Electronic Evidence under the Bharatiya Sakshya Adhiniyam 2023: Section 63 Certificates Explained

Electronic evidence in Indian courts is now governed by the Bharatiya Sakshya Adhiniyam 2023 (BSA), and computer output is admitted through s. 63, which replaced s. 65B of the Indian Evidence Act 1872 from 1 July 2024. To rely on a printout, copy or extract of an electronic record without producing the original device, a party must file a certificate in the form prescribed in the Schedule, signed by the person in charge of the device and by an expert. The certificate records hash values, so the way the evidence was collected now shows up on the face of the document.

This post explains what s. 63 requires, what goes into the certificate and where parties commonly go wrong. For the collection steps that make a certificate possible, see our companion guide on preserving digital evidence in internal investigations.

What changed when the BSA replaced the Evidence Act?

The BSA came into force on 1 July 2024 together with the Bharatiya Nyaya Sanhita and the Bharatiya Nagarik Suraksha Sanhita. Its electronic-evidence provisions map closely onto the old Act, but with important additions.

The definition of "document" in s. 2(1)(d) now expressly includes electronic and digital records, and its illustrations mention emails, server logs, files on computers, laptops and smartphones, messages, websites, location data and voicemail. Section 61 confirms that an electronic record cannot be refused as evidence merely because it is electronic.

When is a section 63 certificate needed?

Primary and secondary electronic evidence

Section 57 widens what counts as primary evidence for electronic records. Its Explanations treat as primary evidence, among other things, each file where a record is stored in multiple files, an electronic record produced from proper custody unless it is disputed, and each automated storage in a computer resource, including temporary files.

Section 63 governs computer output: information printed, stored, recorded or copied from a computer or communication device. Where a party relies on such output rather than producing the original device, the s. 63 route applies.

The certificate requirement

Under s. 63(4), a certificate must be submitted along with the electronic record each time it is submitted for admission. Under the old law, the Supreme Court held in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) that the s. 65B(4) certificate was a condition precedent to admitting secondary electronic evidence, and that oral evidence could not substitute for it. Because s. 63 tracks s. 65B with additions, that reasoning remains the leading authority. The safe course is to treat the certificate as essential whenever computer output is relied on.

What must the certificate contain?

The statutory conditions

Section 63(2) sets out the conditions the certificate must address:

• the device was regularly used to create, store or process information for activities regularly carried on during the relevant period;
• information of the kind contained in the record was regularly fed into the device in the ordinary course of those activities;
• the device was operating properly throughout the material period, or any malfunction did not affect the record or its accuracy; and
• the information in the output reproduces or is derived from information fed into the device in the ordinary course.

Section 63(3) treats a combination of standalone devices, computer systems, networks, computer resources and intermediaries used over the relevant period as a single device. That matters for cloud email, ERP systems and messaging platforms, where data passes through several systems.

The two-part form in the Schedule

Both parts record hash values. The form lists SHA1, SHA256, MD5 or another legally acceptable standard, requires a hash report to be enclosed, and is dated with the time (IST, in 24-hour format) and place of signing. A hash value is a fixed-length digital fingerprint: if a single bit of the record changes, the hash changes. NIST has announced that SHA-1 should be phased out by 31 December 2030, so SHA-256 is the sensible default for new work.

Who is the expert?

Section 63(4) requires the certificate to be signed by the person in charge of the device or the relevant activities and by an expert. Separately, s. 39(2) makes the opinion of an Examiner of Electronic Evidence notified under s. 79A of the IT Act 2000 a relevant fact when a court must form an opinion on electronic information. In practice, Part B is usually signed by a digital forensics practitioner who acquired or verified the data and can explain the method in evidence.

Where do certificates commonly go wrong?

Most defects arise long before anyone drafts the certificate:

1. No hash at acquisition. If the record was not hashed when it was collected, there is no reliable reference point to show it has not changed since.
2. Screenshots instead of exports. A screenshot of a chat or web page shows content but loses metadata and source. A forensic imaging or forensic export of the device or account preserves both.
3. The wrong signatory. The person in charge must be someone who can genuinely speak to the device and the activities, not simply a convenient manager.
4. Gaps in custody. If nobody can account for who held the device or data between seizure and production, the opposing party will question integrity. A documented chain of custody closes that gap.
5. Device particulars that do not match. Serial numbers, account identifiers and system descriptions in the certificate must match the acquisition records.
6. Reusing old certificates. A certificate prepared for an earlier filing may not reflect the record now being produced.

A practical workflow for admissible electronic evidence

1. Identify the relevant devices, accounts and systems, and who controls them.
2. Preserve by imaging devices or exporting accounts using forensically sound methods, before routine deletion or reuse.
3. Hash each image or export at acquisition and record the algorithm, value, date, time and place.
4. Document custody for every transfer, from collection to storage to analysis.
5. Analyse working copies, never the master, and re-verify hashes before production.
6. Prepare the certificate, with Part A completed by the party and Part B by the expert, and attach the hash report.

In commercial suits, the substituted Order XI of the Code of Civil Procedure also requires a declaration on oath covering the source, custody and integrity of electronic records disclosed. Our guide to eDiscovery for Indian litigation and arbitration explains how that disclosure duty works alongside s. 63. For the wider discipline of identifying and reviewing electronic records at scale, see our eDiscovery entry and the section 63 certificate definition.

Does the certificate guarantee admissibility?

No. The certificate addresses the conditions for admitting computer output, but it does not prove that the content is true, that the author is who the other side says it is, or that the record is relevant. Those questions are decided on the wider evidence, which may include expert testimony on metadata, logs and device artefacts. Decisions on how to prove a particular record need specific legal advice.

How Spectra Forensics can help

Spectra Forensics has 19+ years of investigation experience and has worked on matters across 10+ countries. Our digital forensics and eDiscovery service covers forensic imaging of computers, mobile devices and cloud accounts, hash verification, chain-of-custody documentation and expert support for s. 63 certification. Our litigation support for legal firms helps counsel plan how electronic evidence will be collected and proved.

To discuss an evidence question, contact us.