Home  /  Information Technology Act  /  Section 42

Section 42: Control of private key

Information Technology Act • Official Statutory Text & Practice Guide

Statutory Regulation
Legal Standard
Competent Court / Tribunal
Act 2000
Section 41 All 90 Sections of Information Technology Act Section 43

Legal Commentary & Landmark Judgments: Section 42

Section 42 imposes a strict statutory duty on every subscriber to exercise reasonable care to retain exclusive control of their private key, establishing continuous personal liability for unauthorized electronic signatures until formal revocation notice is published.

  • Exclusive Control Obligation: Mandates that the subscriber must exercise reasonable security care to retain sole possession and control of the private key corresponding to the public key in their certificate.
  • Immediate Duty to Report Compromise: Obligates the subscriber to notify the Certifying Authority immediately upon discovering that the private key has been lost, compromised, or exposed to unauthorized access.
  • Ongoing Liability Until Revocation: Maintains the subscriber's legal liability for all electronic signatures applied with the private key until the CA completes publication of revocation under Section 39.
Key Landmark Precedents:
  • State (NCT of Delhi) v. Navjot Sandhu (2005) 11 SCC 600: Supreme Court expounded on the legal liability attached to cryptographic key control and electronic transmission custody in statutory cyber frameworks.
  • Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1: Supreme Court affirmed that physical custody and exclusive control over digital signing devices form the foundation of electronic legal presumptions.
  • Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010) 3 SCC 1: Supreme Court held that a party cannot repudiate an electronic contract signed with its private key without demonstrating that statutory breach notification was dispatched prior to signing.
Courtroom Practice & Strategic Litigation Guidance:

In defending against claims of unauthorized corporate signatures, establish the exact minute a Section 42 key compromise notice was delivered to the CA; failure to dispatch an immediate notice leaves the subscriber strictly liable for intermediate transactions.

Section 41 All 90 Sections of Information Technology Act Section 43