Sections 37 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Sections 37 to 39 of the Information Technology Act, 2000 tell a Certifying Authority when it may suspend or revoke a Digital Signature Certificate that it has issued, what hearing the subscriber must get, and how the suspension or revocation must be communicated and published. A subscriber who loses a key, or a company that is wound up, will find these sections relevant.
A Certifying Authority may suspend a certificate on the request of the subscriber or a duly authorised person, or if it thinks suspension is in the public interest; a suspension cannot exceed fifteen days unless the subscriber has been heard (s.37). It may revoke on request, on the subscriber's death, on dissolution or winding up, and on specified grounds of falsity, unmet requirements, compromise or insolvency, but not without hearing the subscriber (s.38). Notice is published in the repository specified in the certificate (s.39).
Source and scope
This article follows the consolidated text consulted (the Act as amended by the Information Technology (Amendment) Act, 2008). Later amendments and the current position of these sections should be checked. The sections speak of a "Digital Signature Certificate", defined in section 2(1)(q). If you hold certificates for a company and need a plan for suspension, revocation or loss of a key, a legal consultation can help you set one up around these provisions.
Section 37: suspension
"Subject to the provisions of sub-section (2), the Certifying Authority which has issued a Digital Signature Certificate may suspend such Digital Signature Certificate":
| Limb | Ground |
|---|---|
| (a)(i) | on receipt of a request from the subscriber listed in the certificate |
| (a)(ii) | on receipt of a request from any person duly authorized to act on behalf of that subscriber |
| (b) | if it is of opinion that the certificate should be suspended in public interest |
Sub-section (2): "A Digital Signature Certificate shall not be suspended for a period exceeding fifteen days unless the subscriber has been given an opportunity of being heard in the matter."
Sub-section (3): On suspension, the Certifying Authority shall communicate the same to the subscriber.
Notice the difference from the licence provisions: the licence of a Certifying Authority may be suspended for up to ten days without a hearing (see our article on suspension and revocation of Certifying Authority licence), while a subscriber's certificate may be suspended for up to fifteen days before the subscriber must be heard.
Section 38: revocation
Sub-section (1): revocation on request, death or dissolution
A Certifying Authority "may revoke a Digital Signature Certificate issued by it":
- (a) where the subscriber or any other person authorized by him makes a request to that effect;
- (b) upon the death of the subscriber; or
- (c) upon the dissolution of the firm or winding up of the company where the subscriber is a firm or a company.
Sub-section (2): revocation on opinion
Subject to sub-section (3) and without prejudice to sub-section (1), a Certifying Authority may revoke a certificate which it has issued at any time, if it is of opinion that:
| Clause | Ground |
|---|---|
| (a) | a material fact represented in the certificate is false or has been concealed |
| (b) | a requirement for issuance of the certificate was not satisfied |
| (c) | the Certifying Authority's private key or security system was compromised in a manner materially affecting the certificate's reliability |
| (d) | the subscriber has been declared insolvent or dead or, where the subscriber is a firm or a company, has been dissolved, wound-up or otherwise ceased to exist |
Sub-section (3): the hearing
"A Digital Signature Certificate shall not be revoked unless the subscriber has been given an opportunity of being heard in the matter." Sub-section (2) is expressly subject to this; sub-section (1) is described as "without prejudice" in sub-section (2), but sub-section (3) speaks generally of revocation. The text does not say, for the death of the subscriber, how the hearing can happen; we read it as printed and do not add to it.
Sub-section (4): communication
On revocation, the Certifying Authority shall communicate the same to the subscriber.
Section 39: notice of suspension or revocation
- Sub-section (1): where a certificate is suspended or revoked under section 37 or 38, the Certifying Authority "shall publish a notice of such suspension or revocation, as the case may be, in the repository specified in the Digital Signature Certificate for publication of such notice".
- Sub-section (2): where one or more repositories are specified, the Certifying Authority shall publish notices in all such repositories.
So the certificate itself names the repository for such notices. A person relying on a certificate can check that repository.
Suspension and revocation compared
| Feature | Suspension (s.37) | Revocation (s.38) |
|---|---|---|
| Who may ask | Subscriber or duly authorised person | Subscriber or any person authorised by him |
| Own motion | Public interest | Specified grounds in s.38(2) at any time |
| Hearing | Required if suspension exceeds fifteen days | Required before revocation |
| Triggering events | None specific | Death; dissolution or winding up; insolvency |
| Communication | To the subscriber | To the subscriber |
| Public notice | In the repository (s.39) | In the repository (s.39) |
Link with subscriber duties
A subscriber who finds the private key compromised must communicate it to the Certifying Authority without delay (section 42(2)); see our article on duties of subscribers and control of the private key. A request for suspension or revocation is one route by which the subscriber acts on that duty. The grounds for revocation also tie to the Certifying Authority's representations at the time of issue; see our article on issue of an electronic signature certificate and representations.
A worked example
Rudra Engineering LLP holds a certificate in the name of its designated partner. The partner's laptop is stolen on 3 March, and the firm requests suspension. The Certifying Authority may suspend on receipt of the request from the subscriber or a duly authorised person and must communicate the suspension to the subscriber. If the suspension is to run beyond fifteen days, the subscriber must be heard. Some weeks later the firm asks for revocation instead; the Authority may revoke on request but only after giving the subscriber an opportunity of being heard, and must communicate the revocation and publish notice in the repository specified in the certificate. Had the firm been dissolved, the Authority could have revoked on that ground under section 38(1)(c). For the practical side of certificate management, see our guide on how to get, renew and use a Digital Signature Certificate.
Need help with certificate lifecycle and key-loss planning?
If you hold certificates for directors or staff, we can help you decide who may request suspension or revocation and how the notices will be tracked. Reach out for a legal consultation and bring a list of the certificates you hold.
Key takeaways
- Suspension: on request, or in public interest; not beyond fifteen days without hearing the subscriber.
- Revocation: on request, death, dissolution or winding up, or on four grounds of opinion; hearing required.
- The subscriber must be told of suspension and of revocation.
- Notice is published in the repository specified in the certificate, and in all repositories if more than one.
- The sections print no penalty.
Read next
- Sections 40 to 42: duties of subscribers and control of the private key
- Sections 35 and 36: issue of electronic signature certificate and representations
- Sections 25 to 27: suspension and revocation of Certifying Authority licence
- Digital Signature Certificate (DSC): how to get, renew and use
Disclaimer: Based on a consolidated copy of the Information Technology Act, 2000 as amended by the Information Technology (Amendment) Act, 2008, on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as originally notified on 25 February 2021 and on the CERT-In Directions of 28 April 2022, read with the amendments made to the Act by the Jan Vishwas (Amendment of Provisions) Act, 2023 and by section 44 of the Digital Personal Data Protection Act, 2023, as consulted on 2 October 2026. Commencement notifications, other amendments, rules, directions and the current position of each provision are not covered and should be checked. This article is general information, not legal advice; check the official text before acting.