Digital forensics has become a cornerstone of modern investigations, whether in criminal prosecution, corporate compliance, or civil disputes. But with every case that relies on an email trail, server log, or WhatsApp chat, one question keeps coming up:
What makes digital evidence admissible, and how far can investigators go without crossing into privacy violations?
As courts deal with an unprecedented volume of electronic records, the challenge is twofold: ensuring reliability and authenticity on one hand, while safeguarding privacy and constitutional rights under Article 21 on the other. The line between lawful collection and invasive surveillance has never been thinner.
From Evidence Act to Bharatiya Sakshya Adhiniyam: The New Framework
The transition from the Indian Evidence Act, 1872 to the Bharatiya Sakshya Adhiniyam (BSA), 2023, in force since 1 July 2024, marks a defining moment for digital evidence in India.
The Supreme Court’s judgment in Arjun Panditrao Khotkar v. Kailash Goratyal (2020) 7 SCC 1 settled the long-standing conflict, holding that a Section 65B certificate is mandatory for the admissibility of electronic evidence.
What Makes Digital Evidence Admissible
Courts now demand both legal compliance and technical integrity before accepting any digital record.
Legal Requirements under BSA 2023
- Electronic records must be accompanied by a certificate identifying the device, method of production, and authenticity.
- A uniform certificate format under Part A & B of the BSA minimizes procedural disputes.
- The “proper custody” principle requires an unbroken chain of control from collection to presentation.
Technical & Forensic Standards
- Chain of Custody: Every access, transfer, or duplication must be logged.
- Forensic Imaging: Devices must be cloned using write-blockers to prevent alteration.
- Hash Verification: Unique digital fingerprints (MD5/SHA-256) confirm integrity.
- Metadata Preservation: Time stamps and logs corroborate authenticity.
- Expert Reports: Qualified forensic experts must validate methods used.
- Corroboration: Digital evidence should align with physical or independent proof.
Failure in any of these aspects can make evidence unreliable or inadmissible altogether.
Judicial Trends
Courts are increasingly open to audio-visual recordings, call data records (CDRs), and server logs, provided authenticity and certification are proven. The BSA simplifies what was once a fragmented process under the Evidence Act, bringing much-needed procedural clarity.
We’re also seeing a rise in preservation orders, directing parties to secure logs and metadata early in disputes to prevent spoliation or tampering. Courts now assess whether the party producing the record controls the device, which affects the certificate requirement.
Data Privacy in Investigations: The DPDP Act, 2023 and Draft Rules 2025
The Digital Personal Data Protection Act, 2023 (DPDP Act), and the recently released Draft Rules 2025, add a new dimension to digital investigations.
The Act introduces consent-based processing, individual rights (access, correction, erasure), and a Data Protection Board of India. While investigative authorities may rely on certain exemptions for law enforcement, they must still ensure purpose limitation and data minimization.
Forensic units handling personal data must:
- Maintain secure audit trails and restricted access.
- Use encryption and certified tools.
- Ensure lawful basis for any cross-border data transfer.
Early litigation under the DPDP framework is likely to test this balance between privacy protection and investigative necessity.
Best Practice Guidelines for Legal and Investigative Teams
- Preserve Early: Secure servers, devices, and cloud data at the first sign of dispute.
- Use Certified Tools: Adopt forensic tools recognized by NIST or CERT-In.
- Document Every Step: Maintain detailed logs of collection and analysis.
- Follow BSA Formats: Use the prescribed certificate structure.
- Minimize Scope: Extract only relevant data to avoid privacy overreach.
- Engage Experts: Present qualified forensic analysts to validate findings.
- Stay Updated: Track DPDP Act enforcement and forthcoming Board notifications.
Conclusion
Digital forensics and data privacy are now twin pillars of evidentiary justice. The Bharatiya Sakshya Adhiniyam modernises how courts view electronic records, while the DPDP Act demands privacy-respectful investigations.
The future of evidence law in India lies in balance, ensuring digital integrity without compromising constitutional privacy.
