Introduction

India’s Electronic signature (“e-signature”) law is built on a premise that prominent jurisdictions of the world have rejected: that the state, through a prescribed list of approved methods, and not the UNCITRAL-based model, which lets any method qualify so long as it performs the functions of a signature, should decide what counts as a legally valid signature. This article argues why India may be right.

E-signatures are electronic authentication methods used to establish a signatory’s identity and their intent to sign a particular document. They encompass a wide range of technologies, ranging from simple techniques, such as a click-wrap or a stylus signature, to complex methods like digital signatures which use cryptographic techniques and hash functions capable of detecting even the slightest changes in the document content. So, "e-signature" is the umbrella term for all such methods, while "digital signature" refers only to the sub-type that relies on asymmetric cryptography and hash functions.

Given their commercial importance, UNCITRAL's 1996 and 2001 model laws adopted a tech-neutral approach, recognising any method that serves a signature's basic functions.

India, however, took a different path. While legally recognising e-signatures, it adopted the technological specificity approach, granting legal recognition only to those e-signature methods that satisfied the reliability criteria and are specified under the Second Schedule of the Information Technology Act, 2000 (“ITA”). This divergent approach demands a closer analysis, especially in light of the proposed Digital India Act (“DIA”) that seeks to replace the ITA. Although no draft bill is yet public, the reform direction under discussion would have a direct implication on the e-signatures that law recognises. That makes it timely to ask whether India's specificity is a defect to be corrected or a feature worth keeping.

This article, argues that India should retain technological specificity for two reasons: first, this specificity applies only to statutory signature requirements rather than to broader agreements or contracts; and second, mandating a specific form serves important functions like evidentiary certainty, forced deliberation and reduced judicial burden in Indian context. Additionally, it argues for the removal of the classification between electronic signatures and secure electronic signatures, given the operational redundancy of this distinction under ITA and the confusion it creates regarding evidentiary presumptions under the Bharatiya Sakshya Adhiniyam, 2023 (“BSA”).

The Distortion: How India Turned a Presumption Into a Precondition

Article 7 of the 1996 UNCITRAL Model Law on Electronic Commerce (“1996 Model Law”), laid down three function-based requirements for a method to qualify as an e-signature: a) the method must identify the person, b) indicate their approval, and c) the method is reliable as was appropriate for the purpose it was generated. The term ‘reliability’ or ‘appropriateness’ is not defined in the model law, but the adjoining Guide to Enactment provides a set of 14 legal, technical and commercial factors that may be taken into account to determine the appropriateness of a method.

Citing the 1996 Model Law in its preamble, India enacted the ITA in the year 2000. But instead of a tech-neutral provision similar to the 1996 Model Law, Section 3 of the ITA gave legal recognition to a very specific type of e-signature, i.e., digital signatures.

Subsequently, beyond the 1996 Model Law, the 2001 Model Law on Electronic Signatures (“2001 Model Law”) added specific criteria to determine the technical reliability of e-signatures: exclusive linkage of signature data to the signatory, exclusive control during signing, and detectability of subsequent alteration to the e-signature and to the information relayed. These conditions, if met, raise a presumption of reliability in favour of the e-signature. This presumption was designed to provide ex ante certainty, in contrast to uncertain post-hoc reliability determinations by courts.

All four requirements of this criteria introduced in the 2001 Model Law were adopted nearly verbatim in Section 3A, added through the 2008 amendment to the ITA. The object of this amendment was to harmonise the Indian e-signature law the 2001 Model Law, and move towards tech-neutrality.

But the actual drafting of Section 3A achieved the opposite. Under Section 2(ta), an authentication method qualifies as an “electronic signature” only if specified in the Second Schedule. The proviso to Section 3A(4) precludes any method from the Second Schedule that does not conform to S. 3A’s reliability criteria. The result is that the criterion envisioned by the 2001 Model Law, to provide ex ante certainty of reliability to an e-signature was enacted in India as the very condition to be legally recognised as an e-signature in the first place. The Model Law makes reliability a rebuttable presumption open to challenge in each case, while Section 3A settles it once, at the time of notification by government, sparing courts a repeat inquiry. This excludes simpler methods, like appending a name at the end of a mail, which can show identity and intent and would likely pass UNCITRAL's functional test from legal recognition as e-signatures.

