Modernising Evidence Law: The Bharatiya Sakshya Adhiniyam, 2023 (BSA) in the Digital Age

By M.G. Kodandaram, IRS, Assistant Director (Retd.), Advocate and Consultant

In an era defined by rapid technological advancements and the pervasive digitization of communication, commerce, and governance, traditional evidence laws have increasingly struggled to keep pace with the realities of a digital society. Recognizing this imperative, the Indian legislature enacted the Bharatiya Sakshya Adhiniyam, 2023 (hereafter ‘BSA’ for brevity), a landmark statute that modernizes the legal framework governing the admissibility, authenticity, and evidentiary value of electronic records and digital evidence. This legislation marks a paradigm shift from paper-based processes to a data-driven judicial system, establishing clear standards and presumptions tailored to the complexities of electronic evidence. By embracing technological neutrality, procedural rigor, and a balanced approach to evidentiary presumptions, the BSA ensures that India’s evidence law aligns with global best practices while safeguarding the principles of fairness and due process in the digital age.

The BSA, which replaces the colonial-era Indian Evidence Act of 1872, represents a significant evolution in India’s legal approach to evidence, especially in the context of electronic and digital materials. In an age marked by pervasive digitization, cyber transactions, virtual communications, and electronic documentation, issues surrounding the admissibility and evidentiary value of digital evidence have become central to both civil and criminal proceedings. The BSA introduces a modern and structured legal framework that directly addresses these challenges, covering areas such as electronic records, digital signatures, email correspondence, and digital certificates – recognizing the distinctive attributes of digital data and ensuring it is evaluated with appropriate legal and technological insight.

Departing from the outdated constructs of its predecessor, the BSA is designed to function within a digitally-driven legal ecosystem. These provisions lay down presumptions related to the authenticity, integrity, and authorship of electronic communications and records, which are vital in easing the evidentiary burden for parties relying on digital documentation and in expediting dispute resolution where electronic evidence forms the foundation of the case. Importantly, the BSA balances these presumptions with safeguards by ensuring they remain rebuttable, thus preserving the right of the opposing party to question the validity, source, or reliability of the electronic material.

 Additionally, the Act introduces qualifying criteria such as “secure electronic records,” “proper custody,” and “verified electronic signature certificates,” which act as checks against digital forgery and manipulation. This carefully constructed legal framework reflects a progressive and pragmatic approach—one that aligns with constitutional principles and procedural fairness while embracing technological advancements. This article seeks to explore the legal regime governing the admissibility and presumptions surrounding electronic evidence under the BSA, 2023. It aims to analyse the relevant statutory provisions in detail, focusing on their application to electronic records, digital signatures, emails, and certificates within judicial processes. By doing so, it evaluates how the BSA enhances the evidentiary credibility of electronic materials and contributes to a more efficient and technologically attuned justice delivery system in India. The relevant provisions of the BSA discussed in this article are included in the APPENDIX for convenient reference.

Document and Evidence

Sections 2(d) and 2(e) of the BSA lay the groundwork for a modern, technology-inclusive evidentiary regime in India by defining the key terms “document” and “evidence.” Section 2(d) adopts a broad and progressive definition of “document,” encompassing any matter expressed, described, or recorded on any medium by means of letters, figures, marks, or a combination thereof. Importantly, this definition explicitly includes electronic and digital records, thereby acknowledging the shift in how information is generated, communicated, and preserved in the digital era. The accompanying illustrations make this scope unmistakably clear by recognizing emails, server logs, files stored on computers, laptops, or smartphones, text messages, website data, geolocation information, and voicemail messages saved on digital devices as valid documents. This ensures that electronic data is placed on equal footing with conventional paper-based documentation in legal proceedings.

Further, Section 2(e) provides a comprehensive definition of “evidence,” distinguishing it into two primary forms: oral and documentary. Sub-clause (i) includes all statements made before the court by witnesses concerning the facts under inquiry, whether communicated in person or through electronic means, and categorizes them as oral evidence. Sub-clause (ii) encompasses all documents presented to the court for its examination, including electronic and digital records, and classifies them as documentary evidence. By formally recognizing electronically delivered witness statements as oral evidence and treating digitally stored material as documentary evidence, the BSA affirms its adaptability to contemporary modes of communication and record-keeping.

Together, these definitions emphasise the Act’s commitment to integrating technological advancements into the fabric of evidentiary law. They provide a robust and future-ready legal foundation for the admissibility and treatment of electronic materials in judicial processes, aligning Indian evidentiary standards with the realities of a digital society.

Accommodation of Digital Evidentiary Framework

The BSA marks a transformative shift in Indian evidentiary law by establishing a technologically inclusive framework that integrates both traditional and digital forms of evidence. Recognizing the prevalence of electronic communication and data storage, the Act modernizes foundational legal principles to align with contemporary realities. Section 15 expands the concept of “admission” to include statements, whether oral, documentary, or electronic, that suggest an inference about a fact in issue or a relevant fact. This inclusive definition ensures that emails, text messages, audio-video recordings, and other digital communications are legally recognized as admissions, reflecting the centrality of digital interactions in modern life. Similarly, Section 28 extends the admissibility of entries in books of account to those maintained electronically, such as accounting software logs and cloud-based ledger systems. While such records are deemed relevant when maintained in the regular course of business, the provision sensibly asserts that they cannot be conclusive proof on their own, thereby maintaining the evidentiary balance. Section 29 furthers this digital accommodation by recognizing entries in public or official records – including those created electronically by public servants in the discharge of official duties – as relevant facts. This effectively legitimizes digital land records, online registries, and other e-governance databases as valid evidentiary sources. Section 31 reinforces the evidentiary value of public documents by affirming that facts of public nature may be proven through recitals in Central or State Acts or official notifications, whether in printed or electronic form. This affirms the admissibility of digital gazettes and e-governance portals, which are now primary channels of public legal communication. Moreover, Section 32 confirms the relevancy of legal texts, including those in digital formats, allowing courts to rely on online legal databases, government-authorized e-books, and electronic case law compilations for interpreting statutes and precedents. Collectively, these provisions embody the BSA’s forward-looking vision, recognizing that digital evidence is not merely supplementary but often central to judicial inquiry. By firmly embedding digital records within the evidentiary structure, the BSA ensures that the Indian legal system remains responsive, reliable, and robust in the face of technological transformation.

