eSign and Digital Signature for Government Documents

Quick answer: For eSign and digital signature for government work in India, use eSign (Aadhaar or e-KYC based, no token) for citizens and occasional signers, and a Class 3 Digital Signature Certificate (DSC) for officers, vendors and tenders. Both are legally recognised under the IT Act, 2000. Scanned signature images are not.

Government offices across Maharashtra have moved many services online, yet a large number of workflows still stop at one step: the signature. Certificates are printed, signed by hand, scanned and uploaded again. Approval notes wait days for an officer to return to the office, and contractors travel just to submit signed bid papers.

Using eSign and digital signature for government documents removes this bottleneck. The trouble is choosing the right method. Departments often mix up eSign, DSC and scanned signatures, or force one method onto every use case. This guide explains the legal basis, compares the options side by side, and gives a step-by-step plan to build signing into a government portal.

The Legal Basis in India

The Information Technology Act, 2000 gives legal recognition to electronic records and electronic signatures. Digital signatures based on public key infrastructure are recognised under Section 3. Section 3A allows any electronic signature technique listed in the Act's Second Schedule, and that schedule includes e-authentication using Aadhaar or other e-KYC services, which is the basis of eSign.

The Controller of Certifying Authorities (CCA), under the Ministry of Electronics and Information Technology, licenses the Certifying Authorities that issue DSCs and sets the guidelines for eSign Service Providers (ESPs). All valid certificates chain up to the Root Certifying Authority of India.

A few documents are excluded from the Act by its First Schedule, including wills, powers of attorney, trusts, negotiable instruments other than cheques, and contracts for the sale or conveyance of immovable property. Check this list, and any department-specific rules, before digitising a signing workflow.

eSign vs DSC vs Scanned Signature: Comparison

This table shows how the three common approaches compare for government use.

Point	eSign	Digital Signature Certificate (DSC)	Scanned signature image
Legal status under IT Act	Recognised (Section 3A, Second Schedule)	Recognised (Section 3)	Not an electronic signature
How the signer proves identity	Aadhaar OTP or biometric e-KYC at the time of signing	Certificate issued after verification, used with a PIN	No identity check
Hardware needed	None; works in browser and on mobile	USB crypto token	None
Validity	One-time key for each signature	Fixed period, usually one to three years	Not applicable
Cost model	Per signature, through an ESP or aggregator	Per certificate and token	Free, but no legal value
Best fit	Citizens, applicants, occasional signers	Officers, vendors, e-tendering, statutory filings	Display only, never for validity

How eSign and DSC Work

eSign (online electronic signature)

eSign is a signing service provided by licensed ESPs. The signer authenticates, usually with Aadhaar-based OTP or biometric e-KYC, and a one-time key pair is created to sign the document. The application normally sends only a hash of the document to the ESP, not the document itself. No token is needed, so it suits citizens and anyone who signs rarely.

Digital Signature Certificate (DSC)

A DSC is issued to a person or organisation by a licensed Certifying Authority after identity verification, and is typically stored on a secure USB crypto token. Since Class 2 certificates were discontinued from January 2021, Class 3 is the standard for individuals and organisations. DSCs are widely used for e-tendering, procurement portals and statutory filings, so they suit officers and vendors who sign often.

What a scanned signature is not

A scanned image of a handwritten signature pasted into a PDF is not an electronic signature under the IT Act. It offers no proof of identity or protection against changes, so it should never be used where legal validity matters.

Where Each Method Fits in Government Workflows

• Citizen applications and declarations: eSign lets applicants sign forms on a portal without visiting an office.
• Certificates issued to citizens: income, caste, domicile and similar certificates can be digitally signed by the issuing officer using a DSC, so they can be verified online. Many departments also push them to DigiLocker; see our guide to DigiLocker integration for government departments.
• Internal file approvals: officers approving notes and orders often use DSC, or eSign where the office system supports it. Our e-Office implementation guide covers the wider file workflow.
• Tenders and procurement: vendors typically sign and encrypt bids with a Class 3 DSC on e-procurement portals. See our note on e-tender management systems.
• Agreements with contractors and vendors: either method can be used, subject to departmental rules and stamp duty requirements.
• Bulk outputs: for high-volume notices or certificates, server-side signing with an organisational certificate kept in a hardware security module may be suitable, subject to policy approval.

