BACK TO IT ACT
IT Act 2000

Section 33

Surrender of Licence

THE STATUTE

Original Text

A Certifying Authority whose licence is suspended or revoked shall, immediately on such suspension or revocation, surrender the licence to the Controller.

Simplified

Section 33 addresses the mandatory surrender of a licence when it has been suspended or revoked by the Controller under Section 25. The duty is immediate — on suspension or revocation, the CA must surrender the physical licence document to the Controller without delay. This physical surrender serves several purposes. It prevents a CA from continuing to display a suspended or revoked licence on its premises (as required by Section 32(a)), which would create a false impression of continued authorised operation. It also creates a clear administrative record of the licence's end — the physical licence is now in the Controller's custody and cannot be used. In conjunction with Section 26 (publication of suspension or revocation in the database), Section 33's surrender requirement creates a complete paper trail: the Controller holds the surrendered licence, the public database records the suspension or revocation, and the CA is comprehensively stripped of the ability to hold itself out as a licensed operator. For subscribers with active certificates issued by a suspended CA, the certificate status remains determined by the relevant certificate's validity period and the CA's CRL/OCSP — the licence suspension does not automatically invalidate already-issued, valid certificates. However, the suspended CA may not issue new certificates, and the Controller will typically arrange for the CA's existing subscriber base to migrate to another licensed CA.

Common Queries

IT Act Section 33 deals with Surrender of Licence. It is an enabling or procedural provision under the Information Technology Act, 2000 that A Certifying Authority whose licence is suspended or revoked shall, immediately on such suspension or revocation, surrender the licence to the Controller. This section does not create direct criminal liability but establishes the regulatory or technical framework within which other provisions operate.
IT Act Section 33 governs the voluntary surrender of a CA licence. The CA must give advance notice to the Controller, notify all subscribers whose certificates will be revoked, and hand over all records. Section 33 protects DSC holders by ensuring an orderly wind-down, giving users time to obtain alternative certificates from another licensed CA before the surrender takes effect.
IT Act Section 33 was retained without substantial change by the Information Technology (Amendment) Act, 2008. The provision continues to be in force and must be read alongside the DPDP Act, 2023 and relevant rules notified under the IT Act. Courts continue to apply this section in disputes involving electronic records and digital transactions.

Legal Evolution

Section 33 was in the original IT Act 2000. Licence surrender on enforcement action is standard across licensed industries in India. The CCA's regulations elaborate the practical arrangements for orderly CA exit — including subscriber notification, certificate repository transfer, and CRL maintenance obligations.

Key Amendments

Unchanged since the original IT Act 2000.