To date, only two methods have been specified in the Second Schedule, both fundamentally based on the digital signature technology: Aadhaar-based e-KYC authentication and trusted third-party key facilitation. So, despite the expanded terminology from digital to electronic signatures, India’s e-signature regime remains largely technologically specific in practice.

However, this continued specificity under Section 3A should not be equated with the stricter Section 3 digital signature regime. Section 3 specificity embedded a precise technological mechanism, involving hash functions, asymmetric cryptosystems and public-private key pairs, into the statute itself. Section 3A, by contrast, prescribed only what an authentication method must achieve i.e. exclusive linkage, sole control, tamper-detection; while leaving the how open. This is the difference between a design standard and a performance standard: the former mandates the means through which a form must be achieved and the latter describes the outcomes or the ultimate form required. The design choices now sit in the Second Schedule modifiable by an executive gazette notification rather than a stricter parliamentary amendment. This lighter, notification-based specificity is not the rigid technology-in-statute of Section 3, so the usual "frozen technology" objection does not apply.

Having established what kind of specificity India actually practises, we can now ask the more fundamental question: is it worth practising at all?

In Defence of Specificity

It has been argued, that India should reform towards recognising all forms of e-authentication technologies and not just a specified few, a step in the direction of tech-neutrality. However, a more nuanced analysis reveals that such reforms may be unnecessary. The analysis rests on two pillars: the limited scope of technological specificity and its functional value as a legal form.

Specificity Applies Only Where the Law Demands a Signature

India’s tech specific regime is criticised for excluding innovative authentication methods from legal recognition. But this exclusion narrowly applies only to the statute mandated signatures and not to the vast universe of private agreements.

Section 5 of the ITA permits the use of an electronic signature to meet the requirement of affixing a signature under any law. But under Section 10A of the ITA, evidence of the formation of a contract (including the communication of acceptance, proposal, and revocation) through electronic form or record is sufficient, and no signature is required.

Similarly, the Indian Contract Act does not require a signature as a precursor to forming an agreement and a clear proposal or acceptance suffices. This means that while only a specified e-signature can meet the requirement of a signature under a law, parties remain free to use any e-authentication method as an expression of consent in private agreements.

The 1996 Model Law favoured tech-neutrality partly to leave room for innovation. That room survives in the private contractual realm, where parties may use the latest technologies available. This is already where most innovation sits: clickwrap, OTP, biometrics and platforms like DocuSign, all used freely in private contracting.

Three Functions That Neutrality Would Sacrifice

Lon Fuller, in “Consideration and Form”, identified three functions of legal formalities: an evidentiary function (providing objective proof the legal transaction), a cautionary function (inducing deliberation before acting) and a channelling function (offering a clear framework for legally effective action). Though originally developed for contract formalities, Fuller’s framework has been applied to electronic signatures by scholars including Mark Sneddon and Stephen Mason. Because specified e-signatures perform all three functions, the mandated form is not friction but what makes the signature work. Form serves function.

Specified e-signatures under the ITA serve all three functions. The evidentiary function is served through non-repudiation feature. It means that any change to the signature or the information is detectable. Thus, ensuring the authenticity and integrity of the legal transaction, in contrast to the less secure methods that can be forged easily and undetectably.

The cautionary function, requires an interruption of the ordinary flow of conduct that forces the person to stop, recognise, and deliberate. In case of a specified digital signature or e-signature the signatory must complete additional authentication steps such as providing a DSC token, OTP, PIN, or biometric verification. These steps operate as a psychological check that forces the signatory to realise the performance of a legal act. The same is not true for methods like signing at the end of an email or a clickwrap, which are almost instantaneous, requiring little deliberation.

The channelling function is served when the specificity of form enables a clear and identifiable channel for legally enforceable acts. For example, Rule 26(1) of the CGST Rules prescribes that all returns and applications may be submitted using a digital signature certificate or an e-signature as specified under the ITA. When millions of such filings are processed annually, the specified form acts as a channel that can instantly verify and accept an application without having to evaluate the underlying technology. If any e-authentication method were permitted then each filing would require an individual assessment, and disputes later would demand an inquiry into the method used. Moreover, this channelling function does not foreclose innovation as the government can add methods to the Second Schedule through notification.