Evidentiary Rules for the Digital Regime

The BSA significantly updates the evidentiary framework to address the complexities introduced by technological advancement, forensic science, and digital communication. Central to this modernization is the contextual evaluation of statements, the recognition of expert opinions, and the authentication of both handwritten and electronic signatures. Section 33 addresses the need to interpret statements, whether in oral, written, or electronic form, within their broader context. It mandates that only so much of a conversation, book, letter, document, or electronic record be produced as is necessary for a full understanding of the statement’s meaning and effect. This is particularly crucial in the digital age, where decontextualized excerpts from emails, chat threads, or social media messages can mislead or distort the truth. By requiring courts to examine communications in their full narrative, the BSA safeguards against misrepresentation and partial evidence.

Section 39 reinforces the evidentiary value of expert opinion in complex legal matters. Sub-section (1) validates the admissibility of expert views in areas like foreign law, science, medicine, handwriting, and fingerprint analysis—ensuring courts are guided by professional expertise when navigating technical subjects. More critically, sub-section (2) introduces a specific provision for digital forensics, recognizing the opinion of the Examiner of Electronic Evidence under Section 79A of the Information Technology Act, 2000 as relevant and authoritative. This formal integration of cyber forensics into the legal process equips courts with the tools to understand electronic logs, metadata, encrypted files, and digital signatures—thus fortifying the evidentiary basis for decisions involving digital records.

Section 41 further bolsters the authentication process by allowing courts to admit opinions on handwriting from persons familiar with it, while extending this principle to digital signatures through Certifying Authorities under the IT Act. This ensures the validity of electronic signatures used in e-governance, digital contracts, and online transactions, thereby reinforcing trust in the digital economy. Collectively, these provisions build a robust legal mechanism that blends traditional evidentiary principles with cutting-edge digital norms.

Primary Evidence under the BSA

Section 57 of the BSA reaffirms the foundational principle of primary evidence by emphasizing the evidentiary primacy of original documents in judicial proceedings. Defined as the document itself produced for court inspection, primary evidence retains its superior status over secondary forms, ensuring authenticity and integrity in adjudication. However, the BSA marks a significant evolution from the previous legal framework by expanding this concept to comprehensively accommodate electronic and digital records, thereby modernizing the evidentiary regime in line with contemporary technological practices.

The section is bolstered by seven explanatory clauses that broaden the understanding of what qualifies as primary evidence. Explanations 1 and 2 deal with multipart documents and counterparts, affirming that each part or version executed by different parties constitutes primary evidence with respect to those signatories. This is particularly relevant for commercial transactions involving joint deeds or bilateral contracts. Explanation 3 recognizes documents uniformly produced through methods like printing or photography, deeming each identical copy as primary evidence of the others, though not of the original matrix—thus distinguishing between derivative replication and authorship. The section’s most forward-looking provisions lie in Explanations 4 through 7, which formally integrate electronic and digital documentation into the definition of primary evidence. Explanation 4 provides that digital records created or stored in multiple files, either simultaneously or sequentially, each qualify as primary evidence. Explanation 5 introduces a legal presumption in favour of the authenticity of digital records produced from proper custody – such as secure corporate or government systems – unless specifically challenged. Explanations 6 and 7 further extend this rationale to electronically stored video recordings and even transient or automated files like cache memory and backup data, thereby encompassing evidence generated through modern surveillance, telecommunication, and computing systems.

These provisions reflect a nuanced understanding of how digital information is created, stored, and transmitted, and ensure that such formats are not excluded merely for their intangible or technical nature. The illustrative example accompanying the section reinforces the principle by clarifying that multiple printed placards serve as primary evidence of one another, but not of the original design—maintaining the conceptual distinction between original creation and mechanical reproduction. Section 57 of the BSA provides a robust evidentiary framework for courts to deal with complex documentation, especially in areas such as digital contracts, cybercrime, commercial disputes, and electronically stored information (ESI).

Electronic Evidence under BSA

Sections 61, 62, and 63 of the BSA lay down the foundation for treating electronic records as valid evidence, clarifying conditions for admissibility, and detailing the procedural safeguards to ensure authenticity and reliability.

Electronic or Digital Record: Section 61 affirms the fundamental principle that the mere nature of a record being electronic or digital shall not negate its admissibility in evidence. This section is a declaratory provision that combats any inherent bias or scepticism towards electronic records, which traditionally faced hurdles in Indian courts. As per this provision the Electronic or digital records have the same legal effect, validity, and enforceability as paper documents, provided they meet the conditions prescribed in subsequent sections. This provision essentially removes any procedural or substantive bar against admitting electronic records solely on the basis that they are not in physical paper form. The phrase “subject to section 63” indicates that while electronic records are admissible, their authenticity and integrity must be established as per the conditions set out in Section 63.

This section aligns with international best practices and legal trends such as those under the Indian Evidence Act (Section 65A and 65B) and international instruments like the UNCITRAL Model Law on Electronic Evidence.

Section 62 is a brief but significant provision that connects Section 61 and Section 63 by stipulating that the contents of electronic records must be proved in accordance with the provisions of Section 63. This emphasizes that although electronic records are admissible, their proof requires adherence to specified conditions to guarantee reliability. This ensures a uniform and consistent evidentiary standard in the treatment of electronic records, preventing arbitrary admission or rejection based solely on their electronic nature.

