Aadhaar eSign Explained: Who Does What, What the Law Says, and How Enterprises Set It Up
A vendor-neutral explanation of Aadhaar eSign: the roles of the application provider, eSign service provider, Certifying Authority and UIDAI, the legal basis in the IT Act's Second Schedule, what the signer's certificate actually is, and how to set it up for an enterprise.
Aadhaar eSign lets an Indian resident sign a document with an OTP or a fingerprint instead of a USB token. Behind that simple experience are four parties, a one-time certificate and a specific statutory basis. Understanding them matters when you choose a provider, explain the method to a counterparty, or defend a signature in court. This is a plain-language, vendor-neutral account. Position as of October 2026.
The legal basis
Section 3A of the Information Technology Act, 2000 allows a subscriber to authenticate an electronic record by an electronic signature that is reliable and listed in the Second Schedule. The Second Schedule entry for the "e-authentication technique using Aadhaar e-KYC services" was notified in January 2015 (G.S.R. 61(E), 27 January 2015), together with the Electronic Signature or Electronic Authentication Technique and Procedure Rules, 2015, which set out the procedure the CCA's specification implements. Section 5 then gives an electronic signature so affixed the same legal recognition as a handwritten one where a law requires a signature. The Controller of Certifying Authorities (CCA) licenses the Certifying Authorities and publishes the eSign API specification that providers follow.
The four parties
| Party | Role (per CCA eSign API Specification v2.1) |
|---|---|
| Application Service Provider (ASP) | The business application that needs the document signed: your CLM, HR or lending system, or a signing platform acting for you. It computes the document's SHA-256 hash and sends only the hash to the ESP. |
| eSign Service Provider (ESP) | A "Trusted Third Party" under the Second Schedule. It authenticates the signer through UIDAI e-KYC, generates a key pair on a hardware security module, obtains a certificate from a CA, signs the hash and returns the signature. |
| Certifying Authority (CA) | Licensed by the CCA; issues the signer's one-time digital signature certificate. |
| UIDAI | Runs the Aadhaar e-KYC authentication (OTP, fingerprint, iris or face) that confirms the signer's identity. |
The document itself never leaves the ASP; the ESP sees and signs a hash. That is both a privacy feature and the reason the audit trail must record the hash.
What the signer actually gets
A one-time digital signature certificate issued for that signing session, with the signer's name and the authentication mode. The CCA's specification classes OTP-based eSign as "Single Factor" and fingerprint or iris as "Multi Factor" under India's PKI certificate policy. For high-value or regulated documents, specify biometric eSign or a DSC; for routine documents OTP eSign is the norm.
What it proves, and its limits
Proves: that a person who controlled the Aadhaar-linked mobile number (OTP) or presented the registered biometric authenticated at that time, and that the document's hash was signed with a certificate issued against that identity. Limits: OTP eSign depends on the security of the signer's mobile number; Aadhaar eSign is available only to Aadhaar holders, so foreign counterparties and some Indian signers will need a DSC or a platform signature instead.
Consent and data protection
The signer's Aadhaar is used for authentication, not shared with your business. Your flow should still present a clear, separate consent for Aadhaar authentication as UIDAI's framework requires, and keep it distinct from consent to the contract and any consent to personal data processing under section 6(1) of the DPDP Act, 2023. If you store the signer's name, mobile number or the eSign response, you are processing personal data; treat your signing platform as a Data Processor under section 8(2) of the DPDP Act and paper it.
How enterprises set it up
- Choose the ASP route. Either integrate directly with a licensed ESP (requires an ASP agreement, security audit and the technical build) or use a signing platform that is already an ASP. Most mid-market companies use the second.
- Decide the method per document type. OTP eSign for NDAs, offer letters and routine consents; biometric eSign or DSC for loan documents, high-value agreements and anything a regulator may inspect.
- Map the fallback. Counterparties without Aadhaar, or who decline it, sign with DSC or a platform signature; the template should allow mixed methods and record which was used.
- Configure the audit trail. Hash, timestamps, authentication mode, certificate serial, and the dispatch and view events, retained with the document for a section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023.
- Stamp first. Aadhaar eSign does not change stamp duty; generate the e-stamp before the signing request.
- Review the provider's standing. Confirm the ESP and CA are on the CCA's current lists, and that the platform signs a DPDP processing agreement.
A note on what has changed
Guides written before 2021 refer to "Class 2" certificates; the CCA discontinued Class 2 certificates for new issuance from 1 January 2021, and current eSign certificates follow the CCA's present certificate policy classes. ****
Where Legatio fits. Legatio operates as an ASP integrated with licensed ESPs, offering OTP and biometric Aadhaar eSign alongside DSC, with the hash and audit trail recorded per signer. The roles and the law above are the same for every provider.
Position stated as of October 2026. General information, not legal advice.