Are electronic signatures legal in India? IT Act, Aadhaar eSign and DSC explained

Rent agreements, offer letters and loan papers in India now often arrive as a PDF with a request to e-sign, sometimes with Aadhaar eSign. It is reasonable to wonder whether that counts in law.

It does: but Indian law is more specific than most about which kind of electronic signature it recognises, and it still keeps a short list of documents outside the digital world altogether. This guide walks through the law, the exceptions, and what to use for the documents people actually sign.

The short answer

• Electronic signatures are legally recognised in India under the Information Technology Act, 2000 (the IT Act). Where a law says a document must be signed, that requirement is met by a signature made in the manner the Act allows.
• The Act recognises two things: a digital signature made with a certificate issued by a licensed Certifying Authority (the familiar DSC), and an electronic signature made with a technique listed in the Act's Second Schedule: in practice, Aadhaar eSign (and other e-KYC based eSign) offered by licensed eSign Service Providers.
• A contract can also be formed electronically, by email, by clicking "I agree", or by a signature image on a PDF. Indian courts accept that a contract formed this way is valid; the question in a dispute is proof, not validity.
• A few documents are still excluded from the IT Act: wills, trusts, and negotiable instruments and powers of attorney between private individuals. Contracts for the sale of property were removed from that list in 2022, but stamp duty and registration rules still apply.

The law: what the IT Act actually recognises

Digital signatures (section 3)

The original 2000 Act was built around digital signatures: the public-key cryptography kind. A subscriber signs an electronic record with a private key, and anyone can check it with the matching public key in a Digital Signature Certificate (DSC). DSCs are issued by Certifying Authorities (CAs) licensed by the Controller of Certifying Authorities (CCA), which operates under the Ministry of Electronics and Information Technology and runs the root of India's public-key infrastructure.

Electronic signatures (section 3A and the Second Schedule)

The IT (Amendment) Act, 2008 made the law technology-neutral in principle by adding section 3A: a subscriber may authenticate a record by an electronic signature or electronic authentication technique that is considered reliable and is specified in the Second Schedule. The Second Schedule lists the approved techniques. The one almost everyone uses is e-authentication using Aadhaar e-KYC: better known as Aadhaar eSign. You enter your Aadhaar number, receive an OTP (or use biometrics), and an eSign Service Provider creates a short-lived certificate in your name and signs the document with it on your behalf.

Legal recognition (section 5)

Section 5 is the key provision: where any law requires information to be authenticated by affixing a signature, that requirement is satisfied if it is authenticated by an electronic signature affixed in the manner prescribed by the Central Government.

That phrase ("in the manner prescribed") is why Indian practice leans so heavily on DSC and Aadhaar eSign. When a statute or a government office demands a signature, those are the two methods the law clearly blesses.

What about a signature image, a click or an email?

The IT Act also says (section 10A) that a contract is not unenforceable just because it was formed using electronic records. The Supreme Court upheld a contract concluded through an exchange of emails in Trimex International FZE v. Vedanta Aluminium (2010). So a rent agreement signed by pasting a signature image, or an NDA accepted with a typed name, can still be a binding contract. Provided the ordinary Indian Contract Act rules (offer, acceptance, consideration, free consent) are met.

What such a signature lacks is the statutory presumption. If the other side later denies signing, you must prove it was them, with emails, OTP logs, IP addresses, an audit trail. That is the practical difference.

Evidence: the Bharatiya Sakshya Adhiniyam, 2023

Since 1 July 2024, the Bharatiya Sakshya Adhiniyam, 2023 (BSA) has replaced the Indian Evidence Act, 1872. Two provisions matter here:

• Section 63 BSA (which replaced the old section 65B) governs how electronic records are admitted in court. It keeps the requirement of a certificate, and the new format asks for more detail, including a hash value of the record.
• Section 66 BSA (the old section 67A) says that, except for a secure electronic signature, a person relying on an electronic signature has to prove it belongs to the person said to have signed.

The upshot: a certificate-based signature starts with a head start in court. Any other electronic signature needs supporting evidence, which is exactly what a good audit trail provides.

Documents you cannot sign electronically in India

The IT Act does not apply to the documents in its First Schedule. The Central Government amended that Schedule in 2022 (notification S.O. 4720(E), dated 26 September 2022). After that change, the list is:

Two practical consequences follow.

First, the 2022 change was aimed mainly at lending: banks, NBFCs and housing finance companies can now take loan documents, demand promissory notes and powers of attorney in their favour digitally. A power of attorney you give your brother, or a promissory note between two friends, is still outside the Act.

Second, removing property contracts from the exclusion list did not remove stamp duty or registration. A sale deed must still be registered under the Registration Act, 1908 and the relevant State's rules, which normally require the parties to appear before the Sub-Registrar (in person, or through whatever online or video process a particular State has introduced). An electronic signature on the PDF does not replace that step.

