Electronic Signatures Under the IT Act: Moving Beyond Digital Signatures

When you click “I agree” on a bank’s loan form online, or authenticate a government document using your fingerprint on a mobile app, you are using an electronic signature. But until 2008, Indian law did not formally recognize most of these methods. The original Information Technology Act, 2000 only acknowledged one narrow form of authentication: the cryptography-based digital signature. The IT (Amendment) Act, 2008 changed that fundamentally by introducing Section 3A, which expanded the legal framework to cover a much wider range of signing technologies – without being tied to any single one. This shift, from technology-specific to technologically neutral, is what makes electronic signatures relevant for India’s digital economy today.

What Section 3A of the IT Act actually says
Digital signature vs. electronic signature: an important distinction
Categories of electronic authentication: the UNCITRAL framework
Knowledge-based authentication
Biometric-based authentication
Possession-based authentication
Other authentication methods
Aadhaar eSign: India’s practical application of Section 3A
Legal recognition and the trust it builds
Why this matters for the digital economy

What Section 3A of the IT Act actually says

Before 2008, Section 3 of the IT Act governed digital signatures exclusively through an asymmetric cryptosystem – a method that uses a pair of mathematically linked keys (one private, one public) to sign and verify documents. While secure, this approach required hardware USB tokens issued by licensed Certifying Authorities, which made it impractical for mass adoption.

Section 3A introduced a broader, technology-neutral threshold: a subscriber may now authenticate any electronic record using an electronic signature or electronic authentication technique that is considered reliable and specified in the Second Schedule of the IT Act. Crucially, new additions to the Second Schedule do not need to originate from an Act of Parliament – the Central Government can notify them directly, allowing the law to keep pace with technological change.

For an electronic signature to qualify as reliable under Section 3A, it must meet five conditions:

The signature creation data must be linked to the signatory and no one else.
At the time of signing, the signature data must have been under the exclusive control of the signatory.
Any alteration to the electronic signature after it is affixed must be detectable.
Any alteration to the signed information must also be detectable.
It must fulfil any additional conditions prescribed by the Central Government.

These clauses ensure that electronic signatures are secure, verifiable, and legally enforceable – regardless of the specific technology used to create them.

Digital signature vs. electronic signature: an important distinction

The two terms are often used interchangeably, but they are not the same under Indian law. A digital signature, defined under Section 3, is cryptography-based and uses public key infrastructure (PKI), while an electronic signature, introduced through Section 3A in 2008, is a broader category that includes any approved authentication method – from Aadhaar-based OTP verification to biometrics.

Think of it this way: all digital signatures are electronic signatures, but not all electronic signatures are digital signatures. Section 3A expanded the definition of electronic signatures to include Aadhaar-based KYC authentication and biometric verification, making the law far more inclusive and accessible.

The legal standing of both is confirmed under Section 5 of the IT Act, which states that wherever any law requires a signature, an electronic signature – if it meets the prescribed standards – fulfills that requirement. Electronic signatures are treated as equivalent to traditional wet signatures and are legally recognised under Section 5 of the IT Act.

Categories of electronic authentication: the UNCITRAL framework

To understand how Indian law classifies electronic authentication, it helps to look at the international model it draws from. The UNCITRAL Model Law on Electronic Signatures (MLES), adopted in 2001, follows a technology-neutral approach that avoids favouring any specific technology or process – recognizing both PKI-based digital signatures and electronic signatures using other technologies. India’s 2008 amendment directly reflects this philosophy.

Based on the UNCITRAL framework, electronic authentication methods fall into three broad categories – and one residual group:

Knowledge-based authentication

These are methods that rely on something the user knows. Knowledge-based methods include passwords and Personal Identification Numbers (PINs). They are the most widely used form of digital authentication worldwide – from email logins to ATM transactions – though they carry higher risks if the user’s credentials are compromised.

Biometric-based authentication

These rely on something the user is – unique physical characteristics that cannot be transferred or duplicated. Biometric methods include fingerprints, iris scans, and voice recognition. In India, Aadhaar-based eSign makes biometric authentication legally viable at scale. Upon successful biometric or OTP authentication, Aadhaar eSign is affixed to the document, completing the process in under a minute.

Possession-based authentication

These depend on something the user has – a physical object that carries authentication data. This category includes codes or other information stored on magnetic cards, chip-based cards, and smart cards. The USB hardware tokens used for traditional Digital Signature Certificates (DSCs) also fall under this category.

Other authentication methods

UNCITRAL also recognizes methods that do not fit neatly into the above three. These include facsimiles of handwritten signatures, names typed at the bottom of electronic messages, scanned signatures, and verification of email addresses or IP addresses. While these carry lower security assurance, they may still carry legal weight in certain low-risk contexts.