Availability of Electronic Records

Section 63 prescribes detailed conditions and procedural safeguards to admit electronic records as evidence without requiring the production of the original.

Sub-section (1): Computer Output Deemed Document: The provision states that information contained in an electronic record printed on paper or stored in any electronic form (optical, magnetic media, semiconductor memory, etc.) is termed “computer output.” Such computer output will be deemed a document and admissible in legal proceedings if certain conditions are met. Importantly, this admissibility is without the need for further proof or production of the original, addressing the practical difficulties in producing original electronic data. This marks a significant shift towards presumption of authenticity for electronic records, reflecting the realities of digital data handling.

Sub-section (2): Conditions for Admissibility: This sub-section enumerates four critical conditions that must be satisfied to admit computer output as evidence:

  1. Regular Usage (Clause a): The computer or device producing the output must have been used regularly over a period for activities carried out by a person with lawful control over the device. This indicates a routine or systematic usage, enhancing credibility.
  2. Regular Feeding of Information (Clause b): The type of information in the electronic record must have been regularly fed into the computer during that period in the ordinary course of business or activity.
  3. Proper Functioning (Clause c): Throughout the relevant period, the computer or device must have been operating properly, or if not, any malfunction should not affect the accuracy or reliability of the electronic record.
  4. Derivation from Original Input (Clause d): The electronic record must faithfully reproduce or derive from the inputted information fed into the device.

These conditions collectively ensure that the electronic record is reliable, authentic, and free from tampering or error.

Sub-section (3): Multiple Devices Treated as Single Device: Recognizing the complexity of modern IT systems, sub-section (3) states that if multiple computers or devices are involved in creating, storing, or processing information as part of a regular activity, these shall be treated as a single computer or communication device for the purpose of admissibility. This includes standalone devices, computer systems, networks, computer resources, or intermediaries. This provision simplifies evidentiary treatment of distributed computing environments and networked systems prevalent in corporate and government setups.

Sub-section (4): Requirement of a Certificate: To reinforce the credibility and authenticity of electronic records, Section 63(4) mandates that every electronic record submitted as evidence must be accompanied by a certificate. The certificate must identify the electronic record and describe how it was produced. It must provide particulars of any device involved. It must address the conditions laid down in sub-section (2) (regular use, proper functioning, etc.). The certificate must be signed by a person responsible for the device or the management of the relevant activities. The certificate is prima facie evidence of the matters stated therein. This certification requirement institutionalizes the concept of a “self-authenticating electronic document,” reducing the need for viva voce evidence on authenticity.

Sub-section (5): Interpretation Provisions: This subsection clarifies:

  • How information is “supplied” to a computer — whether directly or via equipment, with or without human intervention.
  • That a computer output includes data produced by the device directly or electronically by any appropriate equipment.

This wide interpretation ensures the law covers the entire spectrum of digital data creation and processing technologies.

Legal and Practical Implications

The introduction of Sections 61 to 63 of the BSA are tailored to meet the demands of a digitized world by explicitly recognizing the legal validity and enforceability of electronic evidence. One of the most crucial implications of this framework is its role in facilitating digital transactions and streamlining judicial processes. By eliminating outdated barriers to the admissibility of electronic evidence, the law ensures that courts can function more efficiently and with greater technological competence. In an era where emails, digital contracts, CCTV footage, and electronic data are integral to both personal and commercial affairs, such legal support for technology-friendly processes is indispensable.

Equally important are the built-in safeguards against misuse and error. The law mandates that for electronic evidence to be admissible, it must stem from a device that was in regular use and functioning properly at the time the evidence was created. Furthermore, certification under Section 63 is required to validate the authenticity of the record. These conditions work together to minimize the risks of fraud and manipulation, thereby reinforcing trust in the reliability of digital documentation.

From a procedural standpoint, the BSA significantly reduces litigation and delays traditionally associated with proving the genuineness of electronic records. By allowing admissibility without the need to produce the original electronic device and simplifying certification requirements, the law helps avoid cumbersome technical disputes. This streamlining of evidentiary procedures saves judicial time and supports the broader goal of timely justice.

Another notable feature of the BSA’s approach to electronic evidence is its alignment with international standards. By harmonizing Indian evidentiary law with global norms, these sections pave the way for smoother cross-border cooperation in legal matters, particularly in commercial and cyber-related disputes. This is especially relevant in today’s interconnected digital economy, where international transactions and communications are the norm.

Proof of Electronic Signature

Section 66 of the BSA governs the proof of electronic signatures, anchoring the legal framework for digital authentication in judicial proceedings. It stipulates that unless an electronic signature qualifies as a “secure electronic signature” under the Information Technology Act, 2000, the party relying on it bears the burden of proving that the signature indeed belongs to the alleged subscriber. This provision introduces a critical safeguard against digital impersonation, unauthorized use, and fraudulent assertions, by ensuring that only verified and attributable electronic endorsements are accepted as evidence. In contrast, secure electronic signatures, which are generated using a valid digital signature certificate issued by a licensed certifying authority, enjoy a legal presumption of authenticity. This significantly reduces the evidentiary burden for parties relying on such certified signatures, thereby enhancing legal confidence in secure digital infrastructure.

Complementing this, Section 136 upholds legal privilege and confidentiality by protecting individuals from being compelled to produce documents or electronic records that someone else could lawfully withhold. This includes sensitive digital data held by intermediaries such as employers, service providers, or legal professionals, thereby extending traditional protections (such as attorney-client privilege or spousal confidentiality) into the digital realm.

