Electronic evidence under the BSA, 2023

What is electronic evidence under Section 63 of the BSA, 2023?

What counts as electronic evidence under the BSA

The scheme of Sections 61, 62 and 63

Admissibility is not the same as proof

Here’s what experienced litigators know that first-year students often miss: admissibility is not the same as proof. Getting an electronic record admitted under Section 63 only means the court will look at it. It doesn’t mean the court believes it, or that it proves what you say it proves. But those are separate battles, fought on relevance, authenticity, and weight. Section 63 is the doorway, not the verdict.

The old regime: Sections 65A and 65B of the Evidence Act

To understand what changed, you have to know what came before. Electronic evidence didn’t always have its own rules. They were inserted into the Indian Evidence Act, 1872 by the Information Technology Act, 2000, which added Sections 65A and 65B to deal with the then-new problem of computer output. Section 65A was a short signpost. Section 65B of the Indian Evidence Act, 1872 was the substance.

Section 65A of the Indian Evidence Act, 1872 said that the contents of electronic records could be proved in accordance with Section 65B. Section 65B then set out four conditions and one certificate. The conditions were about the reliability of the computer that produced the output.

The four conditions under Section 65B(2)

What were the four conditions? First, the computer output had to be produced during the period when the computer was used regularly to store or process information, by a person having lawful control over its use. Second, information of that kind had to be regularly fed into the computer in the ordinary course of those activities. Third, the computer had to be operating properly through that period, or any malfunction had to be one that did not affect the accuracy of the record. Fourth, the information in the record had to reproduce or be derived from information fed into the computer in the ordinary course.

The single-signatory certificate

Then came the part that generated most of the litigation: Section 65B(4). It required a certificate that identified the electronic record, described how it was produced, gave particulars of the device, and dealt with the four conditions. Crucially, that certificate had to be signed by a person “occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities.” One signature. One responsible person.

That looks simple on paper. In practice, it was anything but. Who was the “responsible official position” for a WhatsApp message, where the “device” was a phone owned by a private individual and the “management of the relevant activities” was, well, nobody in particular? Courts wrestled with this for years, and the answer swung back and forth depending on which bench you drew. A common complaint from advocates during this period was that the certificate requirement, meant to guarantee authenticity, had turned into a technical trap that kept genuine evidence out.

The old regime, in short, had the right instinct and clumsy machinery. It knew electronic records needed a reliability check. It just tied that check to a single signatory and a definition of “computer” that felt increasingly dated as evidence moved from office servers to smartphones. The BSA kept the instinct and rebuilt the machinery.

Section 65B vs Section 63: old and new compared

If you remember one comparison from this guide, make it this one. Section 63 of the BSA is not a fresh start; it is Section 65B with specific, deliberate upgrades. The core idea, that electronic records need a certificate to come in as secondary evidence, survives intact. What changed is who signs, what they must disclose, and how wide the net is cast.

Section 65B vs Section 63 at a glance

The three changes that matter most

Look past the grid, and three changes carry real weight. The first is the second signature. The old law asked one responsible person to vouch for the record. The new law adds an expert, someone with skill in computer science or cyber forensics, to certify the technical side. The idea is that authenticity should not rest on a single administrator’s say-so.

The second is the hash value. A hash is a short string of characters generated by running a file through a mathematical function. Change even one pixel of the image or one character of the chat, and the hash changes completely. Recording it in the certificate gives the court a way to check later whether the file it is looking at is bit-for-bit the same file that was certified. This is genuinely new, and it is the single biggest technical upgrade over 1872-era thinking.

The third is scope. The old wording spoke of “computer output,” which invited arguments about whether a smartphone, a router, or a cloud server was a “computer.” Section 63 closes that gap by naming “any communication device” and “semiconductor memory” directly. So does Section 63 now cover the phone in your pocket and the WhatsApp on it? Yes, and without the old semantic gymnastics.

Is the old Section 65B certificate still valid?

