Digital Signatures and Electronic explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Export filings on the DGFT portal, ICEGATE and the certificate of origin platform all require a digital signature. A digital signature uses public key cryptography and a certificate from a licensed certifying authority, so it proves both who signed and that the record has not been altered.
Where an Exporter Actually Needs One
| Filing or action | Signature requirement |
|---|---|
| IEC application and modification on the DGFT portal | Digital signature or Aadhaar-based e-sign of the authorised signatory |
| e-RCMC application | Digital signature of the authorised signatory |
| Certificate of origin on the DGFT platform | Digital signature |
| ICEGATE registration, AD Code and bank account updates | Class 3 digital signature |
| Authorisation applications and redemption | Digital signature |
| GST returns and refund applications | DSC where mandatory for the entity type; otherwise EVC |
| Electronic bill of lading platforms | Platform-specific credentials, often certificate-backed |
| Electronic presentation under eUCP | Authentication as required by the credit |
In practice a single Class 3 certificate in the authorised signatory's name, registered on each portal, covers the government filings.
Electronic Signature versus Digital Signature
The terms are used loosely and the difference matters when a document is challenged.
- An electronic signature is any electronic method of indicating assent — a typed name, a scanned image, a click-to-accept. It shows intent but proves little about identity or integrity.
- A digital signature uses public key cryptography. The signer holds a private key; a certificate issued by a licensed certifying authority binds the corresponding public key to their verified identity. Anyone can then verify who signed and confirm that nothing has changed since.
For trade documents, that second property — integrity — is what carries the weight. A buyer, a bank or a customs authority receiving an electronic record wants to know it has not been altered in transit.
The Legal Framework
India's Information Technology Act, 2000 framework provides the legal foundation. Its relevant features for an exporter:
- Legal recognition of electronic records — a record is not denied legal effect merely because it is electronic.
- Legal recognition of digital and electronic signatures, subject to the prescribed conditions.
- Licensed certifying authorities under a Controller, which issue the certificates that bind identity to a key.
- Secure electronic records — the framework contemplates that records be maintained in a manner that allows their integrity to be demonstrated, which is a duty and not just a good practice.
- Excluded documents — certain instruments are outside the electronic execution regime, so a high-value or unusual document should be checked rather than assumed.
For instruments where possession matters rather than content — bills of lading, warehouse receipts — the IT Act framework is not sufficient on its own. Those need the electronic transferable records concept of control, which is a separate development.
Choosing and Managing the Certificate
- Class 3 is the standard for portal filings and tenders.
- Signature-only or signature plus encryption — signature-only is sufficient for filings; encryption is needed for some tender platforms.
- In whose name? The individual authorised signatory recorded against your IEC and on each portal — not "the company". A mismatch is a common cause of rejected filings.
- Validity is typically one to three years. Longer validity costs little more and avoids annual disruption.
- Stored on a USB crypto token, which should be treated like a company seal.
Governance That Prevents Trouble
- Register who holds which token and for which portals, in a simple register.
- Never share a token or PIN. A signature applied with your certificate is your signature; there is no "the consultant did it" defence worth relying on.
- Do not leave the token with the customs broker or consultant. If you must let them file, use the portal's authorisation mechanism instead.
- Revoke immediately when a signatory leaves, and update the authorised signatory on every portal.
- Diarise expiry at least a month ahead; expired certificates are always discovered during an urgent filing.
- Keep a second authorised signatory with a live certificate, so a single absence does not stop filings.
Signing Contracts with Foreign Buyers
Electronic execution of the sale contract is generally workable, but three checks are worth making before relying on it for a significant contract:
- Governing law. Does the law governing the contract recognise electronic execution for this type of document?
- Counterparty jurisdiction. Some jurisdictions require specific signature technology for particular documents.
- Evidence. Retain the audit trail from the signing platform, not just the signed PDF. The audit trail is what proves who signed and when.
For documents that must be legalised or attested — which several Middle East markets require — electronic execution may not remove the physical step, so confirm before promising a timeline.
Practical Tips
- Buy the longest validity your provider offers; the administrative saving outweighs the price difference.
- Register the same certificate across DGFT, ICEGATE and GST rather than maintaining several.
- Keep the token's driver software updated; most "portal not working" complaints are driver problems.
- Retain signed electronic records and their verification evidence for the same period as paper records.
- Before moving contracts to electronic signing, confirm your buyer's own policy — some large corporates still require wet ink for supply agreements.