Electronic signature compliance: what ESIGN, eIDAS, UK law, GDPR and Part 11 ask of you

Electronic signature compliance isn't a certificate you buy. It means two things: the signature meets the rules of the law that governs the document, and you can prove that later to a court, an auditor or a regulator. Miss either half and a signed contract can still be picked apart.

The laws differ in detail, yet they ask the same questions. Did the signer intend to sign? Did everyone agree to deal electronically? Can you show who signed, and that the document hasn't changed? Then the one people forget: can you still produce the record years from now?

Most contracts clear that bar with an ordinary e-signature. Trouble starts with the exceptions (wills, certain notices, witnessed deeds) and with regulated records, where an agency stacks its own rules on top. You'll also see the topic called digital signature compliance, though strictly a digital signature is the cryptographic kind.

If you only need to send something today, signing a document online takes minutes. The rest is for when an auditor or the other side's lawyer starts asking harder questions about electronic signature compliance.

Federal law has settled this since 2000. The ESIGN Act says a signature, contract or record can't be denied legal effect just because it's electronic. Its definition is broad: a sound, symbol or process attached to or logically associated with a record and adopted with the intent to sign. A typed name counts. So does a click, provided the record shows what was clicked and by whom.

At state level, UETA does the same job in nearly every state, while New York runs its own Electronic Signatures and Records Act. UETA adds a handy rule on attribution: a signature belongs to a person if it was their act, and you can prove that in any manner, including through the security procedure you used.

In practice, US electronic signature requirements come down to five things you should be able to show:

• Intent: the signer chose to sign, not merely to open the file.
• Agreement to do the deal electronically, which UETA reads from the context and conduct.
• Attribution, meaning evidence of who acted (an email link, an access code, an ID check).
• Association: the signature is tied to that exact version of the record.
• Retention, a copy that "accurately reflects" the record and stays accessible to everyone entitled to it, per § 7001(d).

Documents ESIGN doesn't cover

The exclusions sit in § 7003. ESIGN doesn't reach wills, codicils and testamentary trusts, adoption and divorce papers, most of the Uniform Commercial Code, court orders and filings, or a short list of notices: utility shut-offs, foreclosure or eviction on a primary residence, cancelled health or life insurance, product recalls, and papers that travel with hazardous materials. For those, other law decides.

Honestly, the US bar for an ordinary business contract is low. Where companies slip is the consumer side, where the paperwork before the signature matters as much as the signature.

For eIDAS compliance, start with the sentence most guides skip. Article 25(1) of Regulation (EU) No 910/2014 says an electronic signature can't be denied legal effect, or refused as evidence, just because it's electronic or isn't qualified. A simple signature is valid. It just proves less on its own.

eIDAS defines three levels:

• Simple (SES): any electronic data used to sign, from a typed name to a click with an email trail.
• Advanced (AES): Article 26 adds four tests. It's uniquely linked to the signer, can identify them, is created with data the signer controls with a high level of confidence, and is bound to the document so any later change shows.
• Qualified (QES), an advanced signature made on a qualified device with a qualified certificate. Article 25(2) gives it the effect of a handwritten signature across the EU.

Here's what people get wrong: eIDAS doesn't say which level a contract needs. National form rules do. Most commercial contracts have none, so simple or advanced works and the real question is evidence. Where a statute demands written form, things change. Germany's § 126a BGB accepts the electronic form only with a qualified signature, and France's décret 2017-1416 presumes reliability only for a qualified one.

You can check a provider on the EU Trusted List, and when a contract truly needs that level, read how the qualified level works. The 2024 amendment, Regulation (EU) 2024/1183, kept the effects in Article 25 and the four advanced tests. It's mostly about the digital identity wallet, covered in what the 2024 amendment changed.

The UK never needed eIDAS to accept e-signatures. Section 7 of the Electronic Communications Act 2000 makes them admissible on questions of authenticity and integrity. The Law Commission's 2019 report confirmed that an electronic signature can execute a document, deeds included, if the signer meant to authenticate it and any formalities are met. The catch is witnessing: a deed that needs a witness must still be signed in the witness's physical presence, so a video call won't do. The UK kept its own version of the eIDAS rules after Brexit, and UK GDPR handles the data side.

Every signing flow collects personal data: names, email and IP addresses, device details, sometimes a phone number, and with identity checks, a passport scan and a selfie. GDPR applies to all of it, whatever signature level you use. For EU electronic signature compliance, this is the half auditors open first.

Five questions settle most of it:

1. 1.
   Who's the controller? Your company, for the contracts you send. The provider is normally your processor, and Article 28 requires a contract covering instructions, confidentiality, security, deletion and audits.
2. 2.
   What's the lawful basis? Usually performance of a contract (Article 6(1)(b)) for the signers, and legal obligation (Article 6(1)(c)) for keeping the signed record.
3. 3.
   Are you collecting more than you need? Data minimisation is why an ID check belongs on the deals that warrant it, not on every NDA.
4. 4.
   How long do you keep it? Storage limitation pulls one way, tax and limitation periods the other. Article 17(3) lets you refuse erasure where a law requires the record or a legal claim needs it.
5. 5.
   Where does the data go? Transfers outside the EU need a basis under Chapter V, such as an adequacy decision or standard contractual clauses.