Presumptions as to Electronic Documents

The BSA introduces a technologically responsive framework for presuming the authenticity and validity of electronic records, thereby modernizing the evidentiary regime in India. Section 81 creates a foundational presumption in favor of official electronic records, including those purporting to be the Official Gazette or other legally mandated records, provided they are produced from proper custody and conform substantially to legal standards. The accompanying explanation broadens the notion of “proper custody” to account for practical realities, such as cloud storage and decentralized digital systems, by accepting records of probable authenticity even if not stored in traditional locations. Complementing this, Section 85 empowers courts to presume the due execution of electronic agreements that contain digital or electronic signatures of the parties, thus providing legal sanctity to electronic contracts and promoting ease of business in an increasingly digital commercial environment. Section 86 elevates the evidentiary status of secure electronic records and secure electronic signatures by mandating presumptions of their authenticity and integrity, subject to compliance with secure protocols such as encryption and digital key infrastructure. This presumption, however, is deliberately withheld for non-secure digital records, thus maintaining judicial discretion and incentivizing the adoption of secure technologies. Section 87 furthers this framework by presuming the accuracy of entries in an Electronic Signature Certificate – except for explicitly unverified subscriber information – thereby reinforcing the credibility of India’s licensed certifying authority ecosystem and easing the evidentiary burden on parties relying on digital signatures. Section 90 addresses the complexities of electronic communication by permitting the court to presume that the content received by a recipient is identical to that sent by the originator, while rightly refraining from presuming the sender’s identity, thereby safeguarding against forgery, phishing, and spoofing. Finally, Section 93 adapts the classical presumption for ancient documents to the digital age by allowing courts to presume the authenticity of electronic records that are at least five years old, bear an electronic signature, and are produced from proper custody. These collective presumptions ensure that digital documents—whether official records, private agreements, or historical data—receive appropriate evidentiary value, while maintaining procedural safeguards to prevent misuse. By enabling courts to rely on the integrity, security, and legal enforceability of digital evidence, the Adhiniyam aligns Indian evidence law with global technological standards, striking a careful balance between judicial efficiency and due process.

Closing Remarks

The BSA marks a transformative step in aligning India’s evidentiary framework with the demands of an increasingly digital society. As electronic communications, transactions, and records become integral to both governance and private affairs, the Act provides a timely and sophisticated legal infrastructure to recognize, admit, and evaluate electronic evidence. It replaces outdated procedural norms with a forward-looking regime that is technologically neutral and jurisprudentially robust.

By statutorily recognizing diverse forms of electronic evidence – from digital agreements and emails to electronic signature certificates and official gazettes – the BSA ensures their admissibility and attaches appropriate presumptions to ease their use in judicial proceedings. Overall, the Act embodies a progressive yet cautious approach, facilitating judicial efficiency while safeguarding due process. It acknowledges the shift from paper to data and lays a resilient foundation for the legal system to adapt to ongoing technological evolution. As jurisprudence develops under this new framework, the judiciary’s interpretative role will be pivotal in shaping a dynamic and credible digital evidence regime that serves the goals of justice in a digitized India.

By providing a comprehensive legal framework that recognizes, regulates, and validates electronic evidence, the Act not only facilitates judicial efficiency but also reinforces the integrity and reliability of digital records in legal proceedings. Its balanced approach, – combining robust presumptions with safeguards against misuse, – ensures that technology enhances rather than compromises the administration of justice.

Appendix-Extracts from the Bharatiya Sakshya Adhiniyam 2023 (BSA)

  • Section 2 (d) “document” means any matter expressed or described orotherwise recorded upon any substance by means of letters, figures or marks or any other means or by more than one of those means, intended to be used, or which may be used, for the purpose of recording that matter and includes electronic and digital records.

Illustrations.

(vi) An electronic record on emails, server logs, documents on computers, laptop or smartphone, messages, websites, locational evidence and voice mail messages stored on digital devices are documents;

  • Section 2 (e) “evidence” means and includes—

(i) all statements including statements given electronically which the Court permits or requires to be made before it by witnesses in relation to matters of fact under inquiry and such statements are called oral evidence;

(ii) all documents including electronic or digital records produced for the inspection of the Court and such documents are called documentary evidence;

  • Section 15. Admission defined. —An admission is a statement, oral or documentary or contained in electronic form, which suggests any inference as to any fact in issue or relevant fact, and which is made by any of the persons, and under the circumstances, hereinafter mentioned.
  • Section 28. Entries in books of account when relevant. —Entries in the books of account, including those maintained in an electronic form, regularly kept in the course of business are relevant whenever they refer to a matter into which the Court has to inquire, but such statements shall not alone be sufficient evidence to charge any person with liability.
  • Section 29. Relevancy of entry in public record or an electronic record made in performance of duty.—An entry in any public or other official book, register or record or an electronic record, stating a fact in issue or relevant fact, and made by a public servant in the discharge of his official duty, or by any other person in performance of a duty specially enjoined by the law of the country in which such book, register or record or an electronic record, is kept, is itself a relevant fact.
  • Section 31. Relevancy of statement as to fact of public nature contained in certain Acts or notifications.—When the Court has to form an opinion as to the existence of any fact of a public nature, any statement of it, made in a recital contained in any Central Act or State Act or in a Central Government or State Government notification appearing in the respective Official Gazette or in any printed paper or in electronic or digital form purporting to be such Gazette, is a relevant fact.
  • Section 32. Relevancy of statements as to any law contained in law books including electronic or digital form.—When the Court has to form an opinion as to a law of any country, any statement of such law contained in a book purporting to be printed or published including in electronic or digital form under the authority of the Government of such country and to contain any such law, and any report of a ruling of the Courts of such country contained in a book including in electronic or digital form purporting to be a report of such rulings, is relevant.
  • Section 33. What evidence to be given when statement forms part of a conversation, document, electronic record, book or series of letters or papers.—When any statement of which evidence is given forms part of a longer statement, or of a conversation or part of an isolated document, or is contained in a document which forms part of a book, or is contained in part of electronic record or of a connected series of letters or papers, evidence shall be given of so much and no more of the statement, conversation, document, electronic record, book or series of letters or papers as the Court considers necessary in that particular case to the full understanding of the nature and effect of the statement, and of the circumstances under which it was made.
  • Section 39. Opinions of experts.—(1) When the Court has to form an opinion upon a point of foreign law or of science or art, or any other field, or as to identity of handwriting or finger impressions, the opinions upon that point of persons specially skilled in such foreign law, science or art, or any other field, or in questions as to identity of handwriting or finger impressions are relevant facts and such persons are called experts.

