Section 89 IT Act: Power of Controller to make regulations

Information Technology Act, 2000

Section 89 IT Act at a Glance

Section 89 IT Act empowers the Controller to make Official Gazette regulations after consulting the Cyber Regulations Advisory Committee and obtaining prior Central Government approval. Every regulation must be laid before each House of Parliament for 30 days.

Section 89 IT Act Bare Act Text

89. Power of Controller to make regulations.

(1) The Controller may, after consultation with the Cyber Regulations Advisory Committee and with the previous approval of the Central Government, by notification in the Official Gazette, make regulations consistent with this Act and the rules made thereunder to carry out the purposes of this Act.

(2) In particular, and without prejudice to the generality of the foregoing power, such regulations may provide for all or any of the following matters, namely:—

(a) the particulars relating to maintenance of data base containing the disclosure record of every Certifying Authority under clause (n) of section 18;

(b) the conditions and restrictions subject to which the Controller may recognise any foreign Certifying Authority under sub-section (1) of section 19;

(c) the terms and conditions subject to which a licence may be granted under clause (c) of sub-section (3) of section 21;

(d) other standards to be observed by a Certifying Authority under clause (d) of section 30;

(e) the manner in which the Certifying Authority shall disclose the matters specified in sub-section (1) of section 34;

(f) the particulars of statement which shall accompany an application under sub-section (3) of section 35.

(g) the manner by which the subscriber shall communicate the compromise of private key to the Certifying Authority under sub-section (2) of section 42.

(3) Every regulation made under this Act shall be laid, as soon as may be after it is made, before each House of Parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if, before the expiry of the session immediately following the session or the successive sessions aforesaid, both Houses agree in making any modification in the regulation or both Houses agree that the regulation should not be made, the regulation shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that regulation.

Amendments to this section
  • Subs. by notification No. S.O. 1015(E), for "(m)" (w.e.f. 19-9-2002).

Section 89 IT Act in Simple Words

Section 89 IT Act gives the Controller the power to make regulations to carry out the purposes of the Act. Under Section 89(1) IT Act, the Controller may make these regulations by notification in the Official Gazette only after consulting the Cyber Regulations Advisory Committee and obtaining the previous approval of the Central Government. Every regulation must remain consistent with the IT Act and the rules made under the IT Act.

Section 89(2) IT Act lists seven matters that the regulations may cover without limiting the broad power in Section 89(1) IT Act. Under clauses (a) to (d), the regulations may specify: the particulars for maintaining the publicly accessible database of every Certifying Authority's disclosure record under Section 18(n) IT Act; the conditions and restrictions for recognising a foreign Certifying Authority under Section 19(1) IT Act; the terms and conditions of a licence to issue electronic signature Certificates under Section 21(3)(c) IT Act; and other standards that a Certifying Authority must observe under Section 30(d) IT Act.

Under clauses (e) to (g) of Section 89(2) IT Act, the regulations may also specify: the manner in which a Certifying Authority must disclose the Certifying Authority's electronic signature Certificate, relevant certification practice statement, certificate revocation or suspension notice, and material adverse facts under Section 34(1) IT Act; the particulars of the statement that must accompany an application for an electronic signature Certificate where there is no certification practice statement under Section 35(3) IT Act; and the manner in which a subscriber must communicate the compromise of a private key without delay to the Certifying Authority under Section 42(2) IT Act.

Under Section 89(3) IT Act, every regulation made under the IT Act must be laid, as soon as may be after it is made, before each House of Parliament while Parliament is in session for a total period of 30 days, whether in one session or across two or more successive sessions. If, before the end of the session immediately following that session or those successive sessions, both Houses agree to modify the regulation or agree that the regulation should not be made, the regulation takes effect from then on only in the modified form or ceases to have effect. Any such modification or annulment does not affect the validity of anything previously done under that regulation.

When Section 89 IT Act Applies

  • Consultation by the Controller with the Cyber Regulations Advisory Committee before making regulations.
  • Previous approval of the Central Government before the Controller makes the regulations.
  • Publication of the regulations by notification in the Official Gazette.
  • Consistency of the regulations with the IT Act and with the rules made under the IT Act, to carry out the purposes of the IT Act.
  • Laying of every regulation before each House of Parliament while in session for a total period of 30 days across one session or two or more successive sessions, subject to modification or annulment agreed to by both Houses.

When Section 89 IT Act Does Not Apply

  • Modification or annulment of a regulation by both Houses of Parliament under Section 89(3) IT Act does not affect the validity of anything previously done under that regulation.

FAQs on Section 89 IT Act

What is Section 89 IT Act?▼

Section 89 IT Act empowers the Controller to make regulations, by notification in the Official Gazette, after consulting the Cyber Regulations Advisory Committee and obtaining the previous approval of the Central Government. Section 89 IT Act also lists specific Certifying Authority and subscriber matters that these regulations may cover and requires every regulation to be laid before Parliament.

Can the Controller make regulations under Section 89 IT Act without prior approval?▼

No. Under Section 89(1) IT Act, the Controller must first consult the Cyber Regulations Advisory Committee and obtain the previous approval of the Central Government. Only then may the Controller make regulations by notification in the Official Gazette.

How long must a regulation under Section 89 IT Act be laid before Parliament?▼

30 days. Under Section 89(3) IT Act, every regulation made under the Act must be laid before each House of Parliament while in session for a total period of 30 days, in one session or across two or more successive sessions.

Can one House of Parliament alone annul a regulation under Section 89(3) IT Act?▼

No. Under Section 89(3) IT Act, both Houses of Parliament must agree to modify the regulation or agree that the regulation should not be made, before the end of the session immediately following the laying session or successive sessions.

Does Parliamentary annulment under Section 89(3) IT Act invalidate actions already taken under a regulation?▼

No. Section 89(3) IT Act states that any modification or annulment by Parliament is without prejudice to the validity of anything previously done under that regulation.

Have questions about Section 89 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·