Common situations

Rent and leave-and-licence agreements

Short residential agreements are ordinary contracts and can be signed electronically. But two rules sit on top:

• Stamp duty. Rent agreements attract stamp duty under the Indian Stamp Act, 1899 or the State's stamp law. An insufficiently stamped agreement is not admissible in evidence until the duty and penalty are paid. Many States let you buy an e-stamp online, which is then printed or attached. Sign after stamping.
• Registration. A lease of immovable property from year to year, or for more than a year, must be registered. This is the reason for the familiar 11-month agreement. Some States run online registration for leave-and-licence agreements. Maharashtra is the best-known example, using Aadhaar-based authentication through the State registration department's own system.

For an 11-month agreement where the stamp paper is sorted, an electronic signature from both landlord and tenant is common and workable. For a registered lease, follow the Sub-Registrar's process.

Offer letters and employment contracts

Nothing in Indian labour law requires wet ink for an appointment letter or employment agreement. Electronic acceptance (by signature, OTP or email) is widely used and valid. Keep the signed PDF and the audit trail; they are your proof of what was agreed.

Company, GST and income-tax filings

Government portals prescribe the method, and it is usually a DSC (and for some filings, Aadhaar-based e-verification):

• MCA21 company filings are signed with the DSC of the director or professional.
• GST returns are signed with a DSC (mandatory for companies and LLPs) or EVC (an OTP method) for others.
• Income tax returns are verified with a DSC, Aadhaar OTP or net banking e-verification. A DSC is mandatory for companies; since 2024, individuals and HUFs under tax audit may e-verify instead.

These portals use their own signing utilities. You do not upload a PDF signed elsewhere.

Loan and banking documents

Banks and NBFCs typically use Aadhaar eSign through their own eSign provider, together with e-stamping, often through the National e-Governance Services (NeSL) digital documentation platform. This is exactly the space the 2022 First Schedule amendment opened up.

Courts

E-filing in Indian courts has its own rules, and many High Courts accept DSC or Aadhaar eSign on vakalatnamas and affidavits under their e-filing procedures. Check the specific court's e-filing rules; they vary.

DSC vs Aadhaar eSign: which do you need?

Since 1 January 2021, the CCA discontinued Class 2 certificates; individual DSCs are now issued as Class 3.

How to get a DSC in India

1. Choose a licensed Certifying Authority (the CCA publishes the current list) or one of its registration authorities.
2. Complete identity verification: usually Aadhaar e-KYC, PAN-based e-KYC or a video verification.
3. The certificate and key are generated on a FIPS-validated USB crypto token.

That last point matters. CCA's rules require the private key of a DSC to be generated and kept on a hardware token, and it cannot be exported to a file. That means a normal Indian DSC cannot be uploaded to any website, including KovaPDF. It is used through the token's driver and the portal's own signing utility, or desktop software such as Adobe Acrobat that talks to the token directly. The CCA has also moved to newer FIPS 140-3 tokens: from 21 September 2026, new DSCs must be issued on FIPS 140-3 tokens, while certificates already on older FIPS 140-2 tokens keep working until they expire. If you are buying a token, ask the CA which standard it meets.

Using KovaPDF for this

Pick the tool by what the document needs:

• Everyday agreements where any electronic signature is enough: an 11-month rent agreement on e-stamp paper, an NDA, a freelance contract, an offer letter, a vendor agreement. Use Request Signatures to send the PDF to everyone who must sign. Each person gets a private link, signs in the browser without an account, and you can set the order (for example, tenant first, then landlord) and an access code you share by phone. When everyone has signed, each party receives the signed PDF with a certificate of completion (names, emails, times, IP addresses) and the finished file is sealed with a trusted timestamp, so any later edit is detectable. Legally this is an ordinary electronic signature backed by evidence, not a DSC or Aadhaar eSign.
• Just you, signing a form: use Sign PDF to draw, type or upload your signature and place it.
• You have a certificate as a .pfx or .p12 file: for example an organisational document-signer certificate that your CA issued in exportable form. Use Digital Signature. It creates a PAdES signature with a trusted timestamp and, where the CA publishes revocation information, long-term validation data. Whether that signature is a DSC signature under the IT Act depends on the certificate: a certificate from a CCA-licensed CA gives you that; a self-made certificate does not.
• Someone sent you a signed PDF: check it with Verify PDF Signature. It shows whether the file changed after signing and who signed it. Signatures from Indian CAs chain up to the CCA's root, which some foreign software does not trust by default; "not trusted" there is about the root, not a sign of forgery.

What KovaPDF cannot do: sign with a USB-token DSC, or perform Aadhaar eSign. For those, use the portal or eSign provider that asks for them.

A quick decision guide

• A statute or portal says "digitally signed" or "DSC" → DSC through the portal's utility.
• A bank or regulated entity sends an eSign link → Aadhaar eSign via their provider.
• A private contract, HR document or rental agreement → any electronic signature works; Request Signatures gives you the evidence trail.
• A will, trust deed, or power of attorney to a family member → paper, wet ink, with witnesses and registration as the law requires.