Illustrations.

(a) The question is, whether the death of A was caused by poison. The opinions of experts as to the symptoms produced by the poison by which A is supposed to have died, are relevant.

(b) The question is, whether A, at the time of doing a certain act, was, by reason of unsoundness of mind, incapable of knowing the nature of the act, or that he was doing what was either wrong or contrary to law. The opinions of experts upon the question whether the symptoms exhibited by A commonly show unsoundness of mind, and whether such unsoundness of mind usually renders persons incapable of knowing the nature of the acts which they do, or of knowing that what they do is either wrong or contrary to law, are relevant.

(c) The question is, whether a certain document was written by A. Another document is produced which is proved or admitted to have been written by A. The opinions of experts on the question whether the two documents were written by the same person or by different persons, are relevant.

(2) When in a proceeding, the court has to form an opinion on any matter relating to any information transmitted or stored in any computer resource or any other electronic or digital form, the opinion of the Examiner of Electronic Evidence referred to in section 79A of the Information Technology Act, 2000 (21 of 2000), is a relevant fact.

Explanation. —For the purposes of this sub-section, an Examiner of Electronic Evidence shall be an expert.

  • Section 41. Opinion as to handwriting and signature, when relevant. — (1) When the Court has to form an opinion as to the person by whom any document was written or signed, the opinion of any person acquainted with the handwriting of the person by whom it is supposed to be written or signed that it was or was not written or signed by that person, is a relevant fact.

(2) When the Court has to form an opinion as to the electronic signature of any person, the opinion of the Certifying Authority which has issued the Electronic Signature Certificate is a relevant fact.

  • Section 57. Primary evidence. —Primary evidence means the document itself produced for the inspection of the Court.

Explanation 1. —Where a document is executed in several parts, each part is primary evidence of the document.

Explanation 2. —Where a document is executed in counterpart, each counterpart being executed by one or some of the parties only, each counterpart is primary evidence as against the parties executing it.

Explanation 3. —Where a number of documents are all made by one uniform process, as in the case of printing, lithography or photography, each is primary evidence of the contents of the rest; but, where they are all copies of a common original, they are not primary evidence of the contents of the original.

Explanation 4. —Where an electronic or digital record is created or stored, and such storage occurs simultaneously or sequentially in multiple files, each such file is primary evidence.

Explanation 5. —Where an electronic or digital record is produced from proper custody, such electronic and digital record is primary evidence unless it is disputed.

Explanation 6. —Where a video recording is simultaneously stored in electronic form and transmitted or broadcast or transferred to another, each of the stored recordings is primary evidence.

Explanation 7. —Where an electronic or digital record is stored in multiple storage spaces in a computer resource, each such automated storage, including temporary files, is primary evidence.

Illustration.

A person is shown to have been in possession of a number of placards, all printed at one time from one original. Any one of the placards is primary evidence of the contents of any other, but no one of them is primary evidence of the contents of the original.

  • Section 61. Electronic or digital record. —Nothing in this Adhiniyam shall apply to deny the admissibility of an electronic or digital record in the evidence on the ground that it is an electronic or digital record and such record shall, subject to section 63, have the same legal effect, validity and enforceability as other document.
  • Section 62. Special provisions as to evidence relating to electronic record. —The contents of electronic records may be proved in accordance with the provisions of section 63.
  • Section 63. Admissibility of electronic records.—(1) Notwithstanding anything contained in this Adhiniyam, any information contained in an electronic record which is printed on paper, stored, recorded or copied in optical or magnetic media or semiconductor memory which is produced by a computer or any communication device or otherwise stored, recorded or copied in any electronic form (hereinafter referred to as the computer output) shall be deemed to be also a document, if the conditions mentioned in this section are satisfied in relation to the information and computer in question and shall be admissible in any proceedings, without further proof or production of the original, as evidence or any contents of the original or of any fact stated therein of which direct evidence would be admissible.

(2) The conditions referred to in sub-section (1) in respect of a computer output shall be the following, namely: —

(a) the computer output containing the information was produced by the computer or communication device during the period over which the computer or Communication device was used regularly to create, store or process information for the purposes of any activity regularly carried on over that period by the person having lawful control over the use of the computer or communication device;

(b) during the said period, information of the kind contained in the electronic record or of the kind from which the information so contained is derived was regularly fed into the computer or Communication device in the ordinary course of the said activities;

(c) throughout the material part of the said period, the computer or communication device was operating properly or, if not, then in respect of any period in which it was not operating properly or was out of operation during that part of the period, was not such as to affect the electronic record or the accuracy of its contents; and

(d) the information contained in the electronic record reproduces or is derived from such information fed into the computer or Communication device in the ordinary course of the said activities.

(3) Where over any period, the function of creating, storing or processing information for the purposes of any activity regularly carried on over that period as mentioned in clause (a) of sub-section (2) was regularly performed by means of one or more computers or communication device, whether—

(a) in standalone mode; or

(b) on a computer system; or

(c) on a computer network; or

(d) on a computer resource enabling information creation or providing information processing and storage; or

(e) through an intermediary,

all the computers or communication devices used for that purpose during that period shall be treated for the purposes of this section as constituting a single computer or communication device; and references in this section to a computer or communication device shall be construed accordingly.

