Sections 25 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sections 25 to 27 of the Information Technology Act, 2000 say when the Controller of Certifying Authorities can suspend or revoke a Certifying Authority's licence, how the public is told, and how the Controller can delegate his powers. Section 25 is the working provision, with four grounds, a show-cause safeguard and a ten-day limit on suspension without a hearing.
The Controller may revoke a licence if satisfied, after inquiry, that the Certifying Authority gave false or incorrect material particulars, failed to comply with the licence terms, failed to maintain the procedures and standards specified in section 30, or contravened the Act, rules, regulations or orders; revocation needs a reasonable opportunity to show cause. He may suspend pending inquiry, but not beyond ten days unless a reasonable opportunity to show cause has been given. A suspended Certifying Authority cannot issue certificates. Notice goes into the Controller's database (s.26).
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of these sections should be checked. Certifying Authorities and their advisers who want the exposure under Chapter VI reviewed can start with a legal consultation.
Section 25(1): the grounds
The heading of section 25 is "Suspension of license", but sub-section (1) is about revocation. Heading slip in the copy: the words "revoke the license" are run into the end of clause (d) rather than standing as a separate operative line. The sub-section is explained here as the copy prints it.
The Controller may, "if he is satisfied after making such inquiry, as he may think fit, that a Certifying Authority has" done any of the following, revoke the licence:
| Clause | Ground |
|---|---|
| (a) | made a statement in, or in relation to, the application for the issue or renewal of the license, which is incorrect or false in material particulars |
| (b) | failed to comply with the terms and conditions subject to which the license was granted |
| (c) | failed to maintain the procedures and standards specified in section 30 |
| (d) | contravened any provisions of this Act, rule, regulation or order made thereunder |
Clause (c) is printed in square brackets in the copy. Section 30 is covered in our article on duties of a Certifying Authority.
The proviso: show cause
"Provided that no license shall be revoked unless the Certifying Authority has been given a reasonable opportunity of showing cause against the proposed revocation." The Act does not state how much time is "reasonable"; it prints no period.
Section 25(2): suspension pending inquiry
"The Controller may, if he has reasonable cause to believe that there is any ground for revoking a license under sub-section (1), by order, suspend such license pending the completion of any inquiry ordered by him."
The proviso sets a limit: "no license shall be suspended for a period exceeding ten days unless the Certifying Authority has been given a reasonable opportunity of showing cause against the proposed suspension."
So the Controller may suspend by order for up to ten days on reasonable cause to believe a ground exists. To continue the suspension beyond ten days he must first give the Certifying Authority a reasonable opportunity to show cause.
Section 25(3): no certificates during suspension
"No Certifying Authority whose license has been suspended shall issue any Electronic Signature Certificate during such suspension." The Act prints no separate penalty here; a breach could also be a ground under clause (b) or (d) of sub-section (1), but the text does not say so, and this article does not extend it.
Section 26: notice of suspension or revocation
- Sub-section (1): where the licence is suspended or revoked, the Controller "shall publish notice of such suspension or revocation, as the case may be, in the database maintained by him". Section 18(n) separately mentions a database of disclosure records of every Certifying Authority, accessible to the public.
- Sub-section (2): where one or more repositories are specified, the Controller shall publish the notices in all of them.
- First proviso: the database containing the notice shall be made available through a web site which shall be accessible round the clock.
- Second proviso: the Controller may, if he considers necessary, publicize the contents of the database in such electronic or other media as he considers appropriate.
The text does not define "repositories" in this section. Section 20, which dealt with the Controller acting as repository, is printed as omitted in the copy; we say no more about it.
Section 27: power to delegate
"The Controller may, in writing, authorize the Deputy Controller, Assistant Controller or any officer to exercise any of the powers of the Controller under this Chapter." The authorisation must be in writing, may be given to any officer, and covers "any of the powers" under Chapter VI. Section 17 describes those officers; see our article on sections 17 to 19.
The process at a glance
| Stage | Provision | Safeguard |
|---|---|---|
| Inquiry | s.25(1) | Controller must be satisfied after inquiry as he may think fit |
| Suspension | s.25(2) | Reasonable cause to believe a ground exists; by order; pending inquiry |
| Limit | proviso to s.25(2) | Not beyond ten days without a reasonable opportunity to show cause |
| Revocation | proviso to s.25(1) | Reasonable opportunity of showing cause |
| Effect of suspension | s.25(3) | No certificates issued during suspension |
| Publication | s.26 | Notice in the Controller's database; website accessible round the clock |
| Delegation | s.27 | In writing |
A worked example
The Controller receives information that Harbor Secure Certs Private Limited, a Certifying Authority, stated an incorrect figure about its financial resources in its renewal application. The Controller orders an inquiry. Because he has reasonable cause to believe a ground under section 25(1)(a) exists, he suspends the licence by order on the first day. He may leave the suspension in place for ten days; if he wants it to continue beyond ten days, he must give Harbor a reasonable opportunity to show cause against the suspension. During any suspension Harbor cannot issue a certificate. If the Controller decides to revoke, he must give Harbor a reasonable opportunity to show cause against the proposed revocation, and then publish notice of the revocation in his database under section 26. A Deputy Controller can conduct the inquiry only if the Controller has authorised him in writing under section 27.
Need help with Certifying Authority compliance?
If a licence is under inquiry or you want to test your compliance with the standards that can trigger revocation, we can review the position and the notices issued. Please ask for a legal consultation and bring any notice you have received.
Key takeaways
- Four grounds for revocation: false or incorrect statement, breach of licence terms, failure to maintain section 30 standards, contravention of the Act, rules, regulations or orders.
- No revocation without a reasonable opportunity of showing cause.
- Suspension pending inquiry cannot exceed ten days without a reasonable opportunity to show cause.
- A suspended Certifying Authority cannot issue certificates.
- Notice of suspension or revocation goes in the Controller's database; delegation must be in writing.
Read next
- Sections 21 to 24: licence to issue electronic signature certificates
- Sections 28 and 29: Controller's power to investigate and access computers
- Sections 30 to 34: duties of a Certifying Authority
- DSC (Digital Signature Certificate) for MCA filing: guide
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.