Home  /  Information Technology Act  /  Section 30

Section 30: Certifying Authority to follow certain procedures

Information Technology Act • Official Statutory Text & Practice Guide

Statutory Regulation
Legal Standard
Competent Court / Tribunal
Act 2000
Section 29 All 90 Sections of Information Technology Act Section 31

Legal Commentary & Landmark Judgments: Section 30

Section 30 establishes mandatory operational and security procedures for Certifying Authorities, requiring strict hardware-software integrity, personnel reliability screening, adherence to Certification Practice Statements, and continuous cryptographic safeguards.

  • Hardware and Software Trustworthiness: Mandates that every Certifying Authority utilize hardware, software, and operational procedures that are reasonably secure from intrusion and digital misuse.
  • High Standard of Service and Integrity: Obligates the CA to provide a reasonable level of reliability in its operations, adhering strictly to the procedures disclosed in its Certification Practice Statement.
  • Personnel Vetting and Access Controls: Requires rigorous background verification and security vetting for all personnel entrusted with access to cryptographic keys and root certificates.
Key Landmark Precedents:
  • Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1: Constitution Bench held that private and public entities handling digital identities must maintain strict technical safeguards to protect citizen data against breaches.
  • PUCL v. Union of India (1997) 1 SCC 301: Supreme Court established that technical procedures governing communication infrastructure must incorporate robust safeguards against unauthorized interception.
  • Shreya Singhal v. Union of India (2015) 5 SCC 1: Supreme Court underscored that statutory standards regulating the digital ecosystem must be applied with procedural rigor to maintain legal certainty.
Courtroom Practice & Strategic Litigation Guidance:

In damages claims against a Certifying Authority for wrongful certificate issuance or private key leakage, plead breach of statutory duty under Section 30; proof that the CA deviated from its Certification Practice Statement creates an unassailable basis for civil liability.

Section 29 All 90 Sections of Information Technology Act Section 31