Is a digital signature on an invoice legally valid in India?
Yes. Sections 3 and 5 of the Information Technology Act, 2000 recognise electronic records authenticated with a digital signature in the same way as signed paper. A digital signature uses a DSC issued by a Certifying Authority licensed by the Controller of Certifying Authorities (CCA). Since 1 January 2021, new certificates are Class 3; Class 2 is no longer issued.
Under GST, rule 46 of the CGST Rules lists the "signature or digital signature of the supplier or his authorised representative" among the contents of a tax invoice. A proviso inserted by Notification No. 74/2018-Central Tax says that signature is not required for an electronic invoice issued in accordance with the Information Technology Act, 2000. In practice, most businesses that email PDF invoices still sign them digitally, because the signature:
- proves which company issued the invoice;
- shows if the file was changed after signing;
- is accepted by buyers, banks and auditors without a printed copy.
Is the e-invoice QR code the same as a digital signature?
No. Under GST e-invoicing, the Invoice Registration Portal (IRP) signs the IRN and the QR code it returns. That proves the invoice was registered with the IRP. It does not sign the PDF you send to the buyer, and it says nothing about who printed or changed that PDF. Many businesses therefore do both: report the invoice to the IRP, print the IRN and QR code, then digitally sign the final PDF. See the GST e-invoicing guide.
Which SAP documents are usually signed?
| Document | Why it is signed |
|---|---|
| Sales and proforma invoices | Sent by email to buyers who need proof of origin and integrity |
| Credit and debit notes | Change the amount owed, so buyers and auditors want them authenticated |
| Purchase orders and contracts | Committed to vendors without wet signatures |
| Export documents | Shared with buyers, banks and agents abroad |
| Payment advices and bank letters | Accepted by banks as authenticated instructions |
| Statements and reports | Sent to customers, vendors or lenders as signed records |
What makes bulk signing from SAP hard?
- Volume: a business issuing hundreds or thousands of invoices a day cannot sign them one at a time with a USB token.
- Keys: the private key must stay on a hardware cryptographic token or, where the certificate type allows it, a hardware security module (HSM). Your Certifying Authority can tell you which certificate type suits automated signing.
- Placement: the visible signature has to land in the right place on every SAP form layout, whether SmartForms, SAPscript or Adobe Forms.
- Authority: each document type should be signed only by the person or role authorised for it, and some need a maker-checker approval first.
- Evidence: auditors expect a record of who signed what, when, with which certificate and the document hash.
What does an automated SAP signing set-up need?
- A trigger: signing starts when SAP outputs the document through its normal output type, so users change nothing.
- Rules: each document type, company code or plant is mapped to the certificate that signs it and to where the signature goes on the form.
- Signing: the PDF is signed with the DSC, from a token, a signing server or a cloud HSM, depending on the model chosen.
- Distribution: the signed PDF is emailed to the customer or vendor, or stored in the SAP content server or a document management system.
- Audit trail: every signature is logged with the user, time, certificate and document hash.
How do OptiSign and OptiSignC handle it?
- [OptiSign](/platform/digital/optisign/) runs with SAP S/4HANA and ECC. It hooks into SAP output, signs documents automatically by rule or in background batches, places the signature by anchor text or set areas, emails or archives the signed PDF and keeps a tamper-proof audit trail. It can be deployed as a signing server on-premise or hosted, with remote signing through a cloud HSM, as an API-driven e-sign gateway, or with a web dashboard for maker-checker approval.
- [OptiSignC](/platform/digital/optisignc/) runs on SAP BTP for SAP S/4HANA, including Public Cloud, with keys in a cloud HSM and no change to the SAP core. S/4HANA sends the document through SAP BTP, OptiSignC signs it and returns it to SAP for archiving and distribution.
Frequently asked questions
Can we digitally sign invoices directly from SAP?
Yes. The invoice is signed automatically when SAP outputs it, using the company's DSC, and the signed PDF is then emailed or archived. No one has to sign files one by one.
Is a digitally signed PDF invoice valid under GST?
Yes. A digital signature with a valid DSC is recognised under the Information Technology Act, 2000, and rule 46 accepts a digital signature on a tax invoice. Electronic invoices issued under the IT Act do not need a separate signature.
Do e-invoices with an IRN still need a digital signature?
The IRP signs the IRN and QR code, which proves registration, not who issued the PDF. Signing the PDF as well is not required for e-invoices, but most businesses do it to prove origin and integrity to buyers.
Which DSC class is needed?
Class 3. Certifying Authorities have issued only Class 3 certificates since 1 January 2021. Ask your Certifying Authority which certificate type suits automated, high-volume signing.
Can thousands of invoices be signed at once?
Yes. Bulk signing runs in the background, either as SAP outputs each document or in scheduled batches, with automatic retries if the signing device or network is briefly unavailable.
Does it work with SAP S/4HANA Public Cloud?
Yes, through OptiSignC on SAP BTP, which connects to S/4HANA and signs with keys held in a cloud HSM.
Where does the signature appear on the invoice?
Wherever the form layout needs it. OptiSign finds the position by anchor text on the document or uses a fixed area set for each SAP form layout.
Sources
This guide summarises the rules for general information and is not legal advice. Check the current notifications before acting on them.