Digital Signature

A digital signature is the electronic equivalent of a handwritten signature. It uses a cryptographic key to verify the identity of the person or business signing a document and to ensure that the document has not been tampered with after it was signed. In India, digital signatures are legally recognised under the Information Technology Act 2000 and are used across GST filings, income tax returns, company registrations, and e-invoicing. A digital signature is applied using a Digital Signature Certificate (DSC), which is a secure electronic key issued by a government-authorised Certifying Authority. For GST purposes, only a Class 3 DSC is valid as of 2021 onwards.

Quick reference

Full form	Digital Signature Certificate (DSC) when stored on a device
Governed by	Information Technology Act 2000
Valid class for GST	Class 3 DSC only (Class 2 discontinued from 2021)
Issued by	Certifying Authorities licensed by the Controller of Certifying Authorities (CCA)
Validity period	1 or 2 years from date of issue
Stored on	A USB token (hardware dongle)
Required for	GST registration, GST return filing, e-invoicing, MCA filings, ITR for companies
Legal equivalence	Equal to a handwritten signature under IT Act 2000
Mandatory for companies and LLPs	Yes, for GST filing and MCA compliance

How a digital signature works

Here is how a digital signature authenticates a document in a simple, practical way:

1. A DSC is issued to you. You apply to a licensed Certifying Authority such as eMudhra, Capricorn, or e-Mudhra. After verifying your identity, they issue a Digital Signature Certificate tied to your PAN and stored on a USB hardware token.

2. You connect the USB token and sign the document. When filing a GST return or signing an invoice, you plug in your USB token, open the emSigner utility on the GST portal, and select your certificate. You enter your password to authorise the signature.

3. The document gets a unique encrypted fingerprint. The signing process creates a unique mathematical fingerprint of the document at that exact moment. This fingerprint is embedded in the document along with your certificate details.

4. Anyone can verify the signature. If someone receives your signed document and wants to verify it, they can check the digital signature. If even a single character in the document was changed after you signed it, the verification will fail and the tampering will be detected immediately.

5. The signature is legally binding. A digitally signed document has the same legal standing as a physically signed document under the Information Technology Act 2000, Section 5.

Digital signature example for Indian businesses

Anjali is a director of a Private Limited Company in Hyderabad. Her company is required to file GST returns using a DSC since companies and LLPs cannot use an OTP-based Electronic Verification Code (EVC) for GST filing.

Each month when filing GSTR-3B, Anjali:

• Plugs in her USB DSC token
• Opens the GST portal and navigates to her return
• Clicks "Submit with DSC"
• The emSigner utility detects her certificate and asks for her token password
• She enters the password and the return is signed and submitted

The GST portal records the submission as authenticated by Anjali's PAN-linked DSC. If anyone tries to claim the filing was not made by her company, the DSC creates a non-repudiation record that proves it was.

Where digital signatures are required in India

GST portal

Digital signatures are required for the following actions on the GST portal:

• GST registration application for companies and LLPs
• Filing GST returns (GSTR-1, GSTR-3B, GSTR-9) for companies and LLPs
• Applying for GST refunds
• Filing amendments, appeals, and other applications where the taxpayer is a company or LLP

Individual taxpayers, sole proprietors, and partnership firms can use an Electronic Verification Code (EVC) via Aadhaar OTP as an alternative. However, companies and LLPs must use DSC mandatorily.

E-invoicing and GST invoices

Under Rule 46 of the CGST Rules 2017, every GST invoice must carry the signature of the supplier or their authorised representative. This can be a physical signature or a digital signature. For e-invoicing businesses (turnover above Rs. 5 crore), the Invoice Registration Portal (IRP) itself digitally signs the validated invoice using its own key and generates a QR code and Invoice Reference Number (IRN). This IRP signature makes the e-invoice legally valid. The supplier's own DSC on the invoice is an additional layer but not mandatory if the IRP has already signed it.

Income tax filing

Companies, LLPs, trusts, and certain audit cases require DSC for filing income tax returns. A Class 3 DSC is accepted by the income tax e-filing portal.

MCA and company compliance

All filings with the Ministry of Corporate Affairs (MCA), including company incorporation (SPICe+ form), director KYC, annual returns, and charge creation, require a DSC from the authorised director or company secretary.

Types of digital signatures in India

Class 3 DSC (currently the only valid class)

The highest level of DSC available in India. Class 3 requires in-person verification of identity by the Certifying Authority. It is mandatory for all GST filings, MCA filings, e-tendering, and income tax submissions for companies and LLPs. Since 2021, Class 2 DSC has been discontinued and merged into Class 3. All new DSCs obtained after 2021 are Class 3.

DGFT DSC

A special type of DSC specifically for businesses dealing in import and export activities. It is used for filings with the Directorate General of Foreign Trade (DGFT) portal.

Document Signer Certificate

Used by organisations to automate bulk signing of large volumes of documents such as invoices, certificates, and statements. Common in banks, insurance companies, and large enterprises.

