Act.

(2) In particular, and without prejudice to the generality of the foregoing power, such rules may provide for all or any of the following matters, namely:—

(a) the conditions for considering reliability of electronic signature or electronic authentication technique under sub-section (2) of section 3A;

(aa) the procedure for ascertaining electronic signature or authentication under sub-section (3) of section 3A;

(ab) the manner in which any information or matter may be authenticated by means of electronic signature under section 5;

(b) the electronic form in which filing, issue, grant or payment shall be effected under sub-section (1) of section 6;

(c) the manner and format in which electronic records shall be filed, or issued and the method of payment under sub-section (2) of section 6;

(ca) the manner in which the authorised service provider may collect, retain and appropriate service charges under sub-section (2) of section 6A;

(d) the matters relating to the type of electronic signature, manner and format in which it may be affixed under section 10;

(e) the manner of storing and affixing electronic signature creation data under section 15;

(ea) the security procedures and practices under section 16;

(f) the qualifications, experience and terms and conditions of service of Controller, Deputy Controllers , Assistant Controllers, other officers and employees under section 17;

***

(h) the requirements which an applicant must fulfil under sub-section (2) of section 21;

(i) the period of validity of licence granted under clause (a) of sub-section (3) of section 21;

(j) the form in which an application for licence may be made under sub-section (1) of section 22;

(k) the amount of fees payable under clause (c) of sub-section (2) of section 22;

(l) such other documents which shall accompany an application for licence under clause (d) of sub-section (2) of section 22;

(m) the form and the fee for renewal of a licence and the fee payable thereof under section 23;

(ma) the form of application and fee for issue of Electronic Signature Certificate under section 35;

(n) the form in which application for issue of a electronic signature Certificate may be made under sub-section (1) of section 35;

(o) the fee to be paid to the Certifying Authority for issue of a electronic signature Certificate under sub-section (2) of section 35;

(oa) the duties of subscribers under section 40A;

(ob) the reasonable security practices and procedures and sensitive personal data or information under section 43A;

(p) the manner in which the adjudicating officer shall hold inquiry under sub-section (1) of section 46;

(q) the qualification and experience which the adjudicating officer shall possess under sub-section (3) of section 46;

***

(u) the form in which appeal may be filed and the fee thereof under sub-section (3) of section 57;

(v) any other power of a civil court required to be prescribed under clause (g) of sub-section (2) of section 58; and

(w) the powers and functions of the Chairperson of the Appellate Tribunal under section 52A;

(x) the information, duration, manner and form of such information to be retained and preserved under section 67C;

(y) the procedures and safeguards for interception, monitoring or decryption under sub-section (2) of section 69A;

(z) the procedures and safeguards for blocking for access by the public under sub-section (3) of section 69 B;

(za) the procedure and safeguards for monitoring and collecting traffic data or information under sub-section (3) of section 69B;

(zb) the information security practices and procedures for protected system under section 70;

(zc) manner of performing functions and duties of the agency under sub-section (3) of section 70 A;

(zd) the officers and employees under sub-section (2) of section 70B;

(ze) salaries and allowances and terms and conditions of service of the Director General and other officers and employees under sub-section (3) of section 70B;

(zf) the manner in which the functions and duties of agency shall be performed under sub-section (5) of section 70B;

(zg) the guidelines to be observed by the intermediaries under sub-section (2) of section 79;

(zh) the modes or methods for encryption under section 84 A.

(3) Every notification made by the Central Government under sub-section (1) of section 70A and every rule made by it shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if, before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in *** the rule or both Houses agree that *** the rule should not be made, *** the rule shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that notification or rule.

