Electronic signatures and the GDPR: data sovereignty explained

• Depending on the method used, an electronic signature may involve personal data such as a name, timestamp or IP address; in the case of biometric capture, characteristics such as pressure, writing speed and time elapsed are also included.
• Biometric signature data may fall within the scope of Article 9 of the GDPR if it is used to uniquely identify a person – the specific technical implementation is decisive.
• Where processing is carried out by an external provider, a data processing agreement in accordance with Article 28 of the GDPR is generally required.
• signoSign/2 runs locally; signoSign/Universal is available on-premises or as a SaaS solution hosted in Germany.

This article does not constitute legal advice in individual cases nor an individual data protection impact assessment.

Is an electronic signature GDPR-compliant? The short answer: Yes, provided that the processing of the data generated in the process is based on a legal basis, is contractually secured with the provider, and is technically designed in such a way that only the necessary data is collected and stored. The decisive factor here is not so much the signature itself as the question of what data is generated in the background and where it ends up.

Every electronic signature generates at least some metadata: the name of the signatory, the date and time, and often the IP address and a hash value of the signed document. If the signature is captured by hand on a signotec signature pad, biometric characteristics are also included, such as writing speed, pressure profile and time profile. These characteristics serve to enable the signature to be attributed to a specific person in the event of a dispute – comparable to a handwritten signature sample on paper, but one that can be analysed digitally.

Biometric data falls within the categories of data requiring special protection when it is processed for the purpose of uniquely identifying an individual. Article 4(14) of the GDPR defines such data as that which enables or confirms unambiguous identification; Article 9 of the GDPR generally prohibits the processing of such data, unless one of the exceptions listed therein applies. In practice, depending on the specific purpose, explicit consent may be a particular option. The legal basis of performance of a contract under Article 6(1)(b) of the GDPR, which is otherwise frequently used, is not sufficient on its own for Article 9 data.

With signotec solutions, the raw biometric data of the signature is encrypted and embedded in the PDF document in a tamper-proof manner – it is not the document itself that is encrypted, but the biometric data within the document. It is not stored in a central database for identification purposes; it serves to verify a person who is already known, rather than to identify them for the first time from a dataset. In practice, this distinction is interpreted in different ways. Organisations with high protection requirements should clarify the classification with their own data protection officer and document it in the record of processing activities.

If the signature solution is operated by an external provider or a trust service provider, that provider processes personal data on behalf of the organisation. This requires a data processing agreement in accordance with Article 28 of the GDPR, which sets out, amongst other things, the purpose, duration, type of data, categories of data subjects, technical and organisational measures, and retention periods. If a trust service provider is involved in the qualified electronic signature process, their own statutory obligation to retain signature certificates applies in addition – this runs independently of the company’s own data retention policy.

A key difference compared with many signature solutions is that signoSign/2 runs locally on the workstation or terminal server. signoSign/Universal can be operated on-premises in the organisation’s own data centre. As a result, signature data and signed documents remain within the organisation’s own IT infrastructure. For organisations with strict compliance requirements, such as those in the healthcare or financial sectors, this can reduce the coordination effort involved in order processing, as there is no need for an additional external processor.

Those using signoSign/Universal as a SaaS solution can also clearly identify the storage location: signotec certifies that the cloud solution is hosted and that data is stored in Germany. Processing is governed by a data processing agreement in accordance with Article 28 of the GDPR, which specifies the purpose, duration and technical measures.

• Document the processing activity in the register in accordance with Article 30 of the GDPR, including the purpose and legal basis
• Check whether biometric signature data in the specific setup falls within the scope of Article 9 of the GDPR, and document the result
• Conclude a data processing agreement with the signature provider or trust service provider
• Clarify the data storage location: on-premises, an EU data centre or a third country
• Set retention periods for signature data, taking into account statutory retention obligations for certificates
• Implement data subjects’ rights technically, such as the right to access stored signature data

Are biometric signature data automatically classified as specially protected data?

No, that depends on the technical design and the intended purpose. The decisive factor is whether the data is used for unique identification or serves solely to verify a signature that is already known. This classification determines the legal basis you require for processing.

Does every electronic signature require consent under the GDPR?

Not necessarily. Processing is often based on the performance of a contract under Article 6(1)(b) of the GDPR. The situation is different if, in the specific context, the biometric signature data falls under Article 9 of the GDPR. In that case, the performance of a contract alone is not sufficient; an exception under Article 9(2) of the GDPR must also apply – in practice, depending on the purpose, this might be explicit consent, for example.

How long may signature data be stored?

This depends on the purpose of the processing and any statutory retention obligations, such as those under commercial or tax law. There is no fixed time limit.

Is a cloud-based signature solution automatically prohibited?

No, cloud solutions can also be operated in compliance with the GDPR, provided that data processing on behalf of the controller, the storage location and technical measures are appropriately regulated. On-premises solutions merely reduce the number of processors involved.

Who is liable if the signature provider loses data?

In principle, the company, as the data controller, remains liable to data subjects, but can protect itself internally through the data processing agreement with the provider.

GDPR compliance for electronic signatures is not a state that can be achieved by a tool alone, but rather the result of technical design, contractual safeguards and documentation. Those who run signoSign/2 locally or signoSign/Universal on-premises can reduce the number of data processors involved. For the SaaS version of signoSign/Universal, signotec provides hosting in Germany. Please contact our team if you wish to set up or review your signature setup to ensure it complies with data protection regulations.