Sections 21 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sections 21 to 24 of the Information Technology Act, 2000 set out how a person becomes a licensed Certifying Authority. Section 21 allows an application to the Controller and sets the licence's basic character, section 22 lists what must accompany the application, section 23 deals with renewal and section 24 deals with grant or rejection.
Any person may apply to the Controller for a licence to issue Electronic Signature Certificates, but none is issued unless the applicant meets the requirements of qualification, expertise, manpower, financial resources and infrastructure prescribed by the Central Government (s.21). The application carries a certification practice statement, an identification-procedure statement, a fee not exceeding twenty-five thousand rupees and other prescribed documents (s.22). A renewal application carries a fee not exceeding five thousand rupees and must be made not less than forty-five days before expiry (s.23). A rejection needs a reasonable opportunity to present the case (s.24).
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of these sections should be checked. The forms, fees within the ceilings, periods of validity and documents are left to rules and regulations that are not in the sources used here. A firm preparing a licence application can use a legal consultation to organise the papers against the text below.
Section 21: who may apply and the nature of the licence
Sub-section (1). "Subject to the provisions of sub-section (2), any person may make an application to the Controller for a license to issue Electronic Signature Certificates."
Sub-section (2). No license shall be issued unless the applicant fulfills such requirements with respect to qualification, expertise, manpower, financial resources and other infrastructure facilities, which are necessary to issue Electronic Signature Certificates, as may be prescribed by the Central Government.
Sub-section (3). A license granted under the section shall:
| Clause | Feature |
|---|---|
| (a) | be valid for such period as may be prescribed by the Central Government |
| (b) | not be transferable or heritable |
| (c) | be subject to such terms and conditions as may be specified by the regulations |
Clause (b) means the licence cannot be sold or assigned and does not pass to heirs. The period of validity in clause (a) is left to the Central Government, and the Act prints no number.
"Certifying Authority" is defined in section 2(1)(g) as a person who has been granted a License to issue an Electronic Signature Certificate under section 24; see our article on section 2: digital signature, certifying authority and key pair.
Section 22: the application
- Every application shall be in such form as may be prescribed by the Central Government.
- Every application shall be accompanied by:
- (a) a certification practice statement;
- (b) a statement including the procedures with respect to identification of the applicant;
- (c) payment of such fees, not exceeding twenty-five thousand rupees as may be prescribed by the Central Government;
- (d) such other documents as may be prescribed by the Central Government.
A "certification practice statement" is defined in section 2(1)(h) as a statement issued by a Certifying Authority to specify the practices that it employs in issuing Electronic Signature Certificates. The Act caps the fee at twenty-five thousand rupees; the amount within that ceiling is for the Central Government to prescribe.
Section 23: renewal
An application for renewal of a license shall be:
- (a) in such form;
- (b) accompanied by such fees, not exceeding five thousand rupees, as may be prescribed by the Central Government, and shall be made not less than forty-five days before the date of expiry of the period of validity of the license.
Printing slip: clause (a) reads only "in such form;" without saying "as may be prescribed"; we quote it as printed and read the detail as left to the Central Government.
Section 24: grant or rejection
"The Controller may, on receipt of an application under sub-section (1) of section 21, after considering the documents accompanying the application and such other factors, as he deems fit, grant the license or reject the application."
The proviso: "no application shall be rejected under this section unless the applicant has been given a reasonable opportunity of presenting his case."
So the Controller has a discretion ("may"), is entitled to consider "such other factors, as he deems fit", and cannot reject without giving the applicant a reasonable opportunity. The section does not set a time limit for a decision. Section 24 itself says nothing about an appeal from a rejection.
Putting the steps in order
| Step | Provision | What happens |
|---|---|---|
| 1 | s.21(1), (2) | Application to the Controller; applicant must meet the prescribed requirements |
| 2 | s.22 | Application in the prescribed form with certification practice statement, identification procedures statement, fee up to twenty-five thousand rupees, other documents |
| 3 | s.24 | Controller grants or rejects; rejection only after a reasonable opportunity |
| 4 | s.21(3) | Licence valid for the prescribed period, not transferable or heritable, subject to regulations |
| 5 | s.23 | Renewal application at least forty-five days before expiry, with fee up to five thousand rupees |
A worked example
Lumen Trust Services Private Limited applies to the Controller for a licence. It submits the prescribed form, its certification practice statement, a statement of how it identifies applicants, the fee and the other prescribed documents. The Controller considers the documents and other factors he deems fit. Before rejecting the application, the Controller gives Lumen a reasonable opportunity of presenting its case, as the proviso to section 24 requires. If the licence is granted, Lumen notes the validity period prescribed and diarises renewal so that the renewal application is made not less than forty-five days before expiry. If Lumen later wants to hand the business to another company, clause (b) of section 21(3) means the licence itself is not transferable.
Once licensed, the Certifying Authority has duties under sections 30 to 34; see our article on duties of a Certifying Authority. For a practical user's view of getting a certificate from a licensed body, see our guide on how to get, renew and use a Digital Signature Certificate.
Need help with Certifying Authority licensing?
If you plan to apply for or renew a licence, or want to check how your obligations to the Controller line up, we can review the application structure and calendar. Ask for a legal consultation and bring the form and supporting statements.
Key takeaways
- Any person may apply to the Controller, but only an applicant meeting the prescribed requirements gets a licence.
- The application fee is capped at twenty-five thousand rupees; the renewal fee at five thousand rupees.
- Renewal must be applied for not less than forty-five days before expiry.
- A licence is not transferable or heritable.
- No application may be rejected without a reasonable opportunity of presenting the case.
Read next
- Sections 25 to 27: suspension and revocation of Certifying Authority licence
- Sections 17 to 19: Controller of Certifying Authorities, appointment and functions
- Sections 30 to 34: duties of a Certifying Authority
- Digital Signature Certificate (DSC) for MCA filing: complete guide
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.