(4) In any proceeding where it is desired to give a statement in evidence by virtue of this section, a certificate doing any of the following things shall be submitted along with the electronic record at each instance where it is being submitted for admission, namely: —

(a) identifying the electronic record containing the statement and describing the manner in which it was produced;

(b) giving such particulars of any device involved in the production of that electronic record as may be appropriate for the purpose of showing that the electronic record was produced by a computer or a communication device referred to in clauses (a) to (e) of sub-section (3);

(c) dealing with any of the matters to which the conditions mentioned in sub-section (2) relate,

and purporting to be signed by a person in charge of the computer or communication device or the management of the relevant activities (whichever is appropriate) and an expert shall be evidence of any matter stated in the certificate; and for the purposes of this sub-section, it shall be sufficient for a matter to be stated to the best of the knowledge and belief of the person stating it in the certificate specified in the Schedule.

(5) For the purposes of this section, — (a) information shall be taken to be supplied to a computer or communication device if it is supplied thereto in any appropriate form and whether it is so supplied directly or (with or without human intervention) by means of any appropriate equipment;

(b) a computer output shall be taken to have been produced by a computer or communication device whether it was produced by it directly or (with or without human intervention) by means of any appropriate equipment or by other electronic means as referred to in clauses (a) to (e) of sub-section (3).

  • Section 66. Proof as to electronic signature. —Except in the case of a secure electronic signature, if the electronic signature of any subscriber is alleged to have been affixed to an electronic record, the fact that such electronic signature is the electronic signature of the subscriber must be proved.
  • Section 81. Presumption as to Gazettes in electronic or digital record. —The Court shall presume the genuineness of every electronic or digital record purporting to be the Official Gazette, or purporting to be electronic or digital record directed by any law to be kept by any person, if such electronic or digital record is kept substantially in the form required by law and is produced from proper custody.

Explanation.For the purposes of this section and section 93 electronic records are said to be in proper custody if they are in the place in which, and looked after by the person with whom such document is required to be kept; but no custody is improper if it is proved to have had a legitimate origin, or the circumstances of the particular case are such as to render that origin probable.

  • Section 85. Presumption as to electronic agreements. —The Court shall presume that every electronic record purporting to be an agreement containing the electronic or digital signature of the parties was so concluded by affixing the electronic or digital signature of the parties.
  • Section 86. Presumption as to electronic records and electronic signatures. — (1) In any proceeding involving a secure electronic record, the Court shall presume unless contrary is proved, that the secure electronic record has not been altered since the specific point of time to which the secure status relates.

(2) In any proceeding, involving secure electronic signature, the Court shall presume unless the contrary is proved that

(a) the secure electronic signature is affixed by subscriber with the intention of signing or approving the electronic record;

(b) except in the case of a secure electronic record or a secure electronic signature, nothing in this section shall create any presumption, relating to authenticity and integrity of the electronic record or any electronic signature.

  • Section 87. Presumption as to Electronic Signature Certificates. —The Court shall presume, unless contrary is proved, that the information listed in an Electronic Signature Certificate is correct, except for information specified as subscriber information which has not been verified, if the certificate was accepted by the subscriber.
  • Section 90. Presumption as to electronic messages. —The Court may presume that an electronic message, forwarded by the originator through an electronic mail server to the addressee to whom the message purports to be addressed corresponds with the message as fed into his computer for transmission; but the Court shall not make any presumption as to the person by whom such message was sent.
  • Section 93. Presumption as to electronic records five years old. —Where any electronic record, purporting or proved to be five years old, is produced from any custody which the Court in the particular case considers proper, the Court may presume that the electronic signature which purports to be the electronic signature of any particular person was so affixed by him or any person authorised by him in this behalf.

Explanation.The Explanation to section 81 shall also apply to this section.

  • Section 136. Production of documents or electronic records which another person, having possession, could refuse to produce. —No one shall be compelled to produce documents in his possession or electronic records under his control, which any other person would be entitled to refuse to produce if they were in his possession or control, unless such last-mentioned person consents to their production.

THE SCHEDULE

[See section 63(4)(c)]

CERTIFICATE

PART A

(To be filled by the Party)

I, _____________________ (Name), Son/daughter/spouse of ___________________ residing/employed at __________________________ do hereby solemnly affirm and sincerely state and submit as follows:—

I have produced electronic record/output of the digital record taken from the following device/digital record source (tick mark):—

Computer / Storage Media □ DVR □ Mobile □ Flash Drive □

CD/DVD □ Server □ Cloud □ Other □

Other: ________________________________________

Make & Model: _______________ Color: _______________

Serial Number: _______________

IMEI/UIN/UID/MAC/Cloud ID_____________________ (as applicable)

and any other relevant information, if any, about the device/digital record____(specify).

The digital device or the digital record source was under the lawful control for regularly creating, storing or processing information for the purposes of carrying out regular activities and during this period, the computer or the communication device was working properly and the relevant information was regularly fed into the computer during the ordinary course of business. If the computer/digital device at any point of time was not working properly or out of operation, then it has not affected the electronic/digital record or its accuracy. The digital device or the source of the digital record is: —

Owned □ Maintained □ Managed □ Operated□

by me (select as applicable).

I state that the HASH value/s of the electronic/digital record/s is _________________,

obtained through the following algorithm: —

□ SHA1:

□ SHA256:

□ MD5:

□ Other__________________ (Legally acceptable standard)

(Hash report to be enclosed with the certificate)

(Name and signature)

Date (DD/MM/YYYY): _____

Time (IST): ________hours (In 24 hours format)

Place: ____________

PART B

(To be filled by the Expert)

I, ____________________ (Name), Son/daughter/spouse of ____________________

residing/employed at _________________________ do hereby solemnly affirm and sincerely state and submit as follows: —

The produced electronic record/output of the digital record are obtained from the following

device/digital record source (tick mark): —

Computer / Storage Media □ DVR □ Mobile □ Flash Drive □

CD/DVD □ Server □ Cloud □ Other □

Other: ________________________________________

Make & Model: _______________ Color: _______________

Serial Number: _______________

IMEI/UIN/UID/MAC/Cloud ID_____________________ (as applicable)

and any other relevant information, if any, about the device/digital record_______(specify).

