UA EN
Support

Electronic Digital Signature: Legal Aspects of Use

· Updated · 6 min

Conceptual illustration of an electronic digital signature: key media, document, and desktop computer

As of early January 2009, an electronic digital signature (EDS) allows verifying who signed an electronic document and whether the signed data has changed. For an enterprise, this is an opportunity to organize document exchange with partners without sending a paper copy in cases where the law and an agreed workflow procedure permit an electronic original. The basis is formed by Law No. 851-IV on Electronic Documents and Law No. 852-IV on EDS. In an electronic document management system, signing must be combined with authority verification, approval of the final version, and proper storage.

What an Electronic Digital Signature Verifies

An EDS is created using a private key and verified with a public key. An image of a handwritten signature inserted into a file is not an EDS. The digital signature itself also does not conceal the document content from third parties: confidentiality requires separate protection. Signature verification helps identify the signer and check data integrity, but does not confer authority on an employee to conclude agreements. Therefore, the recipient separately verifies the signature, the person's right to represent the organization, and compliance with the form requirements of a specific transaction.

When an EDS is Equated to a Handwritten Signature

According to Article 3 of Law No. 852-IV, an electronic digital signature has the same legal status as a handwritten signature (seal) when all three conditions are met:

  • the signature is verified using an enhanced key certificate and reliable digital signature tools;
  • validity of the public key certificate at the time of signature application, which is confirmed during verification;
  • matching of the signer's private key to the public key specified in the certificate.

The absence of an enhanced certificate does not in itself make an electronic signature invalid. Article 5 of Law No. 852-IV allows other legal entities and individuals, unlike the state entities listed in it, to use certificates of key certification centers or an EDS without a certificate on a contractual basis. The parties allocate the risks of such exchange in the contract. This does not override special requirements for individual transactions and does not mean that any file marked "signed" is equivalent to a paper original.

Separate Rules for the Public Sector

Separate conditions apply to state authorities, local self-government bodies, state-owned enterprises, institutions, and organizations. The Procedure approved by CMU Resolution No. 1452 requires reliable EDS tools and enhanced key certificates. In the version effective as of January 5, 2009, it prohibits these institutions from applying an EDS for transactions exceeding UAH 1 million and for documents that by law cannot be electronic originals. These restrictions should not be automatically extrapolated to all private enterprises.

For executive branch bodies, CMU Resolution No. 1453 defines the procedure for electronic document flow: signature verification, registration-control cards, and notifications of receipt and registration. If the addressee lacks the necessary EDS tools, appropriate paper procedures are provided for. The recipient's readiness for electronic exchange must be ascertained prior to launch, not after the first dispatch.

How to Organize Document Exchange

A hypothetical example: two private companies agreed on electronic exchange of a contract for which such a method is permissible. An employee creates a draft with a version number, collects internal approvals, and passes the final package to the authorized signer. The signer checks the content and attachments and applies the EDS. The recipient verifies the signature, the person's authority, and completeness, and sends an acknowledgment of receipt agreed upon by the parties. An amended document is executed as a new version and signed again: altering the signed data causes the integrity check to fail. A notification of receipt does not replace the approval of contract terms or the signature of the other party.

Keys, Authority, and Employee Training

Successful use of an EDS in enterprise activities requires preparing the internal environment and implementing strict security regulations:

  • installation of compatible software for applying and verifying digital signatures;
  • ensuring personal responsibility of employees for maintaining the secrecy of the private key without transferring it to other persons;
  • substitution procedure: a separately authorized person signs with their own key, not with the key of an absent colleague;
  • implementation of a procedure for immediate blocking or revocation of a certificate in case of loss or compromise of a key;
  • review of authority and access after a change of position or dismissal, and proper revocation of relevant certificates.

The choice of key media depends on signature tools, requirements for specific exchange, and security organization. Before starting work, it is worth checking whether the partner can open the file, verify all signatures, and read attachments. Employees need concise instructions with examples: how to verify signature results, whom to notify about key media loss, and how to act upon verification failure. Administrator access to the system must not imply the right to sign documents on behalf of other persons.

Storage and Value for the Customer

Article 13 of Law No. 851-IV establishes that the retention period for electronic documents cannot be less than the period established for corresponding paper documents. Data accessibility and the ability to reproduce the document must be ensured. For subsequent verification, it is advisable to store the signed file with signatures, relevant certificates and information on their status, proof of exchange, and documents confirming authority. The composition of such a set is determined for a specific process. A printout or screenshot does not replace an electronic original.

For the customer, the value of an EDS lies in the ability to verify the signer and document integrity, and to reduce the forwarding of paper copies where electronic exchange is permissible. The outcome depends on the authority of participants, compatibility of tools, and configured procedures.

It is advisable to start with one document type and a small group of partners. In the pilot, measure the time from document readiness to confirmed receipt, the number of failed verifications, and cases of re-signing. Separately check the search for saved packages and recovery from backup copies. This demonstrates which operations became simpler for the employee and where additional settings or training are needed.

Questions and answers

Is a scanned handwritten signature on a document an electronic digital signature?

No, a graphic image of a signature is not an EDS. It does not provide cryptographic protection, does not confirm document integrity, and does not allow technically verifying the signer's identity.

Can a private enterprise operate without an enhanced certificate?

Article 5 of Law No. 852-IV allows contractual options for using an EDS for non-governmental participants. However, special requirements for a specific transaction and its participants must be verified separately.

What restriction applied to the public sector as of January 5, 2009?

Pursuant to CMU Resolution No. 1452, an EDS was not used in the public sector for transactions exceeding UAH 1 million or for documents that by law cannot exist in the form of an electronic original.

Sources

Tags: #Electronic Signature #Electronic Document Management #Public Sector