Digital signature vs electronic signature vs wet signature

These three terms are often confused, especially by Indian small business owners:

	Wet signature	Electronic signature	Digital signature
What it is	Physical handwritten signature	Any digital mark representing approval, such as a typed name, scanned signature, or checkbox	Cryptographically secured signature using a DSC
Legal validity in India	Fully valid	Valid under IT Act 2000 in limited contexts	Fully valid under IT Act 2000
Tamper detection	No	Limited	Yes, any change invalidates the signature
Required for GST filing	Not applicable online	Only for individuals via EVC	Mandatory for companies and LLPs
Identity verification	None built-in	None built-in	Yes, tied to PAN and certified identity

Important for small business owners and freelancers: If you are an individual, sole proprietor, or partnership firm, you do not need a DSC for GST filings. You can sign GST returns using your Aadhaar-based Electronic Verification Code (EVC) or OTP. A DSC is mandatory only for companies (Private Limited, Public Limited) and LLPs. Many small businesses spend money on a DSC unnecessarily. Check your business structure before buying one.

How to get a Digital Signature Certificate in India

1. Identify your requirement. Most businesses need a Class 3 Individual DSC or a Class 3 Organisation DSC. If you export goods, you may additionally need a DGFT DSC.

2. Choose a licensed Certifying Authority. The most common ones in India are eMudhra, Capricorn CA, NSDL, and Sify. Their fees range from approximately Rs. 800 to Rs. 2,500 for a two-year validity certificate.

3. Submit your documents. You will need your PAN card, Aadhaar card, photograph, and a business address proof if applying for an organisation DSC.

4. Complete identity verification. Class 3 DSC requires in-person video verification or physical verification through a Registration Authority.

5. Receive your USB token. Your DSC is stored on a USB hardware token (also called a dongle). This token must be plugged into your computer each time you need to sign.

6. Register your DSC on the GST portal. Go to the GST portal, navigate to My Profile, and click on Register/Update DSC. Install the emSigner utility and follow the steps to link your DSC to your GSTIN.

Common digital signature mistakes Indian businesses make

• Using an expired DSC for GST filing. A DSC issued for two years expires after that period. Many businesses discover their DSC has expired only when they try to file a return and it fails. Mark the expiry date on your calendar and renew it at least a month before expiry.

• Companies trying to use EVC instead of DSC. Private Limited and Public Limited companies and LLPs cannot use an OTP-based EVC for GST filing. Only DSC is accepted. Attempting to file with EVC will result in rejection.

• Losing or damaging the USB token. Your DSC is stored on a physical USB dongle. If you lose it, you cannot recover the certificate. You will need to revoke the old DSC and apply for a new one. Keep the token in a safe place and take a backup of the token password.

• Registering the wrong person's DSC on the GST portal. The DSC must belong to the authorised signatory registered on the GST portal. If you register a DSC that belongs to someone who is not listed as an authorised signatory, the filing will fail.

• Not installing the emSigner utility. The GST portal requires a utility called emSigner to be installed and running on your computer before you can use your DSC. Many users forget this step and then cannot complete their filing.

Frequently asked questions

Is a digital signature mandatory for GST invoices in India?

Not for all businesses. Under Rule 46 of the CGST Rules 2017, a GST invoice must have the signature of the supplier or an authorised representative. This can be a physical signature, a digital signature, or it can be omitted entirely if the invoice is generated as an e-invoice through the Invoice Registration Portal, since the IRP applies its own digital signature. For non-e-invoice businesses, most small businesses use a printed signature or a scanned signature on their invoices, which is acceptable.

Do sole proprietors and freelancers need a DSC for GST filing?

No. Individual taxpayers, sole proprietors, and partnership firms can file GST returns using an Aadhaar-based Electronic Verification Code (EVC) or OTP. A DSC is mandatory only for companies (Private Limited, Public Limited) and LLPs.

What is the difference between a DSC and an e-signature in India?

A Digital Signature Certificate (DSC) is a cryptographic certificate stored on a USB token, issued by a licensed Certifying Authority after identity verification. It creates a tamper-proof signature. An electronic signature (e-signature) is a broader term covering any digital representation of approval, including a typed name, a scanned signature image, or an Aadhaar OTP. A DSC is a specific, high-security type of electronic signature.

What happens if my DSC expires?

An expired DSC cannot be used for signing. You must renew it by applying to the Certifying Authority before expiry. If it has already expired, you will need to apply for a fresh DSC, complete the identity verification process again, and re-register it on the GST portal. GST filings cannot be submitted until a valid DSC is registered.

Can a digital signature be forged or tampered with in India?

A DSC-based digital signature cannot be practically forged because it is tied to your unique cryptographic key and your verified identity. If anyone alters a digitally signed document even slightly, the signature becomes invalid immediately. This tamper detection is one of the primary reasons digital signatures are legally recognised under the Information Technology Act 2000.

Related terms

GST Invoice · E-Invoice · Tax Invoice · Annual Return · GSTIN · Audit Trail · Bill of Supply

---

Create GST-compliant invoices with signature support in JetInvoice

Every invoice you create in JetInvoice is ready for your signature, whether physical or digital. For businesses covered under e-invoicing, JetInvoice generates the correct format for IRP submission with the required fields pre-filled.

Create your GST invoice free at jetinvoice.in