Section 25

Section 25 is the primary enforcement provision against licensed Certifying Authorities — it gives the Controller power to revoke or suspend a CA's licence where the CA has fallen short of its regulatory obligations. Four grounds for revocation are specified: material misrepresentation in the licence application, non-compliance with licence conditions, failure to maintain Controller-specified standards, and any contravention of the IT Act or delegated legislation. The Controller may choose suspension instead of outright revocation where circumstances do not warrant the more severe sanction — providing a proportionality principle in licence enforcement. Section 25(2) provides the fundamental due process protection: no licence may be revoked or suspended without first giving the CA a reasonable opportunity to show cause. This applies the audi alteram partem principle at the licence enforcement stage. However, Section 25(3) creates an important emergency exception: where the Controller considers it necessary in public interest, a licence may be suspended with immediate effect. The emergency suspension takes immediate force, but the Controller must within three days give the CA an opportunity to show cause — so the suspension is immediate but the hearing obligation is deferred, not eliminated. This emergency provision is critical for situations where a CA's operations pose an imminent risk to relying parties — for example, if evidence emerges that a CA is issuing fraudulent certificates or that its key generation systems have been compromised.