Legal Framework and Procedure for Digital Signatures

Every time you e-file your income tax return, incorporate a company on the MCA portal, or bid on a government e-tender, a small piece of cryptography does the heavy lifting behind that “sign and submit” button. That’s the digital signature at work, and it isn’t just a technical convenience. It is a legally recognised act with the same weight as putting pen to paper. The Information Technology Act, 2000 built the entire legal foundation for this, and understanding how it works is essential for anyone studying e-commerce law or planning to run a business online.

What counts as a digital signature under Indian law 🔗

The IT Act defines a digital signature as the authentication of an electronic record by a subscriber using a specific electronic method described in Section 3 of the Act. In plain terms, it is a cryptographic technique, not just any scanned image of your signature pasted onto a PDF. It relies on an asymmetric cryptosystem and a hash function to bind a unique digital identity to a document.

It’s worth separating two terms that often get used interchangeably. A digital signature under Section 3 is one particular technology built on public key infrastructure. A broader category called electronic signature was introduced through Section 3A after the 2008 amendment to the Act, and it covers other verification methods too, such as Aadhaar-based eSign or OTP-driven eKYC authentication. Every digital signature is an electronic signature, but not every electronic signature is a digital signature in the strict legal sense.

Sections 4 and 5: why digital signatures carry legal weight 🔗

Two provisions do the real work here. Section 4 gives electronic records the same status as physical, written documents, so any law that demands information be in writing is satisfied if it exists electronically. Section 5 goes a step further and states that wherever a law requires a person’s signature, that requirement is met if the document carries a digital or electronic signature affixed in the prescribed manner.

This is what makes a digitally signed loan agreement, board resolution, or tax filing legally enforceable in India. The Act does not treat this as optional; the signature requirement is genuinely fulfilled, not simply waived for convenience.

Inside the process: how a digital signature is actually created 🔗

The mechanics can feel abstract, so it helps to walk through the actual sequence of steps that happen when you sign a document digitally.

Step 1: creating a hash of the document 🔗

The signing software first runs the entire document through a mathematical hash function, which produces a fixed-length string of characters called a message digest. Even a single altered character in the original file produces a completely different hash. This is what allows anyone to later detect whether a signed document has been tampered with.

Step 2: encrypting the hash with the private key 🔗

The signer’s private key, which only they possess, encrypts this hash. The encrypted output is the digital signature itself. Because the private key never leaves the signer’s crypto token, nobody else can reproduce this exact signature for that specific document.

Step 3: verifying the signature with the public key 🔗

The recipient uses the signer’s public key, available through the digital signature certificate, to decrypt the signature and recover the original hash. They independently compute a fresh hash of the received document and compare the two. If they match, the document is confirmed as authentic and unaltered. This process is what gives digital signatures their three defining properties: authenticity, integrity, and non-repudiation, meaning the signer cannot later deny having signed the record.

Who issues digital signatures: certifying authorities explained 🔗

None of this works without trust, and trust needs a hierarchy. India’s Public Key Infrastructure starts at the top with the Controller of Certifying Authorities (CCA), a body under the Ministry of Electronics and Information Technology that licenses and regulates every entity permitted to issue digital signature certificates in the country. The CCA operates the Root Certifying Authority of India, which digitally signs and vouches for every licensed Certifying Authority beneath it.

These licensed Certifying Authorities, in turn, issue Digital Signature Certificates directly to individuals and organisations. When a government portal verifies your certificate, it traces this chain of trust all the way back to the root, confirming the certificate genuinely belongs to a system the government recognises.

The procedure to get a digital signature certificate 🔗

Getting a DSC involves a defined process rather than simply downloading software.

Identity verification 🔗

Applicants can be verified through a few accepted routes: a paper-based application with attested supporting documents, Aadhaar-based eKYC that skips the paperwork entirely for Aadhaar holders, or banking eKYC where the bank shares verified customer data with the Certifying Authority. The exact verification standards are laid down by the CCA to keep identity checks consistent no matter which licensed authority issues the certificate.

Storing your private key safely 🔗

Once issued, the private key associated with a DSC has to be stored on a dedicated cryptographic USB token that meets a recognised security standard, and it stays in the subscriber’s physical custody. This is a deliberate design choice. Software-based keys stored on an ordinary laptop are far easier to copy or steal, which would undermine the whole non-repudiation principle the law depends on.

Validity and renewal 🔗

Digital signature certificates in India are typically issued for one or two years and must be renewed before expiry to keep signing documents. Since January 2021, the earlier three-tier classification of certificates was streamlined, and Class 3 certificates now serve as the standard level of assurance across all use cases, from company filings to individual online transactions.

Where digital signatures are mandatory in India 🔗

A DSC isn’t a nice-to-have for most businesses; it’s a legal necessity for several routine compliance activities.

Legal position: authenticity, integrity and non-repudiation 🔗

Beyond the technical process, the law also builds in specific evidentiary support for digital signatures. India’s evidence law, now the Bharatiya Sakshya Adhiniyam, 2023, which replaced the Indian Evidence Act, 1872 from July 2024, carries forward the same presumptions that existed earlier. Under its provisions on electronic records and electronic signatures, courts presume that a secure electronic record has not been altered since it was secured, and that a secure signature was affixed by the subscriber with genuine intent to sign, unless proven otherwise. A related provision creates a presumption that a properly issued digital signature certificate is genuine. The structure of these presumptions closely mirrors what existed under the earlier evidence law, so the legal protection digital signatures enjoyed hasn’t weakened with the transition.

In practical terms, this shifts the burden of proof. If a digitally signed contract is challenged in court, the person disputing it has to actively prove tampering or misuse, rather than the signer having to prove the document is genuine from scratch. This is precisely why courts, banks, and regulators treat digitally signed records as strong evidence, comparable to the trust placed in a notarised physical signature.

What happens if a digital signature is misused 🔗

The IT Act doesn’t stop at recognition; it also builds in accountability. Certifying Authorities are required to retain issuance-related records for several years after a certificate expires and can only disclose subscriber information under legal compulsion or a court order, according to CCA’s own operational guidelines. Misrepresenting facts to obtain a certificate, or knowingly publishing a false one, attracts penal consequences under the Act. This layer of accountability is what keeps the entire PKI ecosystem trustworthy at scale, since millions of digitally signed documents rely on the assumption that certificates were issued to genuinely verified individuals.

What do you think? If a private key is compromised through no fault of the subscriber, where should the balance of legal responsibility fall between the signer, the Certifying Authority, and the party relying on the signature? And as Aadhaar-based eSign becomes more common for everyday transactions, does it deserve the same legal weight as a PKI-based digital signature, or should high-value contracts continue to demand the stricter Class 3 standard?

References

1. https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&sectionId=13013&sectionno=3A
2. https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&sectionId=13015&sectionno=5
3. https://www.digitalindia.gov.in/di_ecosystem/controller-of-certifying-authorities-cca/
4. https://cca.gov.in/digital_signature.html
5. https://cca.gov.in/faq.html
6. https://prsindia.org/files/bills_acts/bills_parliament/2023/BHARATIYA_SAKSHYA_BILL,%202023.pdf