Whitepapervault Com
May 2, 2024; Page 1 of 19 An Analysis of Shared Compliance Responsibilities under the Indian Information Technology Act, 2000 May 2, 2024; Page 2 of 19 May 2, 2024; Page 3 of 19
Indian law has recognized electronic signatures, or e-signatures, under the Information Technology Act, 2000 (“IT Act”) for over 20 years. With its increased emphasis on improving the ease of doing business; digital inclusion, streamlining the storage of records; and improving the safety, security, and cost-effectiveness of electronic records, the Government of India has promoted the use of digital technologies by Indian citizens and corporations. As a result, there has been a recent increase in the use of e-signatures in India. "is paper presents an analysis of the technical features and relevant integrations that, if properly implemented, allow for the application of signatures compliant under the IT Act using Acrobat Sign Solutions. "is assessment focuses on how Adobe, licensed Certifying Authorities (“CAs”), eSign Service Providers (“ESPs”) and the organization using Acrobat Sign Solutions share responsibilities for achieving compliance with the IT Act.
"is paper focuses on the compliance pro#le of the Acrobat Sign Solutions (e.g., Aadhaar eSign service and Digital ID (sign using tokens)), alongside the tools and features of Acrobat Sign Solutions, that can be used to help customers comply with the requirements with the IT Act requirements. "e intended reader of this paper is an organization using Acrobat Sign Solutions looking to achieve compliance requirements under the IT Act (“Customer”).
"e following chart discusses how Acrobat Sign Solutions supports Customer compliance with the IT Act and its related rules/regulations. "is chart highlights shared responsibilities among Adobe, CAs, ESPs and Customers related to the IT Act and its related Rules. An important preliminary responsibility to highlight, is that this chart is predicated on the Customer (i) performing its responsibility to purchase the Aadhaar eSign service from Adobe, obtain the license to use the Aadhaar eSign service provided by Protean via integration with the Acrobat Sign Solutions product, and con#gure its account to use the Aadhaar eSign service or (ii) using Digital ID (using tokens), where Customers sign using a security token or hardware token connected to their computer. Note that several sections of the IT Act and its rules/regulations are not discussed in the following chart because the excluded sections are not relevant to the requirements for the formation of a valid electronic signature. Moreover, Adobe is not directly responsible for meeting the legal requirements of the IT Act and its rules/regulations. Adobe only helps its Customers meet the standards required under the IT Act. Please also note that de#ned terms are bolded and appear alphabetically in a glossary at the end of this article. May 2, 2024; Page 4 of 19 Information Technology Act, 2000 Citation What the Law Requires Stakeholder responsible for compliance CA/Adobe/ESP/ Customer How Acrobat Sign Solutions Supports Customer Compliance IT Act Chapter 2; Section 3 This provision explains how a subscriber can authenticate an electronic record using their digital signature. The authentication of the electronic record shall be effected by the use of asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record, where any person by the use of the public key of the subscriber can verify the electronic record. The private key and the public key must be unique to the subscriber and constitute a functioning key pair. Customer (Signer) Adobe collaborates with CAs to provide Customers who are signers with a compliant solution. Adobe is an Application Service Provider (“ASP”) that offers Aadhaar eSign service as a part of Acrobat Sign Solutions. Adobe has partnered with Protean eGov Technologies Ltd (formerly NSDL e-Governance Infrastructure Ltd) (“Protean”), a CA that is empanelled as an ESP to provide its users with this Aadhaar eSign service. Taken together, Customers can authenticate electronic records with digital signature technology using the Aadhaar eSign service in Acrobat Sign Solutions. In addition, Adobe partners with a CA, eMudhra Limited ("eMudhra"), to obtain a Document Signer Certificate (“DS Certificate”) that meets the Controller of Certifying Authorities (“CCA”) requirements. Adobe applies a DS Certificate using asymmetric crypto systems to all documents signed using security tokens to confirm proof of origin and integrity and to also act as a tamper evident seal. IT Act Chapter 2; Section
A subscriber may authenticate any electronic record by such electronic signature or electronic authentication technique which is considered reliable and may be speci!ed in the Second Schedule of the IT Act. An electronic signature or electronic authentication technique shall be considered reliable if– • the signature creation data or the authentication data are, within the context in which they are used, linked to the signatory or, as the case may be, the authenticator and to no other person; • the signature creation data or the authentication data were, at the time of signing, under the control of the signatory or, as the case may be, the authenticator and of no other person; • any alteration to the electronic signature made a"er affixing such signature is detectable; • any alteration to the information made a"er its authentication Customer (Signer) Acrobat Sign supports electronic signatures using the Aadhaar eSign service or the Digital ID (using security tokens). As signature affixed using Adobe Sign Solution meets the speci!c requirements for a reliable electronic authentication technique as described in Section 3A of the IT Act. See our comment to Rule 3 above as well our comments to the Second Schedule separately discussed below.