A possible objection is that even if specificity serves these 3 functions, the burden it imposes maybe disproportionate to the transaction it governs. Fuller anticipated this critique stating that the legal system should not "require a sealed and witnessed document for the effective sale of a loaf of bread." India's current framework broadly satisfies this proportionality. No signature is required for everyday low-value contracts under the Indian Contract Act. But as the stakes rise, so does the formality demanded: registering a partnership firm requires all partners to sign the application (Indian Partnership Act, 1932, Section 58), incorporating a company requires subscribers to sign the Memorandum and Articles of Association (Companies Act, 2013, Section 7), and income tax returns must be signed and verified by the assessee themselves (Income Tax Act, 1961, Section 140).

Crucially, the compliance burden of mandating specified e-signatures is negligible. For example, Aadhaar eSign takes under a minute requiring a valid Aadhaar number and access to a linked phone. A higher standard, thus, decreases the litigation costs without materially increasing compliance costs.

Finally, tech-specificity also serves the function of reducing burden on courts. Scholars have recommended that DIA should adopt a tiered classification of e-signatures modelled on the EU’s eIDAS Regulation distinguishing between Simple, Advanced, and Qualified Electronic Signatures. However, this recommendation overlooks a key difference in what courts are asked to do. Under eIDAS, only Qualified Electronic Signatures carry a presumption of validity. Simple and advanced e-signatures carry none and courts must still evaluate reliability case-by-case. The tiered model thus reduces court burden only at the top tier. Under India’s tech specific approach executive performs an ex ante determination of reliability through second schedule notification. So the courts only need to verify the factual question of transactional authenticity in a case. To the contrary, in the system of tiered neutrality the courts must first answer the harder question of whether technology meets the reliability criteria before reaching the factual question. This additional burden on courts is particularly significant in Indian context, where the judiciary is already strained with around 5 crore pending cases. In a bid to reduce this burden Fuller argued that legal form could act as an "external test of enforceability." Second schedule notified e-signatures function as these external tests.

A Classification Without Function

Although technologically specific regime serves important functions, ITA undercuts its own logic through a classification that creates ambiguity.

ITA classifies signatures into two types: e-signatures under Section 3A (satisfying the reliability criteria and notified under the Second Schedule) and secure electronic signatures under Section 15. Section 15 requires two conditions for a secure electronic signature: the private key must be under the exclusive control of the signatory, and it must be stored and affixed in the prescribed manner. But exclusive control is already the first requirement under Section 3A’s reliability criteria. And no additional manner of storage and affixation of signature has been prescribed yet. Since any Section 15 signature already satisfies Section 3A, the "secure" label adds nothing at present. The categories overlap, leaving the classification redundant.

This redundancy creates real confusion. Under Section 86(2) of the BSA, presumption of authenticity and integrity attaches only to secure electronic signatures and not to all specified e-signatures. Section 66 of the BSA further provides that for non-secure e-signatures, the fact that a signature belongs to a subscriber must be independently proved. The 2001 Model Law envisioned this presumption for signatures complying with the reliability criteria. Since complying with these criteria is a necessary condition for notification under the Second Schedule, the presumption should logically extend to all specified e-signatures. But the current classification withholds this. In practice, every method presently notified (like the Aadhaar eSign and DSC-based methods) likely satisfies Section 15's exclusive control requirement anyway.

Even if, in future, prescription of new storage and affixation methods were to give Section 15 independent content, the structural problem persists: denying the presumption to a method that has already cleared the reliability threshold solely because it lacks a separate "secure" label undermines the very certainty that this specificity was designed to provide.

Hence, the upcoming Digital India Act should eliminate this redundant classification and extend the presumption to all specified e-signatures.

Conclusion

As DIA takes shape, the temptation to adopt a technologically neutral regime is strong. But specificity viewed through Fuller’s functional theory is not a hurdle, but a feature. Specificity for legal requirements saves crucial state resources while ensuring that sovereign records remain immutable and unforgeable. On the other side of the balancing scale, by embracing tech neutrality for the marketplace, India has ensured that private commerce can move at the speed of a click. Goal of e-signature regime is not merely efficiency, but also to make signature final.

At the same time DIA must avoid inheriting the redundant classification between secure and non-secure e-signatures from ITA. Therefore, in designing DIA, the aim should be to preserve specificity where it serves a legal function and abandon classifications that perform none.