Electronic signature laws by country

The question almost always arrives late. The contract has gone out, somebody has already drawn their name with a fingertip on a phone, and only then does a third person ask whether that counted.

The honest answer has two halves, and most articles give you only the first. This is general information, not legal advice, and the rules differ by country and often by state, so check your own jurisdiction before relying on any of it.

The short answer

Each of the laws below does the same narrow thing. It stops a signature from being rejected because it was electronic. None of them says an electronic signature is automatically good, and none of them removes any other objection a court might have.

So the question worth asking is not whether the format is allowed. It is what you would put in front of someone if the other side said they never signed. That is a question about records, and it has a concrete answer you can inspect.

The laws, country by country

Where	Law	What it provides
Australia	Electronic Transactions Act 1999 (Cth), ss 8 and 10	A transaction is not invalid because it took place by electronic communication. A signature requirement is met if a method identified the person and indicated their intention, the method was as reliable as appropriate for the purpose or is proven in fact to have done both, and the recipient consented to it.
United States	ESIGN Act 2000, s 101(a)	A signature, contract or record may not be denied legal effect, validity or enforceability solely because it is in electronic form. Section 106(5) defines an electronic signature as a sound, symbol or process attached to a record and “executed or adopted by a person with the intent to sign the record”.
United Kingdom	Electronic Communications Act 2000, s 7	An electronic signature, and any certification of it, is admissible in evidence on questions of the authenticity or the integrity of the data. The Law Commission concluded in 2019 that an electronic signature can validly execute a document, deeds included, where the signatory intends to authenticate it and any formalities are met.
European Union	eIDAS Regulation 910/2014, arts 25 and 26	A signature is not denied legal effect or admissibility solely because it is electronic or because it is not qualified. A qualified electronic signature has the equivalent legal effect of a handwritten one. Article 26 sets the four requirements an advanced signature must meet.

Two limits are easy to miss. The Australian Act’s signature rule sits in a part headed “Requirements under laws of the Commonwealth”, and section 7B takes court and tribunal practice and procedure out of it, so state law and court rules are governed elsewhere. And eIDAS article 2(3) says the Regulation does not affect the law on the conclusion and validity of contracts or other obligations relating to form. Both come to the same thing: the rule that an electronic signature counts is a different rule from the one that says this document must be witnessed, registered or made as a deed.

Documents that are usually excluded

Every jurisdiction carves something out, and the carve-outs do not match each other.

The ESIGN Act lists its own at section 103: wills, codicils and testamentary trusts; state law on adoption, divorce and other family law; most of the Uniform Commercial Code; court orders and official court documents; notices cancelling utility services; notices of default, foreclosure or eviction under a credit agreement secured by, or a rental agreement for, a primary residence; cancellation of health or life insurance benefits; product recalls; and documents accompanying hazardous materials.

The Australian Act reaches exclusions differently, through section 7A, which lets regulations switch provisions off for specified laws or classes of matter, and through the court and tribunal exclusion in 7B.

Treat that as a warning rather than a checklist. Property instruments, anything registered, anything witnessed, and anything a regulator has its own rules for are where a general answer stops being useful. Look the document type up in your own jurisdiction.

What makes a signature hold up: intent, consent, identity, integrity

Strip the four statutes down and they ask for the same four things.

Intent. ESIGN’s definition turns on the person adopting the symbol with the intent to sign. The Australian test asks for a method that indicates the person’s intention in respect of the information communicated.

Consent. Section 10(1)(d) of the Australian Act makes the recipient’s consent to the method part of the test, and ESIGN has a separate consumer consent regime at section 101(c). Here consent is a hard gate: a tick box saying the signer agrees to sign electronically and that their signature is as binding as a handwritten one, refused again by the API if it is missing. It is stored as a timestamp plus a version string, currently 2026-08-01, so you can tell later which wording someone accepted.

Identity. The Australian test asks for a method to identify the person. Three are offered: the emailed link alone, an access code the sender shares out of band, or a six digit code emailed at the moment of signing. Which one was used is printed on the certificate, per signer.

Integrity. Article 26(d) of eIDAS asks that an advanced signature be linked to the signed data so that any later change is detectable. That is the one part of this that is pure cryptography, and it happens once, at the end.

What the evidence looks like: certificate and audit trail

Two records come out of a completed request.

The first is the audit trail. Eighteen event types are written, from created and sent through opened, auth_challenged, authenticated, viewed and signed, to certified and completed. Each row carries a hash over its own contents plus the previous row’s hash, with object keys sorted so that a database reordering them cannot change the result. Walking the chain gives a verdict: either it verifies, or it names the sequence number where it broke.

The second is the certificate of completion, a separate A4 PDF built at the end. Its three sections and every line in them are set out in the table below.

Two honest caveats. The two hashes in the ENVELOPE section are the uploaded file and the stamped file before certification, so neither equals the checksum of the PDF you download. Do not tell anyone to compare them. And the timestamping code is complete but switched off: the timestamp authority URL is empty in the deployed configuration, so the certificate prints PAdES-SHA256-DocMDP with no timestamp phrase after it, which is the certificate telling you plainly that there is no third party time attestation.

Electronic vs digital vs qualified

This is the distinction most articles blur, and it matters.

The mark the signer makes is a picture. Drawn with a finger, or typed and rendered onto a canvas, it is saved as a PNG with its own SHA-256. It is an electronic signature in the eIDAS sense of data in electronic form attached to other data and used by the signatory to sign, and nothing more. On its own it proves nothing.

The certificate-based part happens once, after the last signer. The finished PDF is signed with a PAdES CMS signature and certified with DocMDP set to 1, which means no changes are permitted and any change invalidates the signature. That is what makes later edits detectable, and it is what checking the PDF in a reader actually inspects.

What it is not is a qualified electronic signature under eIDAS article 3(12), which needs a qualified certificate issued to the signatory and a qualified signature creation device. Nobody here is claiming that, and any product that quietly implies otherwise is worth reading twice. If you want the difference in one sentence, electronic versus digital signature sets it out.

The example

The worked example below is a mutual non-disclosure agreement, the document most people send for signature first. It is small, two-sided, and unlikely to fall inside anyone’s exclusion list, which is why it makes a good first test of a process you want to trust with a bigger contract later.