Digital signatures and online contracts — are they binding?

The enforceability of an e-contract executed with a digital or electronic signature in India rests on a four-pillar architecture — Sections 3, 3A, 4, 5 and 10A of the Information Technology Act, 2000; the technology-neutral Second Schedule of e-signature techniques (including Aadhaar OTP-based eSign); Sections 10 and 25 of the Indian Contract Act, 1872; and the digital-evidence regime under Sections 63 and 39 of the Bharatiya Sakshya Adhiniyam, 2023. The framework is settled at the centre and contested at three edges — the Section 1(4) carve-outs, state-level e-stamping ambiguity, and the certificate requirement under Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal.

For roughly the first eight years of the Information Technology Act, 2000's life, Indian law on the enforceability of e-contracts was a riddle. The Act recognised digital signatures (Section 3), recognised electronic records as legally equivalent to paper records (Section 4), and recognised the use of digital signatures to authenticate filings with government (Section 5) — but it did not, in terms, say that a contract formed wholly through electronic means could not be denied enforceability merely because of its electronic form. The Indian Contract Act, 1872, drafted in a pre-electronic age, was silent. The Indian Evidence Act, 1872, then governing admissibility, was being rewritten through 2000-era amendments to admit electronic records under the new Sections 65A and 65B. The result was an enforceability question that depended on inference rather than text. The Information Technology (Amendment) Act, 2008 — which inserted Section 10A and the technology-neutral Section 3A — closed the question at its centre. The framework as it stands in 2026, after Trimex International FZE Ltd v Vedanta Aluminium Ltd, (2010) 3 SCC 1 on email-formed contracts, Anvar P V v P K Basheer, (2014) 10 SCC 473 on digital-evidence admissibility, and Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 on the Section 65B certificate requirement, is settled at the centre and contested at three working edges — the Section 1(4) carve-outs, the state-level e-stamping position, and the Section 63 BSA certificate practice.

The IT Act core — Sections 3, 3A, 4, 5 and 10A

Section 2(1)(p) of the IT Act, 2000 defines a digital signature as the authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with Section 3. Section 3 supplies the substantive standard — authentication of an electronic record by affixing a digital signature, effected by the use of an asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record. The Explanation to Section 3(2) defines the hash function as an algorithm that maps a sequence of bits into a smaller hash result, such that the same electronic record yields the same hash result every time the algorithm is executed, and it is computationally infeasible to derive the original record from the hash, or to produce two electronic records that yield the same hash. The key-pair architecture — private key with the subscriber, public key with the Certifying Authority — is the operational backbone of digital signatures in India, with Certifying Authorities licensed under Chapter VI of the Act by the Controller of Certifying Authorities.

Section 3A, inserted by the 2008 amendment, supplies the technology-neutral overlay. The provision authorises a subscriber to authenticate any electronic record by such electronic signature or electronic authentication technique which is considered reliable and which is specified in the Second Schedule. Section 3A(2) lays down the five conditions of reliability — the signature creation data must be linked to the signatory and to no other person; it must, at the time of signing, be under the control of the signatory and of no other person; any alteration to the signature after affixation must be detectable; any alteration to the information after authentication must be detectable; and the signature must fulfil such other conditions as may be prescribed. The Second Schedule, as amended by the Electronic Signature or Electronic Authentication Technique and Procedure Rules, 2015 and the further notification of 27 April 2016 (G.S.R. 446(E)), now specifies (a) e-authentication using e-KYC services — the Aadhaar-OTP-based eSign that has become the operational backbone of consumer e-contracts — and (b) e-authentication using a Digital Signature Certificate stored on a hardware security module. The 2015 amendment, by removing the "on hardware security module" qualifier from item (b) of the Second Schedule (G.S.R. 539(E), 30 June 2015), broadened the technology base.

