Saya & Associates
Electronic evidence in a company investigation: preserve it before it changes
The records are already moving
A company learns that an internal transaction may be under investigation. Relevant emails sit in several mailboxes, chat messages sit on phones, and system logs are due for routine deletion.
A screenshot or exported spreadsheet may be useful for review. But the company should also be able to explain where each record came from, who collected it and what happened to it afterwards.
What the BSA says about electronic records
The BSA came into force on 1 July 2024 and replaced the Indian Evidence Act, 1872. Under section 170(2), proceedings already pending on that date continue under the old Act.
The key provisions for a company's records:
| Provision | What it says |
|---|---|
| Section 2(1)(d) | A "document" includes electronic and digital records. The illustration lists emails, server logs, files on computers, laptops or smartphones, messages, websites, location data and voicemail |
| Section 57, Explanations 4 to 7 | Some electronic records are primary evidence: each file where a record is stored in several files, a record produced from proper custody unless disputed, and each automated storage, including temporary files |
| Section 61 | An electronic record cannot be refused as evidence just because it is electronic; subject to section 63, it has the same legal effect as other documents |
| Section 62 | The contents of electronic records may be proved under section 63 |
| Section 63(1) and (2) | A printout or copy (a "computer output") is admissible without the original if conditions about regular use and proper operation of the device are met |
| Section 63(4) | A certificate must accompany the electronic record each time it is submitted for admission, signed by the person in charge of the device or the relevant activities and by an expert |
Section 63(3) treats all the computers and devices used for an activity over a period as a single device. That covers networks, cloud services and intermediaries, which is how most company systems run.
What the certificate asks for
The certificate is in the Schedule to the BSA. It has two parts, and both ask for the same core facts about the source:
| Part | Signed by | What it records |
|---|---|---|
| Part A | The party producing the record | The source (computer, mobile, server, cloud or other), make, model, serial number and IMEI, MAC or cloud ID; that it was under lawful control and working properly; whether the signatory owns, maintains, manages or operates it; and the hash value with its algorithm |
| Part B | An expert | The source device details, and the hash value with its algorithm (SHA1, SHA256, MD5 or another accepted standard) |
Both parts require a hash report to be enclosed. A company that did not record the device details and hash values when it collected the material will find the certificate hard to complete months later.
What the Supreme Court said about the old certificate
Section 63 follows the structure of section 65B of the old Evidence Act.
In Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020), the Supreme Court held that the section 65B(4) certificate was a condition precedent to admitting a copy of an electronic record.
The Court also said the certificate was unnecessary if the original was produced: for example, if the owner of a laptop or phone steps into the witness box and proves the device on which the information was first stored.
Where the original sits on a network or system that cannot be brought to court, the only route was the copy with the certificate. Most company records fall in that category.
Put a preservation hold around the relevant material
Once an investigation or dispute is reasonably anticipated, identify the systems and custodians likely to hold relevant records. The plan should settle five things:
- Scope: Which period, people, systems and transaction are relevant?
- Retention: Which routine deletion or device-replacement processes need to be paused?
- Custody: Who is authorised to collect and secure the material?
- Method: How will exports, forensic copies or system snapshots be made?
- Recordkeeping: Where will the source, date, time, collector and each transfer be logged?
Preservation should be proportionate. It should not become an unrestricted search through unrelated employee or customer data. Access, privacy, privilege and confidentiality need to be considered alongside it.
Keep originals and working copies distinct
Do not casually edit, rename, convert or circulate the original device or system record. Where technically appropriate, make a controlled copy for review and keep the source preserved.
Record the method used, the system details and any integrity checks, including hash values where suitable.
Avoid forwarding key emails to personal accounts, editing a spreadsheet before it is preserved, or relying only on a cropped screenshot when the full conversation or its metadata may matter.
If outside investigators or forensic specialists are involved, record their role and the scope of their work. One of them may later need to sign Part B.
What the certificate does not do
The certificate is not a substitute for sound collection. A hash value shows that a copy matches what was hashed. It does not prove who created the record or whether its contents are true.
Those questions are answered by the full record and the witnesses who can explain it, not by a form.
Plan for the records that may be used
The legal team should identify which records may be relied on and what proof each will need. A mailbox export, a phone message, a cloud audit log and a CCTV clip may each need different people and technical detail.
Before anything goes to an authority or a court, confirm the legal basis for disclosure, the exact record set, any privilege or confidentiality issue, and the evidential paperwork needed.
Do not alter or destroy material because it looks unhelpful. Raise questions about personal devices, employee data or privileged communications before collection, not after.
If the police have asked for records, see our guide to section 94 BNSS orders. If the Serious Fraud Investigation Office is involved, see our guide to an SFIO notice.
The first preservation steps
- Issue a preservation hold. Pause routine deletion and device replacement for the relevant people and systems.
- Map the sources. List mailboxes, chat platforms, drives, logs, CCTV, cloud services and devices, and who controls each.
- Secure the originals. Keep devices and system records unchanged: no resets, renaming or format conversion.
- Make controlled copies. Use exports, forensic images or snapshots, and record the method and hash values at the time.
- Log every transfer. Record the source, date, time, collector and each hand-over.
- Plan the certificate. For each record likely to be relied on, identify who can sign Part A and which expert can sign Part B.
Frequently asked questions
Are emails and chat messages admissible as evidence in India?
Yes. Under section 2(1)(d) of the BSA, electronic records are documents, and section 61 says they cannot be refused just because they are electronic. A copy or printout is proved under section 63.
Who signs the section 63 certificate?
Section 63(4) requires a person in charge of the device, or of the relevant activities, and an expert to sign it. The Schedule splits it into Part A for the party and Part B for the expert.
Is a certificate needed if the original phone or laptop is produced?
Under the old section 65B, the Supreme Court said in Arjun Panditrao (2020) that it was not, where the owner produces and proves the device.
Section 57 of the BSA also treats some electronic records as primary evidence. Take advice on the route for each record.
Does a hash value prove a document is genuine?
No. It shows that a copy matches the record that was hashed. It does not show who created the record or whether its contents are true.
Does the BSA apply in an arbitration?
No. Section 1(2) of the BSA excludes proceedings before an arbitrator, and section 19(1) of the Arbitration and Conciliation Act, 1996 says the tribunal is not bound by the Evidence Act. Careful preservation still matters there.
The takeaway
An early preservation protocol reduces avoidable disputes about missing records and collection history. It does not decide whether the evidence proves an allegation. That remains a question for the full record and the proceedings.
To discuss an investigation, contact Saya & Associates with the date the company first learned of it and the systems involved.
This article provides general information as at 30 September 2026. The right preservation and production steps depend on the investigation, the systems involved, privacy and employment obligations, and the forum in which the record may be used. It is not legal advice.