Sections 40 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Chapter VIII of the Information Technology Act, 2000 is headed "Duties of subscribers". It covers four short provisions: generating the key pair (section 40), further duties for a subscriber of an Electronic Signature Certificate (section 40A), what counts as accepting a Digital Signature Certificate and what the subscriber certifies by accepting it (section 41), and the duty to keep control of the private key and report any compromise (section 42).
A subscriber who accepts a certificate must generate the key pair by applying the security procedure (s.40). By accepting a Digital Signature Certificate (publishing it, authorising its publication, or showing approval in any manner) the subscriber certifies to all who reasonably rely on it that the subscriber holds and is entitled to hold the private key and that representations and information within his knowledge are true (s.41). He must exercise reasonable care to retain control of the private key, prevent its disclosure and tell the Certifying Authority without any delay if it is compromised; he stays liable until he has informed it (s.42).
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of these sections should be checked. Section 40 contains square-bracket marks in the copy ("[*]" and ""), and section 40A is printed in square brackets as a whole. If you want a key-custody and signing-authority policy for your company, a legal consultation can help you build one around the text.
Section 40: generating the key pair
The copy prints: "Where any Digital Signature Certificate, the public key of which corresponds to the private key of that subscriber which is to be listed in the Digital Signature Certificate has been accepted by a subscriber, [*], the subscriber shall generate pair by applying the security procedure."
Printing slip: a "[*]" mark sits in the middle of the sentence, and "" is shown in brackets, so the sentence is not perfectly smooth; we explain the part that is clear. Where the certificate has been accepted by a subscriber, the subscriber is to generate the key pair by applying the security procedure. "Security procedure" means the procedure prescribed under section 16 by the Central Government (section 2(1)(zf)); see our article on secure electronic record and secure electronic signature. A "key pair" is a private key and its mathematically related public key (section 2(1)(x)).
Section 40A: duties of a subscriber of an Electronic Signature Certificate
Section 40A is a single sentence: "In respect of Electronic Signature Certificate the subscriber shall perform such duties as may be prescribed." The duties themselves are left to rules, which are not in the sources used here. No duty is stated.
Section 41: acceptance of a Digital Signature Certificate
Sub-section (1). A subscriber shall be deemed to have accepted a Digital Signature Certificate if he publishes or authorizes the publication of it:
- (a) to one or more persons;
- (b) in a repository; or
"otherwise demonstrates his approval of the Digital Signature Certificate in any manner." (The copy prints this last phrase on its own line after clause (b).)
Sub-section (2). By accepting a Digital Signature Certificate the subscriber certifies to all who reasonably rely on the information contained in it that:
| Clause | Certification |
|---|---|
| (a) | the subscriber holds the private key corresponding to the public key listed in the certificate and is entitled to hold the same |
| (b) | all representations made by the subscriber to the Certifying Authority and all material relevant to the information contained in the certificate are true |
| (c) | all information in the certificate that is within the knowledge of the subscriber is true |
Acceptance is a matter of conduct. A subscriber who sends the certificate to a counterparty, or lists it in a repository, is deemed to have accepted it, and the certifications in sub-section (2) follow. The beneficiaries are "all who reasonably rely", not only the Certifying Authority.
Section 42: control of the private key
Sub-section (1). "Every subscriber shall exercise reasonable care to retain control of the private key corresponding to the public key listed in his Digital Signature Certificate and take all steps to prevent its disclosure." (Some words after "disclosure" appear as omitted in the copy.)
Sub-section (2). "If the private key corresponding to the public key listed in the Digital Signature Certificate has been compromised, then, the subscriber shall communicate the same without any delay to the Certifying Authority in such manner as may be specified by the regulations."
Explanation. "For the removal of doubts, it is hereby declared that the subscriber shall be liable till he has informed the Certifying Authority that the private key has been compromised."
Three practical points:
- The standard in (1) is reasonable care to retain control, but the second duty is stronger: all steps to prevent disclosure.
- In (2) the duty is to report without any delay. The Act prints no number of hours or days; the manner is to be specified by regulations, which are not in the sources used here.
- The Explanation fixes the period of liability: the subscriber remains liable until he has informed the Certifying Authority. The text does not describe the nature or amount of that liability, and none is stated here.
Duties side by side
| Section | Duty | Key words |
|---|---|---|
| 40 | Generate the key pair by applying the security procedure | After acceptance |
| 40A | Perform prescribed duties (Electronic Signature Certificate) | Left to rules |
| 41(2) | Certifications on acceptance | Holds the private key; representations true; information within knowledge true |
| 42(1) | Retain control; prevent disclosure | Reasonable care; all steps |
| 42(2) | Report compromise | Without any delay |
A worked example
Devika, a director of Granite Logistics Private Limited, receives a Digital Signature Certificate and e-mails the certificate to the company's bank. On the words of section 41(1) she is deemed to have accepted it, and the bank, relying reasonably on it, may take it that she holds the matching private key and that the information within her knowledge is true. Devika keeps the private key on a hardware token locked in her desk. One morning the token is missing. Section 42(2) requires her to tell the Certifying Authority without any delay, and the Explanation makes her liable until she has done so. She can also ask the Authority to suspend the certificate, as explained in our article on suspension and revocation of a Digital Signature Certificate. Our guide on DSC for MCA filing covers the filing context.
Need help with key custody and signing authority?
If directors and staff hold certificates for your company, we can help you set rules on who holds the key, where it is stored and who must be told if it goes missing. Ask for a legal consultation and bring your list of certificate holders.
Key takeaways
- The subscriber generates the key pair by applying the security procedure (s.40).
- Section 40A leaves the duties of an Electronic Signature Certificate subscriber to rules.
- Publishing, authorising publication or otherwise showing approval is acceptance (s.41(1)).
- By accepting, the subscriber certifies key possession and truth of information to all who reasonably rely.
- Report a compromised private key without any delay; liability continues until the Certifying Authority is informed.
Read next
- Sections 37 to 39: suspension and revocation of a Digital Signature Certificate
- Section 43: compensation for damage to a computer and unauthorised access
- Sections 14 to 16: secure electronic record and secure electronic signature
- Digital Signature Certificate (DSC): how to get, renew and use
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.