Section 4 of the IT Act supplies the legal recognition of electronic records — where any law provides that information shall be in writing or in the typewritten or printed form, the requirement is deemed to have been satisfied if the information is rendered or made available in an electronic form and accessible for subsequent reference. Section 5 supplies the parallel recognition for electronic signatures — where any law requires that information be authenticated by affixing the signature of any person, the requirement is deemed to have been satisfied if the information is authenticated by means of an electronic signature affixed in such manner as may be prescribed by the Central Government. Section 10 confers on the Central Government the power to prescribe the type of electronic signature, the manner and format in which the signature shall be affixed, the manner or procedure that facilitates identification of the person affixing the signature, and the control processes and procedures to ensure adequate integrity, security and confidentiality of electronic records or payments.

Section 10A — inserted by the IT (Amendment) Act, 2008 and the central provision in the e-contract framework — provides: "Where in a contract formation, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances, as the case may be, are expressed in electronic form or by means of an electronic record, such contract shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used for that purpose." The provision is the textual anchor that the pre-2008 framework had lacked. After 27 October 2008, an e-contract — whether negotiated by email, executed by clickwrap, or signed through an Aadhaar OTP-based eSign — is statutorily protected against the medium-based unenforceability challenge.

The Contract Act overlay and the secure-signature framework

The Indian Contract Act, 1872 continues to govern the substantive law of contract formation. Section 2(b) defines a proposal that is accepted to be a promise; Section 2(e) defines an agreement as every promise and set of promises forming the consideration for each other; Section 2(h) defines a contract as an agreement enforceable by law. Section 10 specifies the conditions of enforceability — the agreement must be by free consent of parties competent to contract, for a lawful consideration and with a lawful object, and must not be expressly declared to be void. Section 25 governs consideration and supplies the residual exceptions (natural love and affection between near relations, past voluntary services, time-barred debts). None of these provisions was amended by the IT Act framework; the IT Act overlay operates by reading down the writing-and-signature formalities that some statutes superimpose on the Contract Act baseline, not by displacing the Contract Act.

The combined effect is that an e-contract is enforceable in India where (i) the Contract Act baseline of offer, acceptance, consideration, free consent and competent parties is satisfied, (ii) the medium is electronic and therefore engages Section 10A IT Act, (iii) the authentication is by digital signature under Section 3 or by an electronic signature under Section 3A on a technique notified in the Second Schedule, and (iv) the subject-matter is not within the Section 1(4) carve-outs of the IT Act. Where the contract is a high-value or evidentiary-sensitive instrument, the Section 14 IT Act concept of a secure electronic record and the Section 15 concept of a secure electronic signature operate as an additional layer — but neither concept is a precondition of enforceability under Section 10A.

Section 15 IT Act, as substituted by the 2008 amendment, deems an electronic signature to be a secure electronic signature where (a) the signature creation data, at the time of affixing the signature, was under the exclusive control of the signatory and no other person, and (b) the signature creation data was stored and affixed in such exclusive manner as may be prescribed. The Explanation makes clear that in the case of a digital signature, the signature creation data means the private key of the subscriber. Section 16, also substituted in 2008, empowers the Central Government to prescribe the security procedures and practices, having regard to the commercial circumstances and the nature of transactions. At the time of writing, the Central Government has not exhaustively prescribed the storage manner under Section 15(b); the consequence — flagged in the commentary to Chapter V of the IT Act — is that secure-electronic-signature status remains, in practice, an aspirational standard rather than a routinely-met baseline. Section 85B of the predecessor Evidence Act (now Section 39 of the Bharatiya Sakshya Adhiniyam, 2023, on the presumption as to electronic agreements and electronic signature certificates) supplies the evidentiary presumption — a secure electronic record is presumed not to have been altered, and a secure electronic signature is presumed to have been affixed by the subscriber with intent to authenticate.

The Section 1(4) carve-outs — what the IT Act framework does not reach

Section 1(4) of the IT Act, 2000, read with the First Schedule, excludes specified instruments from the operation of the Act. The carve-outs — substantially preserved through the 2008 amendments and the subsequent notifications — are the principal limit on the e-contract framework. The First Schedule excludes (i) a negotiable instrument (other than a cheque) as defined in Section 13 of the Negotiable Instruments Act, 1881; (ii) a power-of-attorney as defined in Section 1A of the Powers-of-Attorney Act, 1882; (iii) a trust as defined in Section 3 of the Indian Trusts Act, 1882; (iv) a will as defined in clause (h) of Section 2 of the Indian Succession Act, 1925, including any other testamentary disposition by whatever name called; and (v) any contract for the sale or conveyance of immovable property or any interest in such property. The carve-out for cheques was inserted by amendment to bring electronic-cheque clearing within the IT Act framework; the remaining four classes continue to require wet-ink execution.