Article 32 asks for security "appropriate to the risk". That's deliberately loose, which is why buyers ask for an ISO 27001 certificate as shorthand.

Blockchain-backed signing raises an awkward question: how do you honour an erasure request on a ledger nobody can edit? The European Data Protection Board answered it in its guidelines on blockchain, final version adopted on 7 July 2026. In general, it says, personal data shouldn't go on a chain, and never in the content of transactions. Where something must, it should work as a proof of existence (a pointer, a commitment or a keyed hash), with the data needed to check it kept off chain.

Two details matter more than the headline. The EDPB treats a hash of personal data as personal data, and it says an unsalted, unkeyed hash generally isn't enough protection on a public chain. So "we only store hashes" isn't a GDPR answer by itself. Ask your provider exactly what it writes on chain and whether a person could be linked to it, then put the answer in your data protection impact assessment.

Still, a fingerprint on a public ledger is a record neither you nor the vendor can quietly rewrite. Documenting that trade-off is part of electronic signature compliance.

If you make drugs, devices or biologics, or run clinical trials, the FDA adds a layer that ordinary e-signature law doesn't. Part 11 covers the electronic records and signatures that FDA rules require you to keep or submit. It's the strictest form of electronic signature compliance most companies will meet.

The 21 CFR Part 11 electronic signature requirements that catch teams out:

• Signature manifestation (§ 11.50). The signed record shows the signer's printed name, the date and time, and the meaning: review, approval, responsibility or authorship.
• Linking (§ 11.70). Signatures are bound to their records so they can't be excised, copied or moved to falsify another record by ordinary means.
• Each signature is unique to one person, never reassigned, and issued only after the organisation verifies that person's identity (§ 11.100).
• A one-time letter to the FDA, with a handwritten signature, certifying that your staff's electronic signatures are binding. It's a letter, not a setting, which is why it gets forgotten.
• Two distinct identification components, such as an ID code and a password, for non-biometric signatures (§ 11.200).
• Secure, computer-generated, time-stamped audit trails that never obscure earlier entries (§ 11.10(e)), plus validation, access limits and written accountability policies.

Read the list again and notice how much of it describes your system and your procedures. For the logging side, see what a signing audit trail records.

NIST turns up in security questionnaires so often that people assume it's mandatory. For most private companies it isn't. SP 800-63-4, finalised in July 2025, applies to federal systems, and everyone else may consider it. Its value is vocabulary: identity assurance levels (IAL) grade how well a person's identity was proofed, authentication assurance levels (AAL) grade the login, and federation levels (FAL) grade single sign-on. A customer asking for "AAL2" means multi-factor authentication. The other NIST text you'll see, FIPS 186-5 from February 2023, is the Digital Signature Standard for the cryptography itself.

Run this before a contract type goes live, not after a dispute. Each row is a requirement from one of the laws above, what usually satisfies it, and the evidence you'd hand an auditor. Skip rows that don't apply. If you can't fill the last column, that's your gap. For how long US records must be kept, see US record retention periods.

No electronic signature compliance tool makes you compliant. It gives you controls and evidence. You decide which documents go through it, at what level, with what consent, and for how long you keep them. Write that split down before you sign a vendor contract, because it's where audits find the gaps.

Vendors differ most on certifications and regulated-industry extras, and DocuSign is ahead of most here. Its trust center lists ISO 27001:2022, SOC 1 and SOC 2 Type 2 reports, and adherence to 21 CFR Part 11 and the EU's Annex 11. Its subsidiary Docusign France SAS is listed as a qualified trust service provider on the trusted list run by France's ANSSI (both read 14 October 2026). If procurement asks whether DocuSign covers eIDAS or Part 11, those pages answer it. The right-hand column below stays yours whichever vendor you pick.

Here's what Chaindoc gives you, and where it stops.

Standard Chaindoc signatures are PAdES-BES advanced electronic signatures in the eIDAS sense, and ESIGN and UETA accept them like any e-signature that meets the tests above. For a qualified signature, the signer brings a certificate from a qualified trust service provider (a national eID or a CSC-compatible provider) and Chaindoc runs the signing session; we aren't a trust service provider ourselves. PAdES-BES carries no timestamp, so long-term validation isn't built in. Keep the audit trail and verification report with the file.

Each completed document comes with an audit trail PDF and a verification report. The server fingerprints a file on upload, the fingerprint of each published version is written to a public blockchain, and each signer's proof is recorded as they finish. Names and email addresses don't go on chain. Files travel over TLS and private signing keys are encrypted with AES-256, but documents aren't end-to-end encrypted: the server reads them to scan, convert and sign.

Our privacy notice names Chaindoc as your processor for uploaded documents, signatures and audit trails, with data processed in the EU, the US or wherever subprocessors operate. Chaindoc holds ISO 27001 and ISO 9001 certificates. You add ID checks per deal through optional identity checks, and a fixed signing order runs through approval routes on the Business plan. Compare the plans before you commit.

That covers the evidence half of electronic signature compliance. The right-hand column above remains yours.