Subscriber Responsibilities Under IT Act 2000

Every time you file your GST returns, upload a tender document, or e-sign a company filing with the Ministry of Corporate Affairs, a Digital Signature Certificate (DSC) is doing the quiet work of proving it’s really you. But that convenience comes with a catch: the law puts real legal weight on the person holding the certificate, called the “subscriber”. The Information Technology Act, 2000 doesn’t just protect subscribers, it also holds them accountable. Understanding these duties is essential for anyone studying e-commerce law, and even more useful if you’ll ever apply for a DSC yourself.

Who exactly is a “subscriber”? 🔗

A subscriber is the person in whose name a Digital Signature Certificate is issued by a Certifying Authority (CA). Certifying Authorities are private and government entities licensed and supervised by the Controller of Certifying Authorities (CCA), a body functioning under the Ministry of Electronics and Information Technology. Once a CA verifies your identity and issues a DSC, you become the subscriber, and the certificate links your identity to a unique cryptographic key pair: a public key that others can see, and a private key that only you should ever hold.

This private key is what actually creates the digital signature on a document. The public key, listed in the certificate, is used by others to verify that the signature genuinely came from you. The entire system of trust in electronic transactions collapses if that private key falls into the wrong hands, which is exactly why Chapter VIII of the Act (Sections 40 to 42) spells out what subscribers must do to keep it safe.

The core duties spelled out in Sections 40 to 42 🔗

The Act frames a subscriber’s responsibilities around three connected ideas: generate your keys securely, protect your private key at all times, and report immediately if anything goes wrong. Each has a distinct legal basis.

Generating the key pair securely (Section 40) 🔗

Where a subscriber has accepted a Digital Signature Certificate whose listed public key was generated by the subscriber, Section 40 requires that the corresponding key pair be generated by applying the prescribed security procedure. In simple terms, you can’t cut corners on how the cryptographic keys are created. Section 40A extends similar obligations to Electronic Signature Certificates, since the Act was amended in 2008 to recognise signature technologies beyond the original digital signature scheme.

Exercising reasonable care over the private key (Section 42) 🔗

This is the heart of the subscriber’s duty. Section 42(1) of the Act requires every subscriber to exercise reasonable care to retain control of the private key corresponding to the public key listed in the certificate, and to take all steps necessary to prevent its disclosure. Think of it the way banks describe your UPI PIN or net-banking password: you’re not expected to be a cybersecurity expert, but you are expected to behave like a reasonably careful person would with something this sensitive. That could mean using encrypted USB tokens, never sharing your DSC token or its password, and keeping the physical hardware token secure the way you’d protect a chequebook.

Reporting compromise without delay 🔗

If the private key is ever compromised, whether it’s lost, stolen, or you suspect someone else has accessed it, Section 42(2) requires the subscriber to communicate this to the Certifying Authority immediately, in the manner specified by the applicable regulations. Delay isn’t a minor procedural lapse here; it has direct legal consequences, covered in the next section. In practice, the CCA’s own guidance confirms that once a certificate is compromised or no longer needed, it should be formally revoked and the keys destroyed by the subscriber, not left dormant and vulnerable.

Why the “till informed” clause matters so much 🔗

Here’s the part students often underestimate. The Explanation to Section 42(2) makes it explicit: the subscriber remains liable for any misuse of the digital signature until the Certifying Authority has been informed that the private key has been compromised. This isn’t a small technicality. It means that even if someone else misused your signature without your knowledge, you could still bear legal responsibility for transactions signed in that window, right up until you formally notify the CA.

This is why prompt reporting isn’t just good practice, it’s a legal firewall. A digital signature carries the same evidentiary weight as a handwritten signature under Indian law, and courts have consistently upheld electronic authentication as legally valid in commercial disputes, as reflected in the broader body of case law recognising digital signatures under the IT Act framework. If your signature is used to sign a contract, place an order, or authorise a payment while your key is compromised and unreported, that transaction can potentially be enforced against you.

Acceptance obligations under Section 41 🔗

Duties don’t start only after something goes wrong, they begin the moment you accept the certificate. Under Section 41, a subscriber is deemed to have accepted a Digital Signature Certificate if they publish it, authorise its publication in a repository, or otherwise demonstrate approval of it. By accepting the certificate, the subscriber is effectively certifying three things to anyone who relies on it: that they genuinely hold the private key matching the public key in the certificate, that all representations made to the Certifying Authority during the application were true, and that all information in the certificate within their knowledge is accurate.

This matters because Certifying Authorities such as those licensed by the CCA, and recognised for corporate filings by the Ministry of Corporate Affairs, issue certificates based largely on the information and documents a subscriber provides. If that information turns out to be false, the subscriber, not just the CA, bears responsibility for the misrepresentation.

A quick summary 🔗

Why this matters for e-commerce specifically 🔗

E-commerce runs on trust between parties who often never meet. Digital signatures allow platforms, vendors, tax authorities, and banks to authenticate a person’s identity electronically, without paperwork or physical presence. That system only works if the humans behind those signatures are held to a real standard of care. Subscriber duties under the IT Act are what make it legally safe for a marketplace to accept an e-signed vendor agreement, or for a government portal to accept a digitally signed tender bid, because the law assigns clear responsibility for the security of that signature to the person who holds it.

For students of e-commerce law, this topic is a good reminder that legal frameworks don’t just regulate large platforms and corporations. They also place direct, personal obligations on individuals participating in the digital economy, whether that’s a company director e-filing MCA documents or a freelancer signing contracts online. Negligence with a private key isn’t treated as a technical mishap; it’s treated as a failure of legal duty.

What do you think? If someone’s DSC token is stolen and misused before they even realise it’s missing, should the law still hold them liable for transactions signed in that gap? And as India moves toward Aadhaar-based eSign and cloud-based signing, do you think the “reasonable care” standard needs to evolve to match these newer technologies?

References

1. https://www.digitalindia.gov.in/di_ecosystem/controller-of-certifying-authorities-cca/
2. https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf
3. https://cca.gov.in/faq.html
4. https://www.mondaq.com/india/contracts-and-commercial-law/1441750/law-of-digital-signatures-in-india
5. https://www.mca.gov.in/MinistryV2/certifyingauthorities.html