Duties of Subscribers in IT act

Information Technology Act, 2000 (IT Act) in India establishes a legal framework for electronic transactions and communications. It provides guidelines on the use of digital signatures, the role of certifying authorities, and the responsibilities of individuals or entities using these digital tools. Subscribers, under the IT Act, are individuals or organizations that obtain a Digital Signature Certificate (DSC) for signing electronic documents.

Key Duties of Subscribers:

1. Proper Safeguarding of the Private Key:

   • One of the most critical duties of a subscriber under the IT Act is to safeguard the private key used for creating digital signatures. The private key is a crucial component in the cryptographic process, and its confidentiality is essential to maintaining the integrity of the subscriber’s digital identity.
   • Subscribers must ensure that the private key is stored securely and not shared with any unauthorized person or entity. Any compromise of the private key can lead to unauthorized use of the digital signature, which can have legal and financial consequences.

2. Notification of Key Compromise:

   • If a subscriber has reason to believe that their private key has been compromised or lost, they are required by the IT Act to immediately notify the Certifying Authority (CA) that issued the Digital Signature Certificate.
   • This prompt notification allows the Certifying Authority to revoke or suspend the certificate, preventing its misuse. Failing to notify the CA in the event of a key compromise can result in legal liabilities for the subscriber if the compromised key is used for fraudulent purposes.

3. Use of Digital Signature for Authorized Purposes:

   • Subscribers must ensure that they use their digital signature certificates only for authorized and lawful purposes. The certificate must not be used for any activity that violates the terms of use specified by the Certifying Authority or the provisions of the IT Act.
   • Any misuse of the digital signature certificate, such as for fraudulent transactions, forgery, or other illegal activities, can lead to penalties under the IT Act.

4. Ensuring Accuracy of Information:

   • Subscribers are responsible for ensuring the accuracy and truthfulness of the information provided to the Certifying Authority when applying for a Digital Signature Certificate. This includes personal identification details, contact information, and any other relevant documentation.
   • Providing false or misleading information can result in the suspension or revocation of the certificate, as well as legal action against the subscriber.

5. Retention of the Private Key:

   • A subscriber is required to retain control over the private key associated with their digital signature for the duration of its validity. The IT Act emphasizes that the private key should not be delegated or assigned to any other individual or entity.
   • The proper retention of the private key ensures that only the authorized subscriber can authenticate electronic documents, thus maintaining the integrity of digital transactions.

6. Reporting Changes in Information:

If any of the subscriber’s details (such as name, address, or email) change during the validity period of the Digital Signature Certificate, the subscriber must notify the Certifying Authority immediately. This allows the Certifying Authority to update the certificate or issue a new one with the correct information.

7. Obligations Upon Termination of Certificate:

When the validity of the Digital Signature Certificate expires or is terminated for any reason, the subscriber must stop using the certificate immediately. Continued use of an expired or revoked certificate can lead to serious legal consequences.