I state that the HASH value/s of the electronic/digital record/s is _____________________,

obtained through the following algorithm: —

□ SHA1:

□ SHA256:

□ MD5:

□ Other__________________ (Legally acceptable standard)

(Hash report to be enclosed with the certificate)

(Name, designation and signature)

Date (DD/MM/YYYY): _____

Time (IST): ________hours (In 24 hours format)

Place: ____________

This is a guest article published on request..Naavi

Readers may also view:

https://www.naavi.org/wp/section-63-of-bharatiya-sakshya-adhiniyam/

https://www.bing.com/search?cp=CODE+PAGE+USED+BY+YOUR+HTML+PAGE&FORM=FREESS&q=sec63&q1=site%3Awww.naavi.org

Posted in Cyber Law | Leave a comment

Has Niti Aayog Website been hacked?

For the last several months, I have been struggling with the registration on NGO Darpan website for our Section 8 company.

Government of India introduced Darpan Registration to ensure that Government funding should not go to anti national NGOs. But in the process, some body in RBI circulated to all Banks and REs that Darpan Registration is a mandatory requirement for KYC even if no funding is obtained by the organization from Government sources.

As a result, NGOs not having registration are facing difficulties in collecting genuine revenue for their operations including membership fees. The registration system is however broken for a long time and making it impossible for companies to obtain new registrations creating problems for many NGOs.

Failure of the Darpan Registration system is choking the NGOs by disabling their digital payment system. The problem is going un noticed by the CEO and the Chairman.

Despite e-mails, Linked in posts, X posts etc., Niti Ayog officials are not responding. This is completely unacceptable. I am surprised that even the CEO of Niti Ayog Mr B V R Subramanyam is not able to respond to emails at ceo@niti.gov.in

Today I also found out that there are several You Tube videos explaining step by step instructions for completing the simple web registration. This itself is a vindication that the problem of registration is wide spread and has not been attended to for a long time. In fact Niti Ayog should consider it as an insult that consultants have to post videos to show how the registration has to be completed on the website. This should have been simple enough for any person to complete without spending so much of efforts. Despite using all permutations and combinations for registration, it aways ends up with a 404 error.

There could be two reasons for this complete breakdown of the Darpan Website.

First is that Niti Ayog is not able to manage its day to day administration and is only a paper institution for creating reports and meeting the PM. If so, it is for the Chairman to set it right.

A more likely reason could be that the website of Darpan is not under the control of authorized persons and has been hacked either by an external agency or by rogue employees or a website manager.

Such things usually happen when Government agencies donot pay the service providers maintaining the website and one of them tries to prove their power by creating such problems.

I wish that atleast after this public post, the CEO looks into the administration and ensure that it is functional.

In the mean time, I request RBI to withdraw its instructions on KYC making Darpan Registration mandatory by sending a suitable circular deferring their earlier instructions if any.

Naavi

Posted in Cyber Law | Leave a comment

AI regulation through Model clauses in Australia

As compared to the US approach suggested by Donald Trump on allowing freedom from regulation, Australia has released a set of AI model clauses that is useful for any AI user. These are more practical and can be adopted.

The Australian guideline has recognized the following three scenarios and suggested contractual regulation between the buyer and the seller.

  1. When an organization procures services from a seller using AI in such provision of the services; (Bespoke AI systems)
  2. When an organization develops AI (such as automated decision-making tools) within their own organisation with assistance from a consultant; or
  3. When an organization procures software with embedded AI capabilities.

This approach of using “Contractual Controls” on the use of AI is more in sync with the Indian approach and is in tune with the requirements of ITA 2000 and DPDPA2023.

Key Sections and Highlights
1. AI Use in Service Provision
  • Sellers must notify and obtain buyer approval before using AI systems in delivering services.
  • Sellers are responsible for accuracy, quality assurance, and record keeping related to AI use.
  • Use of banned AI systems (e.g., DeepSeek products) is prohibited, with immediate notification and removal required if discovered.
2. Development and Provision of AI Systems
  • Sellers must develop and deliver AI systems per detailed Statements of Requirement specifying intended use, environment, integration, training, testing, acceptance, and reporting.
  • Transparency of underlying AI models is required, including country of origin, ownership, and data location.
  • Sellers must notify buyers immediately of AI incidents, hazards, or malfunctions and comply with buyer directions.
  • A “circuit breaker” mechanism must be included to allow immediate human intervention or shutdown of the AI system.
  • Fairness clauses require AI systems to avoid discrimination, harm, or reputational risk, with optional provisions addressing inclusivity and ethical operation.
3. Compliance and Privacy
  • Sellers must comply with applicable laws, policies, and privacy obligations, including handling eligible data breaches and supply chain security.
4. Oversight, Explainability, and Transparency
  • Human oversight is mandated, with requirements for competence and expertise.
  • Transparency and explainability standards must be met, including regular reporting.
5. Training, Testing, and Monitoring
  • Clauses cover training data requirements, ongoing testing, monitoring, and optional acceptance and pilot testing phases.
  • User manuals and training for AI system users are optional but recommended.
6. Updates, Security, and Record-Keeping
  • Provisions for iterative updates, source code access (optional), digital security, and detailed record-keeping including audit and logging capabilities.
7. Intellectual Property and Data Use
  • Rights and warranties related to contract materials, third-party software, and buyer data are defined.
  • Seller use of buyer data is restricted to contract terms, with prohibitions on unauthorized data mining and requirements for data security.
8. Handover and Destruction
  • Procedures for handover, destruction, or return of AI datasets and buyer data at contract end.
9. Risk Management (Optional)
  • Sellers may be required to comply with buyer AI policies and risk management systems aligned to ISO/IEC 42001:2023 standards.
  • Sellers must establish, implement, and maintain AI risk management systems with due diligence and record retention.