Aadhaar eSign: India’s practical application of Section 3A

The most significant real-world application of Section 3A in India is the Aadhaar eSign framework. Introduced in 2015 by the Ministry of Electronics and Information Technology (MeitY), the eSign framework builds on Aadhaar-based authentication for e-signing, and was formally incorporated into the Second Schedule of the IT Act.

The process combines two categories of authentication: possession (Aadhaar number) and knowledge or biometrics (OTP or fingerprint). When a user opts to eSign, the document hash is securely transmitted to a Certifying Authority via the Aadhaar eSign API; upon OTP verification linked to the Aadhaar-registered mobile number, the digital signature is generated and embedded in the document – making it tamper-evident and legally valid.

The practical reach of this is significant. The GST platform now supports Aadhaar eSign for business registration, return filing, and compliance documentation, having minimised paperwork for over 1.3 crore registered businesses in India. Beyond tax, it is used for loan agreements, KYC documentation, insurance policies, hospital consent forms, and court-accepted digital affidavits.

MeitY has played a pivotal role by standardising eSign APIs and onboarding both government and private organisations, and has certified multiple eSign service providers under the Controller of Certifying Authorities (CCA) framework.

Legal recognition and the trust it builds

The technologically neutral approach of Section 3A does more than expand the range of signing methods – it builds trust in digital transactions by ensuring that legal recognition is not contingent on using one specific tool. The UNCITRAL Model Law on which Section 3A is based aims to enable States to establish a modern, harmonized, and fair legislative framework that gives certainty to the status of electronic signatures.

In India, this legal certainty extends to evidentiary value. Section 65A of the Indian Evidence Act, 1872 recognises the admissibility of electronic records as evidence, while Section 85C provides that if a digital signature is affixed to a document, the court shall presume that document to be true and correct. This means that a contract signed via Aadhaar biometrics carries the same evidential weight in court as one signed with ink on paper.

However, the law does draw clear boundaries. Under Section 1(4) of the IT Act, documents such as negotiable instruments, powers of attorney, trust deeds, wills and testaments, and contracts for the sale of immovable property are excluded from electronic execution. These exceptions exist because the formal and high-scrutiny nature of such documents demands physical presence and notarization.

For everything within the legal scope of the Act, the diverse recognition of electronic signature methods removes barriers to entry. Citizens who cannot afford hardware tokens or lack technical literacy can still participate in digital commerce using their Aadhaar OTP or fingerprint. The two-factor authentication process – which includes both Aadhaar identification and OTP verification – ensures a high level of security, making Aadhaar-based eSign a trusted solution for individuals and businesses handling critical documents.

Why this matters for the digital economy

Before Section 3A, digital authentication in India was effectively locked behind a technological wall that only large enterprises and tech-savvy users could navigate. The 2008 amendment – by anchoring the law in reliability rather than a specific technology – democratized legal authentication. It meant that a farmer in rural Maharashtra could sign a government form using their fingerprint with the same legal validity as a corporate executive using a PKI-based USB token in a city office.

A 2023 PwC report highlighted that 70% of Indian enterprises now use e-signatures, up from 45% in 2020, driven by cost savings – including up to 80% reduction in document processing time – and remote work trends post-COVID. This adoption trajectory is directly linked to the flexible legal architecture that Section 3A created.

Internationally, India’s approach aligns with global norms. The UNCITRAL Model Law has been enacted in over 30 countries, including India and China, ensuring that electronically signed Indian documents are increasingly recognized across jurisdictions. A Delhi High Court ruling in 2022 further affirmed e-signatures in arbitration agreements, solidifying their reliability in legal proceedings.

For a country of India’s scale and diversity, the shift from a single cryptographic standard to a spectrum of legally recognized authentication methods was not just a technical update – it was a policy decision to make trust in the digital economy inclusive, scalable, and future-ready.

What do you think? As electronic signatures continue to replace physical ones across banking, healthcare, and governance – should India consider extending their legal scope to documents currently excluded, like wills or powers of attorney? And does relying on a single national identity infrastructure like Aadhaar for authentication create a concentration of risk in India’s digital trust ecosystem?

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.

References

PDF 📄

Table of Contents

What Section 3A of the IT Act actually says 🔗

Digital signature vs. electronic signature: an important distinction 🔗

Categories of electronic authentication: the UNCITRAL framework 🔗

Knowledge-based authentication 🔗

Biometric-based authentication 🔗

Possession-based authentication 🔗

Other authentication methods 🔗

Aadhaar eSign: India’s practical application of Section 3A 🔗

Legal recognition and the trust it builds 🔗

Why this matters for the digital economy 🔗