Home  /  Information Technology Act  /  Section 20

Section 20: Controller to act as repository

Information Technology Act • Official Statutory Text & Practice Guide

Statutory Regulation
Legal Standard
Competent Court / Tribunal
Act 2000
Section 19 All 90 Sections of Information Technology Act Section 21

Legal Commentary & Landmark Judgments: Section 20

Section 20 mandates that the Controller of Certifying Authorities shall act as a repository of all Digital Signature Certificates issued under the Act, maintaining a secure, publicly accessible electronic registry of all licenses, certificates, and revocation lists.

  • Comprehensive Electronic Registry: Requires the CCA to maintain a centralized, publicly searchable database of all authorized Certifying Authorities and their operational public keys.
  • Public Key Availability for Verification: Ensures that relying parties can access and verify the public key of any licensed CA to confirm the validity of subordinate subscriber certificates.
  • Continuous Availability and Disaster Recovery: Obligates the CCA to implement robust business continuity and disaster recovery protocols to prevent outage of the national certificate repository.
Key Landmark Precedents:
  • K.S. Puttaswamy (Aadhaar-5J.) v. Union of India (2019) 1 SCC 1: Constitution Bench held that centralized statutory repositories holding citizen data or public cryptographic keys must implement stringent structural safeguards against unauthorized access.
  • Central Board of Secondary Education v. Aditya Bandopadhyay (2011) 8 SCC 497: Supreme Court expounded on the statutory duty of public repositories to balance public disclosure mandates with data integrity protections.
  • Canara Bank v. C.S. Shyam (2018) 11 SCC 426: Supreme Court affirmed that statutory registries must ensure authenticity and accuracy in data held for public verification.
Courtroom Practice & Strategic Litigation Guidance:

In litigation where an adversary challenges the authority of a Certifying Authority, produce a certified extract from the CCA National Repository under Section 20, establishing that the CA's public key was active and valid on the date of execution.

Section 19 All 90 Sections of Information Technology Act Section 21