Common Mistakes That Stall Digital Signing

• One method for everything: asking citizens to buy a DSC token, or letting officers approve high-value orders with no audit trail. The fix is to choose the method per document type.
• Token problems on the day: browser signing fails because drivers or signing utilities do not support the officer's token or operating system. The fix is to test with the actual tokens in use before launch.
• Expired certificates: approvals stop when an officer's DSC lapses. The fix is an expiry register with reminders.
• No verification for recipients: banks and other offices cannot check a signed certificate, so they ask for a hard copy anyway. The fix is a verification page or QR code.
• Weak portal security: a signed document is only as trustworthy as the system that produced it. The fix is secure coding, testing and monitoring.

The Fix: How to Build Signing Into a Government Portal

For departments and their IT teams, adding signing to a portal involves more than a button. Follow these steps:

1. Map the workflows: List every document that needs a signature, who signs it, how often, and whether legal rules require a particular method.
2. Choose the method per document: Use eSign for citizens and low-volume signers, DSC for officers and vendors, and server-side signing only for approved bulk outputs.
3. Select an ESP or aggregator for eSign: Confirm the integration approach, pricing model and supported authentication modes before development starts.
4. Handle DSC on the client side: Use a signing utility or component that works with USB tokens across operating systems, and test with the token types your officers actually use.
5. Use a standard signed format: Apply PDF signatures with visible signature blocks for users, while the embedded cryptographic signature provides validity.
6. Add verification: Give recipients a way to check signed documents, such as a verification page or a QR code linked to the portal.
7. Log everything: Record who signed, when, the certificate used and the document hash, and keep logs secure and tamper-evident.

Preparing Officers and Citizens for the Change

Technology is rarely the hardest part. Adoption is. Officers used to wet signatures may worry about accountability, and citizens may doubt whether a digitally signed certificate will be accepted elsewhere. Plan for this early:

• Issue a clear office order stating which documents will be signed electronically and by which method.
• Run short, hands-on training for officers on token use, PIN safety and what to do if signing fails.
• Set up a helpdesk contact for token, driver and browser issues during the first few weeks.
• Print a short note on digitally signed certificates explaining how to verify them online.
• Pilot with one office or one service before expanding across the district or state.

Security and Governance Checklist

• Keep DSC tokens under each officer's personal control, and never share tokens or PINs.
• Maintain a register of DSC expiry dates and renew before expiry.
• Revoke certificates promptly when officers transfer or retire, or when a token is lost.
• Protect server-side signing keys in hardware security modules with strict access control.
• Validate certificate chains and revocation status when accepting signed documents.
• Protect the portal with secure coding, security testing and monitoring.

Frequently Asked Questions

Is eSign legally valid for government documents?

Yes. eSign is an electronic signature technique recognised under Section 3A and the Second Schedule of the IT Act, 2000, except for document types excluded by the First Schedule or by specific departmental rules.

What is the difference between eSign and a DSC?

eSign is an online service that uses Aadhaar or other e-KYC to create a one-time signature, with no token needed. A DSC is a certificate issued for a fixed period, usually stored on a USB token and used repeatedly.

Which DSC class is used for government work?

Class 3 DSC is the standard since Class 2 certificates were discontinued from January 2021. It is widely used for e-tendering and official filings.

Can a scanned signature replace a digital signature?

No. A scanned image does not verify identity or protect document integrity, and it is not an electronic signature under the IT Act.

Can a portal support both eSign and DSC?

Yes. Many portals offer eSign for citizens and DSC for officers and vendors. The key is to define which method applies to which document and to log every signature.

How Affix Center Can Help

Affix Center helps government departments, PSUs and agencies add eSign and DSC-based signing to portals and internal systems, from workflow mapping and ESP integration to verification pages, logging and security review. Explore our e-governance solutions and our cybersecurity services.

Want to remove the signature bottleneck from your department's workflows? Contact Affix Center to discuss your requirements.