Is the old Section 65B certificate still valid after 1 July 2024? For evidence being tendered now, the answer is no: the BSA has replaced the Evidence Act, and Section 63 is the governing provision. Filing a certificate that cites the repealed Section 65B is a mistake that is already surfacing in courts, and we deal with the transition, including part-heard trials, in the challenges section below.

Section 63 of the BSA, clause by clause

So what does a court actually look for when you tender an electronic record? Section 63 reads as a single dense provision, but it breaks cleanly into four working parts. Reading it clause by clause is the fastest way to understand what a court will ask for.

Section 63(1): what is admissible, and without the original

Sub-section (1) is the admissibility engine. It says that any information contained in an electronic record, whether printed on paper, stored, recorded, or copied in optical or magnetic media or semiconductor memory, and whether produced by a computer or any communication device, shall be deemed to be a document and shall be admissible in any proceeding without further proof or production of the original, if the conditions in the section are satisfied. The phrase “without further proof or production of the original” is the whole point. It lets a printout or a copy stand in for the source device, so long as the conditions and certificate back it up.

Section 63(2): the four conditions

Sub-section (2) carries forward the familiar four conditions, now framed around a “computer or communication device.” The output must have been produced during a period of regular use by someone with lawful control; information of that kind must have been regularly fed in during the ordinary course of activities; the device must have been operating properly, or any defect must not have affected the record’s accuracy; and the information must reproduce or derive from what was fed in. In practice, a bank producing transaction logs or a telecom company producing call records satisfies these conditions almost by definition, because regular business systems are exactly what the conditions describe.

Section 63(3) and 63(4): combined devices and the mandatory certificate

Sub-section (3) handles the modern reality that records rarely come from one machine. Where the relevant activity was carried out across a combination of computers or communication devices, or over successive devices, they are all treated as a single device for the purpose of the section. Sub-section (4) is the one everyone argues about. It requires a certificate, in the form prescribed in the Schedule, that identifies the electronic record, describes the manner of its production, gives particulars of the device, and addresses the conditions. And it must be signed by the person in charge of the device or the management of the relevant activities, and by an expert. The certificate is required “at each instance where it is being submitted for admission,” which is a pointed reminder that this is not a one-time formality you can forget after the first hearing.

A rhetorical trap worth naming: people read “without further proof or production of the original” in sub-section (1) and assume the certificate is optional. It is not. Sub-section (1) removes the need for the original device; sub-section (4) replaces it with the certificate. You trade one for the other. The whole design of Section 63 is that the certificate does the authenticating work the original device would otherwise do.

The Section 63(4) certificate: Part A, Part B and the hash value

The certificate is where most electronic evidence lives or dies, so it is worth slowing down. The Schedule to the BSA prescribes a standard form, and that form has two parts. Getting the right person to sign the right part is not a technicality; it is the difference between admissible and inadmissible.

What the Section 63(4) certificate must contain:

1. A clear identification of the electronic record and a description of how it was produced.
2. Particulars of the device or devices involved in producing the record.
3. The details required to show the four conditions in Section 63(2) are met.
4. The hash value of the electronic record, with the algorithm used (for example SHA-256).
5. The signature of the person in charge of the device or the relevant activities (Part A).
6. The signature and details of an expert (Part B).

Part A: the person in charge of the device

Part A is filled and signed by the party or person responsible for the device or the activities that generated the record. If you are producing your own company’s server logs, that is a person from your IT or records team. If you are producing your own phone’s chat export, that is you. Part A is essentially the custodian saying: this record came from this device, produced in this way, and here is its hash value.

Part B: the expert, and the Section 39 question

The hash value: the record’s fingerprint

Why does a certificate need a hash value at all? Because it’s the only cheap, reliable way to prove a file hasn’t been altered between certification and trial. A hash function such as MD5, SHA-1, or SHA-256 turns a file of any size into a fixed-length string. The same file always produces the same string; a changed file produces a different one. If the hash recorded in the certificate matches the hash of the file in the court’s record, the file is intact. If it does not, someone has tampered with it, or produced the wrong copy. In a world where a convincing fake can be made on a laptop, that check is the closest thing the law has to a tamper-evident seal. In our view, litigators who learn to compute and verify a hash value, rather than leaving it entirely to a forensics vendor, will have a real edge in the next few years, because the argument over integrity is only going to grow.