Amendments to this section
  • Subs. by Act 10 of 2009, s. 46, for clause (a) (w.e.f. 27-10-2009).
  • Ins. by s. 46, ibid. (w.e.f. 27-10-2009).
  • Subs. by s. 2, ibid., for "digital signature" (w.e.f. 27-10-2009).
  • Subs. by s. 46, ibid., for clause (e) (w.e.f. 27-10-2009).
  • Subs. by s. 46, ibid., for "and Assistant Controllers" (w.e.f. 27-10-2009).
  • Clause (g) omitted by s. 46, ibid. (w.e.f. 27-10-2009).
  • Clauses (r), (s) and (t) omitted by Act 7 of 2017, s. 169 (w.e.f. 26-5-2017).
  • Subs. by Act 10 of 2009, s. 46, for clause (w) (w.e.f. 27-10-2009).
  • Subs. by Act 7 of 2017, s. 169, for "Cyber Appellate Tribunal"(w.e.f. 26-5-2017).
  • Subs. by Act 10 of 2009, s. 46, for certain words, brackets, letter and figures (w.e.f. 27-10-2009).
  • The words "the notification or" omitted by s. 46, ibid. (w.e.f. 27-10-2009).

Section 87 IT Act in Simple Words

Section 87 IT Act gives the Central Government the power to make rules to carry out the provisions of the Information Technology Act, 2000. Under Section 87(1) IT Act, the Central Government makes these rules by notification in both the Official Gazette and the Electronic Gazette. Under Section 87(2) IT Act, without limiting that broad rule-making power, the rules may provide for any of the specific matters listed in clauses (a) to (zh).

In the first group of matters under Section 87(2) IT Act, rules may cover conditions for the reliability of an electronic signature or electronic authentication technique under Section 3A(2) IT Act in clause (a), the procedure for ascertaining an electronic signature or authentication under Section 3A(3) IT Act in clause (aa), and the manner of authenticating information or any matter by electronic signature under Section 5 IT Act in clause (ab). Clauses (b), (c) and (ca) cover the electronic form for filing, issue, grant or payment under Section 6(1) IT Act, the manner and format for filing or issuing electronic records and the payment method under Section 6(2) IT Act, and the manner in which an authorised service provider may collect, retain and appropriate service charges under Section 6A(2) IT Act. Clauses (d), (e), (ea) and (f) cover the type, manner and format of electronic signatures under Section 10 IT Act, storing and affixing electronic signature creation data under Section 15 IT Act, security procedures and practices under Section 16 IT Act, and the qualifications, experience and service conditions of the Controller, Deputy Controllers, Assistant Controllers, other officers and employees under Section 17 IT Act. Clause (g) was omitted by Act 10 of 2009 with effect from 27 October 2009.

In the next group under Section 87(2) IT Act, clauses (h) to (m) deal with Certifying Authority licences: applicant requirements under Section 21(2) IT Act, licence validity periods under Section 21(3)(a) IT Act, the licence application form under Section 22(1) IT Act, application fees under Section 22(2)(c) IT Act, accompanying documents under Section 22(2)(d) IT Act, and licence renewal forms and fees under Section 23 IT Act. Clauses (ma), (n) and (o) cover application forms and fees for issuing an Electronic Signature Certificate under Section 35, Section 35(1) and Section 35(2) IT Act, while clause (oa) covers subscriber duties under Section 40A IT Act. Clause (ob) covers reasonable security practices and procedures and sensitive personal data or information under Section 43A IT Act, and clauses (p) and (q) cover the inquiry manner under Section 46(1) IT Act and the qualifications and experience of an adjudicating officer under Section 46(3) IT Act. Clauses (r), (s) and (t) were omitted by Act 7 of 2017 with effect from 26 May 2017. Clauses (u), (v) and (w) cover the appeal form and fee before the Appellate Tribunal under Section 57(3) IT Act, additional civil court powers of the Appellate Tribunal under Section 58(2)(g) IT Act, and the powers and functions of the Chairperson of the Appellate Tribunal under Section 52A IT Act (though Section 52A IT Act itself was omitted with effect from 26 May 2017).

In the final group under Section 87(2) IT Act, clause (x) covers the information to be retained and preserved by intermediaries, along with its duration, manner and form under Section 67C IT Act. Clauses (y), (z) and (za) cover procedures and safeguards for interception, monitoring or decryption (printed with a reference to Section 69A(2) IT Act, whereas Section 69(2) IT Act governs interception, monitoring or decryption), blocking information from public access (printed with a reference to Section 69B(3) IT Act, whereas Section 69A(2) IT Act governs blocking for public access), and monitoring and collecting traffic data or information under Section 69B(3) IT Act. Clauses (zb) and (zc) cover information security practices and procedures for protected systems under Section 70 IT Act and the manner in which the national nodal agency performs its functions and duties under Section 70A(3) IT Act. Clauses (zd), (ze) and (zf) cover the officers and employees of the Indian Computer Emergency Response Team under Section 70B(2) IT Act, the salaries, allowances and service conditions of its Director General, officers and employees under Section 70B(3) IT Act, and the manner of performing its functions and duties under Section 70B(5) IT Act. Clauses (zg) and (zh) cover guidelines to be observed by intermediaries under Section 79(2) IT Act and modes or methods for encryption under Section 84A IT Act.

