Digital Signatures and Electronic Records for Export Trade Documents

Digital Signatures and Electronic explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.

Export filings on the DGFT portal, ICEGATE and the certificate of origin platform all require a digital signature. A digital signature uses public key cryptography and a certificate from a licensed certifying authority, so it proves both who signed and that the record has not been altered.

Where an Exporter Actually Needs One

In practice a single Class 3 certificate in the authorised signatory's name, registered on each portal, covers the government filings.

Electronic Signature versus Digital Signature

The terms are used loosely and the difference matters when a document is challenged.

• An electronic signature is any electronic method of indicating assent — a typed name, a scanned image, a click-to-accept. It shows intent but proves little about identity or integrity.
• A digital signature uses public key cryptography. The signer holds a private key; a certificate issued by a licensed certifying authority binds the corresponding public key to their verified identity. Anyone can then verify who signed and confirm that nothing has changed since.

For trade documents, that second property — integrity — is what carries the weight. A buyer, a bank or a customs authority receiving an electronic record wants to know it has not been altered in transit.

The Legal Framework

India's Information Technology Act, 2000 framework provides the legal foundation. Its relevant features for an exporter:

• Legal recognition of electronic records — a record is not denied legal effect merely because it is electronic.
• Legal recognition of digital and electronic signatures, subject to the prescribed conditions.
• Licensed certifying authorities under a Controller, which issue the certificates that bind identity to a key.
• Secure electronic records — the framework contemplates that records be maintained in a manner that allows their integrity to be demonstrated, which is a duty and not just a good practice.
• Excluded documents — certain instruments are outside the electronic execution regime, so a high-value or unusual document should be checked rather than assumed.

For instruments where possession matters rather than content — bills of lading, warehouse receipts — the IT Act framework is not sufficient on its own. Those need the electronic transferable records concept of control, which is a separate development.

Choosing and Managing the Certificate

1. Class 3 is the standard for portal filings and tenders.
2. Signature-only or signature plus encryption — signature-only is sufficient for filings; encryption is needed for some tender platforms.
3. In whose name? The individual authorised signatory recorded against your IEC and on each portal — not "the company". A mismatch is a common cause of rejected filings.
4. Validity is typically one to three years. Longer validity costs little more and avoids annual disruption.
5. Stored on a USB crypto token, which should be treated like a company seal.

Governance That Prevents Trouble

• Register who holds which token and for which portals, in a simple register.
• Never share a token or PIN. A signature applied with your certificate is your signature; there is no "the consultant did it" defence worth relying on.
• Do not leave the token with the customs broker or consultant. If you must let them file, use the portal's authorisation mechanism instead.
• Revoke immediately when a signatory leaves, and update the authorised signatory on every portal.
• Diarise expiry at least a month ahead; expired certificates are always discovered during an urgent filing.
• Keep a second authorised signatory with a live certificate, so a single absence does not stop filings.

Signing Contracts with Foreign Buyers

Electronic execution of the sale contract is generally workable, but three checks are worth making before relying on it for a significant contract:

1. Governing law. Does the law governing the contract recognise electronic execution for this type of document?
2. Counterparty jurisdiction. Some jurisdictions require specific signature technology for particular documents.
3. Evidence. Retain the audit trail from the signing platform, not just the signed PDF. The audit trail is what proves who signed and when.

For documents that must be legalised or attested — which several Middle East markets require — electronic execution may not remove the physical step, so confirm before promising a timeline.

Practical Tips

• Buy the longest validity your provider offers; the administrative saving outweighs the price difference.
• Register the same certificate across DGFT, ICEGATE and GST rather than maintaining several.
• Keep the token's driver software updated; most "portal not working" complaints are driver problems.
• Retain signed electronic records and their verification evidence for the same period as paper records.
• Before moving contracts to electronic signing, confirm your buyer's own policy — some large corporates still require wet ink for supply agreements.

Related Services & Guides

• MLETR — Electronic Transferable Records
• URDTT — Digital Trade Transactions
• E-Contracts and Digital Signatures in India
• More Guides