When is a certificate required, and when is it not?

Not every electronic record needs a Section 63 certificate, and misunderstanding this wastes enormous effort. The rule turns on a single distinction: are you leading the record as primary evidence, or as secondary evidence?

When the certificate is mandatory

The certificate is required when you rely on a copy, a printout, an export, or any output of the device rather than the device itself. That is secondary evidence, and it is how electronic records are led in the overwhelming majority of cases. Nobody wants to deposit a live server or a personal phone with the court for the duration of a trial, so parties produce printouts and pen drives, and those need the certificate.

When a certificate is not required

If the certificate is refused or unavailable

What happens when you need the certificate but can’t get it? This is a real and common bind. Suppose the record sits with a hostile third party, a bank, a telecom operator, or an opposing party, who simply will not sign. The answer, again from Arjun Panditrao Khotkar, is that the court has the power to summon the person in control of the device and direct them to produce the certificate. You are not left helpless because someone refuses to cooperate; you apply to the court, and the court can compel it. A frequent mistake is to give up, or to try to smuggle the record in without a certificate, when the correct move is a simple application for production.

Here is the pitfall that catches even experienced counsel: assuming that because you personally cannot produce a certificate, the requirement is waived. It is not. The requirement attaches to the evidence, not to your convenience. If a certificate is obtainable, from whoever controls the device, it must be obtained, by court order if necessary.

Landmark judgments on electronic evidence in India

You can’t understand Section 63 without the case law that produced it, because the section is essentially Parliament codifying a twenty-year judicial argument. Four judgments tell the story, and each one shifted the ground. Here’s how the law moved.

State v. Navjot Sandhu (2005): the permissive baseline

Anvar P.V. v. P.K. Basheer (2014): the certificate becomes mandatory

Shafhi Mohammad (2018): the dilution that did not last

Arjun Panditrao Khotkar (2020): the law settled

The 2026 Supreme Court ruling on Section 63

So was the new certificate regime a step too far? Codifying the rule didn’t end the argument, it moved it. Once Section 63 added the second signature and the hash value, the real question became whether the new requirements were too heavy for ordinary litigants. And that challenge reached the Supreme Court in 2026.

What the Court held on the hash value

On the hash value, the Court was emphatic about its purpose. It described the hash value of electronic data as “synonymous with an electronic fingerprint” that provides “a sure way of identifying and verifying digital data,” and held that requiring its disclosure had a clear and rational nexus with the object of the law. Given how easily digital records can now be manufactured, the Court treated the requirement not as red tape but as a safeguard against fabrication. That framing, authenticity in the age of deepfakes, is likely to shape how trial courts read Section 63 for years.

Who can sign Part B: the expert question resolved

On the expert, the Court did the practical work that litigators had been waiting for. It disagreed with the narrow view that Part B could be signed only by a Section 79A notified examiner. Reading Sections 39(1) and 39(2) of the BSA harmoniously, it held that any person with special skill and expertise in computer science and cyber forensics may sign as an expert, if the court is satisfied on the basis of unimpeachable material about their competence. That reading matters enormously in a country with very few notified examiners, because it means a qualified private forensics professional can, in an appropriate case, sign Part B. The better view, in our reading, is that this keeps Section 63 workable without diluting the authenticity check the certificate is meant to provide.

How to prove specific types of electronic evidence

General rules are only useful when you can apply them to the file in front of you. So here is how Section 63 plays out for the four kinds of electronic evidence that come up most often in Indian courts. The common thread: produce the record in a certifiable form, capture the hash, and get the right certificate.

WhatsApp chats and social media messages

Emails

Call recordings and audio

Call recordings are admissible, but they come with two extra layers of difficulty. First, authenticity: you must be able to prove the recording is complete and unedited, ideally with the original recording device and a hash of the file. Second, identification: the voices must be linked to real people, sometimes through voice comparison. There is also a live debate about recordings made without the other person’s consent, which raises privacy questions under the fundamental right to privacy the Supreme Court recognised in 2017. Courts have admitted such recordings in some cases, while cautioning about the manner of collection. A recording pulled from a deceased person’s phone can be admitted, but it needs the same certification and a clear chain of custody, since the person who made it cannot testify to it.