The above principles have already been adopted under DGPSI the Golden standard of DPDPA compliance framework in the following form.

a) The responsibility for the consequences of an AI is that of the Data Fiduciary

b) In Risk assessment of an AI algorithm, the disclosures and assurances of the supplier has to be taken into account including asking for test related assurances like in the FDA-CFR compliance.

c) Developers need to provide indemnities to the users if the source code is proprietary

d) If Risk is unknown and indeterminate the user is considered as a “Data Fiduciary” even if otherwise he is a data processor not determining the main purpose of processing of DPDPA protected data.

Naavi

Refer here:

  1. Details from Digital Transformation Agency
  2. Model clauses suggested in EU

Posted in Cyber Law | Leave a comment

“Big Beautiful Bill”

Mr Donald Trump who has already struck a few ups and downs in his policy drive now has entered the AI regulation domain.

What is termed as a Draft Big Beautiful Bill (OBBB) bans all state-level AI regulations for the next 10 years.

There is an expectation that this would have a “Freedom first” approach to US-AI laws (Refer here). Given the fickleness of Mr Donald Trump, I donot think this would turn out to be an “freedom to innovate”. It could only be a different approach to AI regulation in USA.

OBBB does not mean that AI will not be regulated in USA. It only means that the US Federal regulations will be the only regulatory agency for AI. This is an attempt to Centralize the AI regulation in USA.

OBBB also does not mean that Indian businesses can use any AI algorithm without responsibility. Any user of AI in India will have the vicarious obligation under ITA 2000 and DPDPA 2023 and will have to absorb the Risks. If the Risk is “Unknown” because US sheds the ethical AI development model, the users will be considered as “Significant Data Fiduciaries” and “High Risk Intermediaries” and could have more liability under law than what they may recognize.

Let us remember that Indian companies are regulated by Indian laws..not US or EU laws when it comes to operating on Indian data. Hence the responsibility for ITA 2000 and DPDPA Compliance remains paramount and if unregulated AI is dumped on India, Indian user organizations have to be more careful than they were before to ensure compliance of Indian laws. Taking refuge that US does not need “Disclosure” or “Transparency” or “Accountability” does not help Indian “Intermediaries” or “Data Fiduciaries” with compliance of Indian laws.

Since OBBB would directly affect the federal nature of the US , it could face a challenge in the Courts but beyond this internal clash between Republic states and the Democrat states, this is unlikely to have any impact on the global scenario as some predict.

US did have the confusion of 50 states each having different regulations in the Privacy area and if there were 50 AI regulations also, it would have been a problem to the world. This unification of regulations is therefore welcome since the world does not see the State of California as different from the State of New York.

Hopefully there would be more such unification of laws related to “Internet Economy”.

Naavi

Posted in Cyber Law | Leave a comment

Bill Alert System goes wrong

There are many services in the FINTECH arena where the service provider tries to assist the account holder to make payments of pending bills. For this purpose the service provider takes the permission to view the SMS of the account holder and periodically reads the SMS.

Under DPDPA, this permission is mandatory and is covered under the DPDPA consent regulations. This consent is purpose specific and has to be considered as closed once the purpose is served.

I recently have come across such “Bill Alerts” from CRED on the CRED application linked to my mobile number. These bills were not related to me and had I mistakenly clicked “Pay Now”, the payment could have been effected.

I therefore consider the message as an “Attempt to induce me to make payment to a third party” which is an offence under ITA 2000 and BNS.

last time, CRED had indicated that the message could have been picked up from my SMS store and I also presumed that the mistake might have been at the HESCOM side in wrongly linking my mobile with another account.

I am now given to understand that the mobile number associated with the account in HESCOM is not my mobile. However, I have received the CRED alert again today. I am not able to view the corresponding SMS in my SMS inbox.

Under the circumstance, I feel that CRED has picked up the bill from a source other than my SMS inbox.

If so, the mistake lies with CRED and not HESCOM. If this is true, I owe an apology to HESCOM and I am duty bound to apologize. I am yet to get the confirmation but my advance apologies to HESCOM if the mistake lies with CRED.

We can now surmise that CRED has my account as well as the account of the individual whose bills are coming to my CRED account. Perhaps CRED has mis configured the accounts or their technical system is sending bills of one client to another. Alternatively, it is possible that HESCOM has corrected its mistake but there is a Cache maintained by CRED where the bills related to another account are getting diverted to my account.

I have raised a query with CRED now and am expecting a reply.

Once DPDPA 2023 penalties kick in, these are mistakes for which RS 250 crore penalties may be applicable. Until then remedy is under ITA 2000 which is even more serious. I hope corporate entities do understand their responsibilities when they take “Data Access permissions” particularly if they are not capable of managing the data collected.

While I have used the example of CRED here because it is out of my personal experience. this could be happening with others also including Banks.

Looking forward to get more information on this case.

Posted in Cyber Law | Leave a comment

Niti Aayog not clarifying about Mandatory Darpan Registration

Naavi has been repeatedly requesting Niti Aayog to clarify that registration of Section 8 companies is not mandatory for all Section 8 Companies. Unfortunately NITI Aayog does not respond to the query and prefers to remain silent.

In the meantime some REs like PayU and Razor Pay consider that registration on Darpan Portal is mandatory for Section 8 company and are not completing the KYC process.

It is highly irresponsible for Niti Aayog and RBI not to make a proper announcement that Darpan Registration is not mandatory for KYC. At the same time it is disappointing to note that companies like PayU and Razor Pay are unable to complete KYC ignoring the Darpan portal Registration.

Further registering a Section 8 company like FDPPI in Darpan Portal is not possible and the portal returns error page every time.

Further registering a Section 8 company like FDPPI in Darpan Portal is not possible and the portal returns error page every time.

I hope some senior person like Mr Amitabh Kant looks into this issue and set right this anomaly.

Naavi

Posted in Cyber Law | Leave a comment