Moving Contracts Online: A Ten-Step Implementation Checklist for Indian Businesses

Most "e-contract" guides list benefits. This one lists steps. It is written for the operations lead or founder who has decided to stop circulating Word files and wants the move to be legally sound in India, not just faster. Each step names the Indian legal point that applies and the mistake teams make when they skip it. Position as of October 2026.

Step 1: Inventory what you sign, and how often

List every contract type by volume and value: NDAs, customer agreements, vendor agreements, employment contracts, leases, consents. The high-volume, low-variation types go first.

Mistake: starting with the most complex agreement because legal cares about it most. Start with NDAs or offer letters.

Step 2: Check each type against the First Schedule

Section 1(4) of the IT Act, 2000 excludes the documents in the First Schedule from the Act. After the 26 September 2022 amendment the list is: negotiable instruments other than cheques and certain instruments in favour of RBI/SEBI/IRDAI/PFRDA/NHB-regulated entities, most powers of attorney, trusts and wills. Everything else can be an electronic record with an electronic signature.

Mistake: assuming "everything can be e-signed now". Trust deeds and private powers of attorney cannot.

Step 3: Decide the signature method per contract type

Section 5 of the IT Act gives legal recognition to electronic signatures affixed in the prescribed manner: digital signatures under section 3 (DSC from a licensed Certifying Authority) and electronic signatures under section 3A (Second Schedule techniques, including Aadhaar e-KYC based eSign). A platform click-to-sign with audit trail evidences agreement for a contract formed electronically (section 10A) but is not a section 5 signature.

Rule of thumb: DSC or Aadhaar eSign for anything that will be stamped, registered or litigated; platform signature with full audit trail for low-value, high-volume consents.

Step 4: Put stamping before signature

Section 17 of the Indian Stamp Act, 1899 requires instruments to be stamped before or at execution; section 35 bars an unstamped instrument from evidence until duty and penalty are paid. Map each template to its stamp article and state, and make e-stamp generation a workflow step that precedes signature.

Mistake: signing first and "sorting out the stamp paper later". Later costs a penalty.

Step 5: Build the template and clause library

One approved template per contract type, with variable fields and a small set of pre-approved alternative clauses. Decide which deviations the business can accept and which route to legal.

Indian point: delete any post-term non-compete copied from foreign templates; section 27 of the Indian Contract Act, 1872 voids most restraints of trade.

Step 6: Separate contract acceptance from data consent

If the contract flow collects personal data, the consent to processing must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1), DPDP Act, 2023). A single "I agree to the terms and the privacy policy" checkbox is not specific. Sections 3-17 of the Act commence on 13 May 2027; flows built now should already comply.

Mistake: bundling the privacy consent into the terms acceptance.

Step 7: Paper your processors

If a vendor (including your e-signature or CLM provider) processes personal data for you, section 8(2) of the DPDP Act allows that "only under a valid contract", and rule 6 of the DPDP Rules, 2025 requires "appropriate provision in the contract" on security safeguards. Sign a processing agreement with the platform before you load customer or employee data.

Step 8: Define the record you will keep

For every executed contract keep, together: the signed file, the stamp certificate, the signature audit trail (identity method, timestamps, IP, document hash), and the version history. Since 1 July 2024, electronic records are proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which requires a certificate identifying the record and the device or system that produced it. The Supreme Court in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (14 July 2020), on the predecessor provision, treated the certificate as a condition precedent to admitting electronic records unless the original device is produced. Your system has to be able to generate that certificate.

Mistake: keeping only the signed PDF.

Step 9: Set retention and deletion rules

Contracts carry limitation periods (three years for most money claims under the Limitation Act, 1963, running from when the right accrues), statutory retention (eight years for books of account under section 128 of the Companies Act, 2013), and, for personal data, an erasure duty when the purpose ends (section 8(7), DPDP Act). Write the rule per contract type and let the system enforce it.

Step 10: Train and measure

Train requesters on intake, approvers on the matrix, and signers on the method. Measure turnaround time, exceptions routed to legal, and unsigned-after-7-days counts. Review quarterly.

The checklist in one view

Where Legatio fits. Steps 3 to 8 are what Legatio is built to run: signature methods per template, a stamping step, approvals, consent capture as a separate action, and a per-contract record with the audit trail. Steps 1, 5, 9 and 10 are decisions your team makes.

Position stated as of October 2026. General information, not legal advice.