The carve-outs produce three practical consequences. The first is the immovable-property sale-deed problem — the Section 1(4) exclusion of contracts for sale or conveyance of immovable property means that an Agreement to Sell or a Sale Deed of immovable property cannot, in itself, be executed through an electronic-signature framework that depends on Section 3 or Section 3A. The Registration Act, 1908 — which mandates registration of documents conveying interest in immovable property — operates in parallel and supplies the second formal barrier. The combined effect is that the e-contract framework is unavailable for property conveyances even where the parties wish to use it. The Madras High Court in Tamil Nadu Organic Pvt Ltd v State Bank of India, 2014 SCC OnLine Mad 7184 — addressing the validity of an e-auction conducted under the SARFAESI framework — clarified that the e-auction process itself is valid under the IT Act framework, but that the resulting sale of immovable property remains subject to the Registration Act requirements.

The second consequence is the will and testamentary-disposition problem. The Section 1(4) exclusion of wills means that the IT Act framework cannot be used to execute, attest or revoke a will. The Indian Succession Act, 1925's attestation requirements at Section 63 — two witnesses present at the time of the testator's signature — cannot, on the current statutory position, be satisfied through an electronic-signature framework. The Law Commission of India has, in successive Reports, recommended a limited statutory pathway for electronic execution of wills; no amendment has been brought into force. The third consequence is the negotiable-instrument problem (other than cheques) — promissory notes and bills of exchange continue to require wet-ink execution and physical delivery for the negotiability framework of the Negotiable Instruments Act, 1881 to operate.

State-level stamp duty and the e-stamping ambiguity

The Indian Stamp Act, 1899, read with the State amendments, governs the stamp-duty position on contracts in India. The Act predates the IT Act framework and was drafted on the assumption of wet-ink instruments executed on physical paper. Section 3 of the Indian Stamp Act, 1899, levies stamp duty on instruments specified in Schedule I; Section 17 requires execution to be on stamp paper of the prescribed value, with the duty to be paid at or before the time of execution. The application of the Stamp Act to e-contracts has been worked out in piecemeal fashion through State amendments — Maharashtra, Karnataka, Delhi, Gujarat and Tamil Nadu have each issued notifications adapting the framework to e-stamping through Stock Holding Corporation of India Limited's e-stamping certificate. The position varies significantly across States.

The unresolved questions are three. The first is the timing of payment — Section 17 requires execution to be on stamp paper of the prescribed value, but the e-contract framework permits the affixation of the signature first and the procurement of the e-stamp certificate subsequently, with no clear statutory resolution of the timing mismatch. The second is the State of execution problem — Section 18 of the Indian Stamp Act, 1899 requires payment of stamp duty in the State where the instrument is first executed; an e-contract executed by parties in different States, on a platform server in a third State, produces a determinacy problem that the statutory framework was not drafted to resolve. The third is the e-stamping certificate authenticity — the Stock Holding Corporation's e-stamping framework is operationally well-established but is anchored in administrative notifications rather than in primary statute, and the State-level departures from the central framework produce inconsistency. The practical workaround — payment of stamp duty in the State of one party's principal place of business, with explicit recital in the contract of the State of execution — is widely used but not statutorily settled. The Supreme Court's 2023 ruling in NN Global Mercantile Pvt Ltd v Indo Unique Flame Ltd, (2023) 7 SCC 1 — addressing the consequences of insufficient stamping for arbitration agreements — has tightened the stamping-compliance discipline at the enforcement stage; the doctrine applies equally to e-contracts.