CCTV and video footage

CCTV is powerful and fragile at once. It is powerful because it is contemporaneous and hard to dispute once authenticated. It is fragile because footage is usually copied off a DVR onto a CD or pen drive, and that copy is secondary evidence that needs a Section 63 certificate. Common objections include a wrong timestamp (many DVRs are never set correctly), a claim that the footage was edited or “Photoshopped,” and questions about condensed or fast-forwarded playback. The answers are procedural: certify the copy, record its hash, produce the DVR or its custodian where possible, and be ready to explain the timestamp and the export process. Footage that is properly certified and hash-verified is far harder to attack than footage produced casually on a phone.

Practical challenges, the transition, and common mistakes

Section 63 is clearer than what came before, but “clearer” is not “simple.” A handful of problems are generating most of the real-world friction, and knowing them in advance is half the battle.

The transition problem: which law governs?

The most immediate issue is timing. The BSA applies from 1 July 2024, but trials that began under the old Evidence Act did not vanish overnight. The general position is that the law of evidence in force when the evidence is tendered governs its admissibility, so records led after 1 July 2024 fall under Section 63, while proceedings and steps already completed under the old law are generally protected. In practice, this means a part-heard trial can straddle both regimes, and counsel must be careful to certify current tenders under Section 63, not the repealed Section 65B. Filing a Section 65B certificate today, out of habit, is an error courts are already flagging.

Cloud, third-party, and cross-border records

Where is the “device” when the record lives on a cloud server owned by a company in another country? Section 63(3), which treats a combination of devices as one, helps, but the practical questions, who has lawful control, who can sign Part A, and how you certify a record you accessed through a service rather than a machine you own, are still being worked out. For records held by intermediaries, an application to the court to direct production, backed by the intermediary’s own compliance obligations, is usually the cleaner route than trying to self-certify.

The forensic-capacity gap

Behind the doctrine sits an infrastructure problem. India has very few notified Section 79A examiners, and demand for expert certification under Part B now far outstrips that supply. Early signals suggest this gap will be filled partly by qualified private cyber-forensics professionals, a direction the Supreme Court’s 2026 ruling explicitly enabled, and partly by pressure to notify more examiners and build state forensic capacity. Until that catches up, expect delays in matters that turn on heavily contested electronic evidence, and budget for expert time accordingly.

The mistakes that get electronic evidence excluded

Frequently asked questions

1. What is electronic evidence under Section 63 of the BSA, 2023?
It is any information in electronic form, such as an email, chat, CCTV clip, call recording, or printout, that a court is asked to consider. Section 63 makes such a record admissible as a document without the original device, provided the section’s conditions are met and a certificate accompanies it.

2. Is the old Section 65B still valid after 1 July 2024, and which law applies to my case?
Section 65B of the Evidence Act was repealed when the BSA came into force on 1 July 2024, and Section 63 now governs. As a general rule, the law in force when the evidence is tendered applies, so records led now must be certified under Section 63, even in a trial that began earlier.

3. What is a hash value, and why does Section 63 require it?
A hash value is a fixed-length string produced by running a file through a mathematical function such as SHA-256. It acts as a digital fingerprint: if the file changes even slightly, the hash changes, so the court can verify the record has not been tampered with. Section 63 requires it to guard against fabrication.

4. Does Section 63 cover mobile phones and WhatsApp, unlike the old “computer” wording?
Yes. Section 63 expressly covers information in semiconductor memory and produced by “any communication device,” which squarely includes smartphones. This removes the old argument about whether a phone was a “computer” under Section 65B.

5. Is the Section 63 certificate mandatory for admissibility?
For electronic records led as secondary evidence (copies, printouts, exports), yes. The certificate is a mandatory pre-requisite, a position settled for the old law in Arjun Panditrao Khotkar and now built into Section 63(4).