Under Section 87(3) IT Act, every notification made by the Central Government under Section 70A(1) IT Act and every rule made by the Central Government must be laid, as soon as may be after it is made, before each House of Parliament while in session for a total period of 30 days, whether in 1 session or across 2 or more successive sessions. If, before the expiry of the session immediately following that session or those successive sessions, both Houses agree to modify the rule or agree that the rule must not be made, the rule thereafter has effect only in the modified form or has no effect. As a saving limit, any such modification or annulment does not affect the validity of anything previously done under that notification or rule. Section 87 IT Act was amended by Act 10 of 2009 (with effect from 27 October 2009) and Act 7 of 2017 (with effect from 26 May 2017).

When Section 87 IT Act Applies

  • The Central Government makes rules to carry out the provisions of the IT Act, including on any of the matters listed in Section 87(2) IT Act.
  • The rules are notified in both the Official Gazette and the Electronic Gazette.
  • Every notification under Section 70A(1) IT Act and every rule made by the Central Government is laid before each House of Parliament while in session for a total period of 30 days across 1 session or 2 or more successive sessions.
  • If both Houses agree before the end of the immediately following session to modify a rule or not to make the rule, the rule takes effect only in the modified form or ceases to have effect, without affecting anything previously done under that notification or rule.

When Section 87 IT Act Does Not Apply

  • Any modification or annulment of a rule by both Houses of Parliament under Section 87(3) IT Act does not invalidate anything previously done under that notification or rule.
  • A rule made under Section 87 IT Act ceases to have effect from that point onward if both Houses of Parliament agree, before the expiry of the immediately following session, that the rule is not to be made.

FAQs on Section 87 IT Act

What is Section 87 IT Act?▼

Section 87 IT Act is the rule-making provision that empowers the Central Government to make rules to carry out the Information Technology Act, 2000, covering subjects such as electronic signatures, Certifying Authorities, data security, intermediaries, public blocking, traffic data and cyber security agencies. Every rule must be notified in the Official Gazette and the Electronic Gazette and laid before each House of Parliament for a total period of 30 days.

Where must the Central Government publish rules made under Section 87 IT Act?▼

Both the Official Gazette and the Electronic Gazette. Section 87(1) IT Act requires notification in both gazettes when the Central Government makes rules under the IT Act.

Can the Central Government make rules under Section 87 IT Act only on the matters listed in Section 87(2) IT Act?▼

No. Section 87(1) IT Act gives the Central Government a broad power to make rules to carry out the provisions of the IT Act, and Section 87(2) IT Act states that its specific list of subjects does not limit that broad power.

For how long must rules under Section 87 IT Act be laid before Parliament?▼

30 days. Under Section 87(3) IT Act, every rule and every notification under Section 70A(1) IT Act must be laid before each House of Parliament while in session for a total period of 30 days, whether in 1 session or across 2 or more successive sessions.

Does Parliament modifying or cancelling a rule under Section 87(3) IT Act undo actions already taken under that rule?▼

No. Under Section 87(3) IT Act, if both Houses agree before the end of the immediately following session to modify or annul a rule, the change applies going forward and does not affect the validity of anything previously done under that notification or rule.

Does Section 87 IT Act empower the Central Government to make rules on sensitive personal data and intermediary guidelines?▼

Yes. Section 87(2)(ob) IT Act covers reasonable security practices and procedures and sensitive personal data or information under Section 43A IT Act, while Section 87(2)(x) and Section 87(2)(zg) IT Act cover record preservation under Section 67C IT Act and intermediary guidelines under Section 79(2) IT Act.

Have questions about Section 87 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·