The Signature Assurance Spectrum: Matching OTP, Aadhaar, DSC, Video and Location Checks to the Document
Signature assurance is a spectrum, not a switch: SMS OTP, Aadhaar OTP, Aadhaar biometric, DSC, video verification, liveness and geofencing each add evidence and friction. How to match the level to the document, and the DPDP consent point for location and video data.
"Which e-signature should we use?" has a better framing: how much assurance does this document need, and what evidence will we want if it is challenged? Assurance comes in layers that can be combined. Each layer adds evidence, friction and, for some, personal-data obligations. This guide lays out the spectrum and a rule for choosing. Position as of October 2026.
The layers
| Layer | What it establishes | Statutory status | Friction | Data collected |
|---|---|---|---|---|
| Email link, click-to-sign | Access to the email account | Evidence of agreement (IT Act s. 10A); not a s. 5 signature | Lowest | Email, IP, timestamp |
| SMS OTP added | Control of a mobile number | As above | Low | Mobile number |
| Aadhaar OTP eSign | Aadhaar-linked identity at signing | Electronic signature under s. 3A, Second Schedule; satisfies s. 5 | Low-medium | eSign response, name |
| Aadhaar biometric eSign | Physical presence of the Aadhaar holder | As above; CCA classes it multi-factor | Medium | As above |
| DSC (token) | Certificate-bound identity, CA-verified | Digital signature under s. 3; satisfies s. 5 | Medium-high (token required) | Certificate details |
| Video verification / liveness | A live person matching an ID at the time | Evidence layer; not itself a signature | High | Video, face image |
| Geofencing | Signer's device location within a boundary | Evidence layer | Low | Location data |
The CCA's eSign API specification treats OTP-based eSign as "Single Factor" and fingerprint or iris as "Multi Factor"; a DSC on a token is the long-standing high-assurance method under section 3 of the IT Act, 2000.
A rule for choosing
Match the layer to the consequence of a successful challenge:
- Routine consents and acknowledgements (policy acceptance, delivery confirmations): email or SMS OTP with a full audit trail.
- Contracts that will be stamped, enforced or inspected (vendor MSAs, loan documents, leases, employment contracts): Aadhaar OTP eSign or DSC, because section 5 of the IT Act is satisfied and the identity evidence is strong.
- High-value or high-fraud-risk documents (large loans, guarantees, property): Aadhaar biometric eSign or DSC, with video verification where the counterparty is remote and unknown.
- Signers outside India or without Aadhaar: DSC where available, otherwise platform signature plus video verification, and record the method used.
Adding layers to a low-risk document does not make it safer; it makes it slower, and completion rates fall.
The DPDP point most guides skip
Video, face images and location are personal data. Under the DPDP Act, 2023 (sections 3-17 commence on 13 May 2027), processing them needs consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)) or a legitimate use under section 7, with notice under section 5. Three consequences for a signing flow:
- Collect location or video only where the document's risk justifies it; data minimisation is a design choice the law rewards.
- Present a separate, specific consent for the video or location capture, not buried in the contract acceptance.
- Set a retention period for the video and location data (it is evidence, so retain it with the audit trail for the contract's limitation period, and state that in the notice), and erase it when the purpose ends (section 8(7)).
For Aadhaar eSign, the signer's Aadhaar number is not shared with your business; the eSign Service Provider handles authentication. You still process the signer's name and the eSign response, which are personal data.
Combining layers without double-counting
- Aadhaar eSign already provides identity assurance; adding SMS OTP on top adds little.
- DSC plus video is a sensible pairing for a remote high-value signer whose token could be misused.
- Geofencing is most useful as a negative check (signature from an unexpected country) rather than a positive requirement.
Record the assurance level
Whatever you choose, the audit trail should state the method and layers used for each signer, so that the section 63 certificate under the Bharatiya Sakshya Adhiniyam, 2023 can describe how the record was produced.
Where Legatio fits. Legatio lets each template specify the required assurance layers per signer role, captures the separate consents for video or location, and records the layers used in the audit trail. The choice of level for each document is the business's risk judgement.
Position stated as of October 2026. General information, not legal advice.