6. Who signs the Section 63 certificate, and what is the difference between Part A and Part B?
Part A is signed by the person in charge of the device or the relevant activities, essentially the custodian of the record. Part B is signed by an expert who certifies the technical aspects. Both signatures are needed for a valid certificate under Section 63(4).

7. What must the Section 63(4) certificate actually contain?
It must identify the electronic record, describe how it was produced, give particulars of the device, address the Section 63(2) conditions, disclose the hash value, and carry both the Part A (custodian) and Part B (expert) signatures.

8. When is a certificate not required at all?
When the original device itself is produced and proved by the person who owns and operates it, giving evidence directly. That is primary evidence. A certificate is needed only for secondary evidence, which is how electronic records are led in most cases.

9. What can I do if the person in charge of the device refuses to give the certificate?
Apply to the court. Following Arjun Panditrao Khotkar, the court can summon the person controlling the device and direct them to produce the certificate. You are not left without a remedy simply because a third party will not cooperate.

10. Are WhatsApp chats admissible, and why do bare screenshots get rejected?
WhatsApp chats are admissible if produced and certified correctly. Bare screenshots are often rejected because they carry no metadata, are easily edited, and cannot be hash-verified. The better method is an exported chat file, the original device, and a Section 63 certificate.

11. How do I prove who owns the phone number that sent the messages?
Through the telecom service provider’s subscriber records, usually obtained by a court direction. A chat proves the content of a message, not the identity of the sender, so linking the number to a person is a separate, necessary step.

12. Are emails admissible as evidence in India, and can an email be a binding agreement?
Yes on both counts. Emails, produced with headers intact and certified under Section 63, are regularly admitted. Indian courts have also accepted that an exchange of emails can form a binding contract where the offer, acceptance, and terms are clear.

13. Is a call or audio recording admissible in court?
Yes, if it is complete, unedited, properly certified, and the voices can be identified. Recordings made without consent raise privacy concerns and questions of weight, but are not automatically inadmissible under Indian law.

14. Is CCTV footage on a CD or pen drive admissible without a certificate?
No. A CD or pen drive copy of CCTV footage is secondary evidence and needs a Section 63 certificate, ideally with the DVR or its custodian available and the hash value recorded. Producing the copy without certification is a common reason such footage is excluded.

15. What are the three biggest changes from Section 65B to Section 63?
A second signatory (an expert signs Part B alongside the custodian’s Part A); a mandatory hash value disclosed in the certificate; and an expanded scope that expressly covers semiconductor memory and any communication device.

16. What did Anvar P.V. v. P.K. Basheer decide about the certificate?
It held that Sections 65A and 65B are a complete code and that the certificate is mandatory for electronic records led as secondary evidence, overruling the earlier permissive view in Navjot Sandhu. It is the foundation of the current law.

17. Did Arjun Panditrao Khotkar overrule Shafhi Mohammad?
Yes. The three-judge bench in Arjun Panditrao Khotkar held that Shafhi Mohammad stated the law incorrectly, restored the mandatory-certificate rule from Anvar, and clarified that the certificate can be produced at any stage and ordered by the court where needed.

18. Are cases really being dismissed for a missing certificate (“no certificate, no case”)?
Electronic evidence led as secondary evidence without a valid certificate can be refused admission, which can be fatal where the case rests on that evidence. The requirement is substantive, not a mere formality, so a missing or defective certificate genuinely can sink a claim.

19. Can a recording made without the other person’s consent still be used as evidence?
It can be admitted, because Indian law has generally emphasised relevance over the method of collection, but the manner of recording can affect the weight the court gives it and may raise separate privacy or legal issues. Consent is prudent where obtainable.

20. Can a private cyber-forensics expert sign Part B, or only a Section 79A examiner?
Following the Supreme Court’s 2026 ruling in Pune Bar Association v. Union of India, a person with genuine expertise in computer science and cyber forensics can sign Part B; it is not confined to notified Section 79A examiners, provided the court is satisfied about the expert’s competence.

References

Case Law

Statutes