Sections 28 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sections 28 and 29 of the Information Technology Act, 2000 give the Controller of Certifying Authorities, and officers or persons he authorises, the power to investigate contraventions and to gain access to computer systems and data when there is reasonable cause to suspect a contravention of Chapter VI. They also let the Controller order a person in charge of the system to give reasonable technical and other assistance.
The Controller or an authorised officer shall take up for investigation any contravention of the Act, rules or regulations (s.28(1)) and exercises the like powers conferred on Income-tax authorities under Chapter XIII of the Income-tax Act, 1961, subject to the limitations laid down under that Act (s.28(2)). If he has reasonable cause to suspect a contravention of Chapter VI, he has access to any computer system, apparatus, data or material connected with it to search, and may by order direct the person in charge to give reasonable technical and other assistance (s.29).
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of these sections should be checked. Both sections are in Chapter VI, "Regulation of Certifying Authorities". If you have received a notice or an access request from the Controller, a legal dispute resolution consultation can help you respond within the text of these sections.
Section 28(1): the duty to investigate
"The Controller or any officer authorized by him in this behalf shall take up for investigation any contravention of the provisions of this Act, rules or regulations made thereunder."
Points from the wording:
- The word is "shall", so investigation of a contravention is a duty and not a mere option.
- The investigator is either the Controller or an officer authorized by him in this behalf. Section 27 lets the Controller authorise the Deputy Controller, Assistant Controller or any officer, in writing, to exercise his powers under the Chapter; see our article on sections 25 to 27.
- The subject-matter is any contravention of the provisions of this Act, rules or regulations, which is broader than Chapter VI alone. Section 29, below, is narrower.
Section 28(2): powers likened to Income-tax authorities
"The Controller or any officer authorized by him in this behalf shall exercise the like powers which are conferred on Income-tax authorities under Chapter XIII of the Income-tax Act, 1961 (43 of 1961), and shall exercise such powers, subject to such limitations laid down under that Act."
The text borrows the powers by reference; it does not list them. This article quotes the reference as printed, and does not describe what Chapter XIII contains. Readers should check the current procedural, penal or other law for the corresponding provision of the Act named. For tax questions, see our income-tax guides.
Two phrases carry the weight:
- "The like powers" means powers of the same kind as those conferred on Income-tax authorities under the named Chapter.
- "Subject to such limitations laid down under that Act" means the limits that apply to those powers under the Income-tax Act apply here as well.
Section 29(1): access to computers and data
"Without prejudice to the provisions of sub-section (1) of section 68, the Controller or any person authorized by him shall, if he has reasonable cause to suspect that any contravention of the provisions of this Chapter has been committed, have access to any computer system, any apparatus, data or any other material connected with such system, for the purpose of searching or causing a search to be made for obtaining any information or data contained in or available to such computer system."
| Element | What the words say |
|---|---|
| Who | The Controller or any person authorized by him |
| Threshold | Reasonable cause to suspect |
| Subject | Any contravention of the provisions of this Chapter (Chapter VI) |
| Right | Access to any computer system, any apparatus, data or any other material connected with such system |
| Purpose | Searching, or causing a search to be made, for obtaining information or data contained in or available to the computer system |
| Relation to s.68(1) | "Without prejudice to" it; this article does not describe section 68 |
"Computer system" is defined in section 2(1)(l); see our article on section 2: computer, data, information, intermediary and cyber security. Note that section 29 speaks of "any person authorized by him", wider than the "officer" in section 28.
Section 29(2): assistance by order
"For the purposes of sub-section (1), the Controller or any person authorized by him may, by order, direct any person in-charge of, or otherwise concerned with the operation of, the computer system, data apparatus or material, to provide him with such reasonable technical and other assistance as he may consider necessary."
Three features: the direction is by order; it is addressed to a person in charge of, or otherwise concerned with the operation of the system, data, apparatus or material; and the assistance is "reasonable technical and other assistance as he may consider necessary". The text prints no penalty for failing to give the assistance, and the sources used here do not say what follows from non-compliance in this section. The text of section 28 and 29 does not say that a warrant, a time limit or a particular form of order is needed, and none is stated here.
Sections 28 and 29 compared
| Feature | Section 28 | Section 29 |
|---|---|---|
| Who acts | Controller or authorised officer | Controller or any person authorised |
| Trigger | Any contravention of the Act, rules or regulations | Reasonable cause to suspect a contravention of Chapter VI |
| Nature | Investigation with powers like Income-tax authorities | Access to computer systems and data for search; assistance order |
| Limit | Limitations laid down in the Income-tax Act | None stated beyond the words of the section |
A worked example
Following a complaint, the Controller has reasonable cause to suspect that Verity Sign Services Private Limited, a Certifying Authority, has contravened a provision of Chapter VI. He authorises an officer, in writing, to take up the matter under section 28. The officer then seeks access under section 29 to the company's computer system and related material to search for information. The company's systems manager is directed by order to give reasonable technical assistance. Verity's advisers check three things: that the person acting holds a written authorisation, that the suspected contravention is of Chapter VI for the purposes of section 29, and that any limitation attached to the borrowed powers is observed. They also keep a record of everything given, because the sections say nothing about how records are returned or protected.
Need help responding to an investigation or access request?
If the Controller or an authorised officer has asked you for access or assistance, or you are advising a Certifying Authority on its position, we can review the authorisation and the scope of the request with you. Please contact our legal dispute resolution team and bring the order or notice.
Key takeaways
- The Controller or an authorised officer shall investigate any contravention of the Act, rules or regulations.
- The investigating powers are the like powers of Income-tax authorities under Chapter XIII of the Income-tax Act, 1961, subject to that Act's limitations.
- Access to computers and data under section 29 needs reasonable cause to suspect a contravention of Chapter VI.
- An order for reasonable technical and other assistance may be directed to a person in charge of the system.
- Neither section prints a penalty or a time limit.
Read next
- Sections 30 to 34: duties of a Certifying Authority
- Sections 25 to 27: suspension and revocation of Certifying Authority licence
- Sections 17 to 19: Controller of Certifying Authorities, appointment and functions
- Cyber law: Information Technology Act 2000, offences, penalties and adjudication
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.