Admissibility under the Bharatiya Sakshya Adhiniyam, 2023

The evidentiary regime for an e-contract is now governed by the Bharatiya Sakshya Adhiniyam, 2023, which came into force on 1 July 2024. Section 63 BSA [Section 65B Indian Evidence Act, 1872] supplies the conditions of admissibility for electronic records — the computer producing the output must have been in regular use, the information must have been regularly fed in the ordinary course of activities, the computer must have been operating properly, and the information in the electronic record must reproduce the information fed in. Section 63(4) BSA [Section 65B(4) IEA] requires a certificate identifying the electronic record, describing the manner of production, particulars of the device, and signed by a person occupying a responsible official position in relation to the operation of the device. The certificate requirement is the operational chokepoint of digital-evidence admissibility.

The Supreme Court's reading of the certificate requirement has moved through three stages. The first stage — Anvar P V v P K Basheer, (2014) 10 SCC 473 — held that the Section 65B(4) IEA certificate is mandatory for the admissibility of secondary electronic evidence, overturning the earlier reading in State (NCT of Delhi) v Navjot Sandhu, (2005) 11 SCC 600 that had permitted oral evidence as a substitute. The second stage — Shafhi Mohammad v State of Himachal Pradesh, (2018) 2 SCC 801 — relaxed the rule, holding that the certificate requirement is procedural and could be dispensed with in the interests of justice where the party adducing the evidence does not have control over the device. The third stage — Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 — restored the strict reading of Anvar P V, holding that the certificate is mandatory and that Shafhi Mohammad stands overruled to the extent it held otherwise. The position post-Khotkar, carried over into Section 63 BSA, is that an e-contract sought to be adduced in evidence must be accompanied by a certificate identifying the electronic record and the device, with the certificate signed by a person in a responsible official position. The practical compliance discipline — preserving the metadata, the platform audit log, and the responsible-officer certificate at the moment of execution — is now part of the workflow design of any serious e-contracting platform.

Section 39 BSA, in conjunction with the legacy framework at Sections 67A, 73A, 85A, 85B, 85C, 88A and 90A of the Indian Evidence Act, 1872, supplies the presumptions architecture. The presumption as to electronic agreements (legacy Section 85A) applies to any electronic record purporting to be an agreement containing the electronic signature of the parties — the agreement is presumed concluded by affixing the signature. The presumption as to electronic records and electronic signatures (legacy Section 85B) attaches to secure electronic records and secure electronic signatures. The presumption as to Electronic Signature Certificates (legacy Section 85C) attaches to the information listed in the certificate as accepted by the subscriber. The presumptions are rebuttable but operate as the doctrinal mechanism through which an e-contract executed with a digital or Aadhaar-OTP-based signature is treated as enforceable without independent proof of execution.

Email-formed contracts and the Trimex framework

The principal early authority on the enforceability of e-contracts negotiated through email is Trimex International FZE Ltd v Vedanta Aluminium Ltd, (2010) 3 SCC 1. The Supreme Court held that a contract for the sale of bauxite, negotiated entirely through email exchanges between the parties — with the offer, the acceptance, the price and the delivery terms set out across a series of emails — was a concluded contract under the Indian Contract Act, 1872, notwithstanding the absence of a formal signed agreement. The ratio is twofold: first, that the Contract Act requirements of offer, acceptance and consideration can be satisfied through an exchange of electronic communications without any further formality; and second, that the arbitration agreement contained in such an email-formed contract is enforceable for the purposes of the Arbitration and Conciliation Act, 1996. The Trimex ruling — handed down on 22 January 2010, shortly after the IT (Amendment) Act, 2008 came into force on 27 October 2009 — is doctrinally rooted in the pre-Section-10A reasoning but is reinforced by the Section 10A textual anchor.

The Trimex framework has been followed in a long line of High Court rulings on email-formed commercial contracts — from the Delhi High Court's Galaxy Infra and Engineering Pvt Ltd v Pravin Electricals Pvt Ltd framework on email-based purchase orders, through the Bombay High Court's rulings on email-formed software licensing agreements, to the Madras High Court's Tamil Nadu Organic framework on e-auction processes. The doctrinal stability of the email-formation framework is now sufficiently entrenched that the surviving litigation tends to be about evidence — whether the relevant email exchanges have been adduced with a proper Section 63 BSA certificate — rather than about enforceability. The clickwrap and browsewrap variants — terms of service agreed by a single tick or by mere use of the platform — have been worked out through a separate High Court line, with the Delhi High Court and Bombay High Court rulings clarifying that a clickwrap with clear notice and an affirmative tick is enforceable, and a browsewrap with implicit acceptance through use is enforceable only on stricter notice-and-consent showings.

Foreign-signed e-contracts and the Section 75 reach

Section 75 of the IT Act extends the Act's operation to any offence or contravention committed outside India by any person, irrespective of nationality, if the act or conduct constituting the offence or contravention involves a computer, computer system or computer network located in India. The provision is drafted in the offence-and-contravention register, but the doctrinal extension to the e-contract framework operates through the conflict-of-laws analysis. Where a foreign party signs an e-contract using a foreign-issued digital certificate — issued by a foreign Certifying Authority not licensed under the IT Act — the question of whether the signature qualifies under Section 3 or Section 3A of the IT Act is unsettled. The Central Government has power under Section 19 of the IT Act to recognise foreign Certifying Authorities, and has done so for a limited set of jurisdictions through bilateral arrangements; outside those arrangements, the foreign-issued digital certificate operates as evidentiary support rather than as a Section 3-compliant authentication.

The working practice in 2026 — followed by the law firms that handle cross-border M&A, software licensing and SaaS deployment — is to execute cross-border e-contracts on a DocuSign or Adobe Sign platform that supports both eIDAS-compliant signatures (European framework) and IT Act-compliant signatures (Indian framework) in the same envelope, with parallel certificates issued under both frameworks. The dual-compliance route insulates the contract from the foreign-certificate-recognition gap and supplies the evidentiary anchor for any subsequent enforcement in either jurisdiction. The Hague Apostille Convention framework — which India joined in 2005 — supplies a parallel route for the authentication of foreign instruments in Indian proceedings, but does not directly address the e-signature recognition question.

Open questions and the 2026 framework

Three doctrinal questions remain unresolved in 2026. The first is the secure-electronic-signature operationalisation under Section 15 IT Act — the Central Government's failure to prescribe the storage manner under Section 15(b) means that the "secure" classification, which would attract the strongest evidentiary presumption under Section 39 BSA, remains a virgin area in practice. The Aadhaar-OTP-based eSign, by virtue of its server-side key custody model, sits in an awkward relationship with the Section 15(a) requirement that the signature creation data be under the exclusive control of the signatory; the academic commentary is divided, the Government's position is that the Aadhaar framework satisfies the exclusive-control requirement, and the question has not been authoritatively decided.

The second is the Section 1(4) carve-out's interaction with hybrid instruments — particularly will-substitutes, beneficiary designations, and nomination instruments that perform testamentary functions without being wills in the Indian Succession Act, 1925 sense. The framework's reach into these hybrid instruments is unclear; the practice is conservative, with most parties opting for wet-ink execution to avoid the litigation risk. The third is the consequence of the Digital Personal Data Protection Act, 2023's progressive notification — the consent framework under the DPDP Act for the processing of personal data in connection with e-contract execution overlays the IT Act framework with a separate consent and notice discipline, and the interaction with the Aadhaar-OTP-based eSign workflow is being worked out through the 2025–2026 notification cycle.

For the practitioner, in-house counsel, or platform-operator drafting an e-contracting framework in 2026, the working position is workable. Section 10A IT Act settles the enforceability question at the centre. Section 3 (asymmetric crypto digital signatures) and Section 3A (technology-neutral electronic signatures, including Aadhaar OTP-based eSign) supply the authentication regime. Section 4 and Section 5 supply the legal-recognition baseline. The Indian Contract Act, 1872 baseline of offer, acceptance, consideration, free consent and competent parties continues to govern. Section 63 BSA and the Anvar / Khotkar certificate discipline govern admissibility. The Section 1(4) carve-outs — negotiable instruments other than cheques, powers-of-attorney, trusts, wills, and immovable-property conveyances — remain the principal limit. The state-level stamp-duty position requires case-by-case mapping. The framework is settled enough to support the bulk of consumer, commercial and cross-border e-contracting activity in India; it is contested enough at the carve-outs and at the evidentiary edges to require careful drafting and disciplined execution-workflow design at the moment of signing.