E-signature compliance

Personal Information Protection and Electronic Documents Act

• —Federal legislation that defines "electronic signature" as information in electronic form that a person has created or adopted in order to sign a document and that is in, attached to, or associated with the document.
• —Schedule 2 of PIPEDA provides that an electronic signature satisfies a legal requirement for a signature when the signature can be reliably created and verified in the circumstances.
• —Provincial e-commerce acts (Ontario ECA, BC ECTA, Alberta ETA, etc.) provide supplementary recognition at the provincial level.
• —Quebec's Act to establish a legal framework for information technology (LCCJTI) sets equivalent standards independently of PIPEDA.

Electronic Signatures in Global and National Commerce Act

• —Federal law that gives electronic signatures the same legal weight as handwritten signatures and eliminates paper-only requirements for contracts in interstate and foreign commerce.
• —Requires that the signer have consented to use an electronic signature — consent must be voluntary and documented.
• —Electronic records are the legal equivalent of paper records when all parties have agreed to conduct the transaction electronically.
• —Preempts state laws that restrict electronic signatures, except those consistent with UETA.

Uniform Electronic Transactions Act

• —Model law adopted by 49 states and the District of Columbia. New York has its own equivalent (Electronic Signatures and Records Act — ESRA).
• —Establishes that a record or signature may not be denied legal effect solely because it is in electronic form.
• —Requires that the parties agree to conduct the transaction electronically (expressly or by context and conduct).
• —Governs electronic signatures for intrastate commercial transactions, complementing the federal ESIGN Act.

What is e-signature compliance?

E-signature compliance means that an electronic signature was collected in a way that satisfies the legal requirements of the applicable jurisdiction — most commonly PIPEDA (Canada), the ESIGN Act (US federal), or UETA (US state). The key requirements across all three are: (1) the signer voluntarily consented to sign electronically; (2) the signature is attributable to the signer (via identity verification); (3) the signed document and signing record are retained and accessible. GetSigned is designed to satisfy all three requirements.

What evidence does GetSigned capture to prove an e-signature is valid?

GetSigned captures: explicit e-sign consent with timestamp and IP; OTP identity verification event; document view event; each signature event with metadata; SHA-256 hashes of the original and final document; a PKCS#7 digital seal applied to the entire PDF; and a hash-chained, append-only audit log. All of this is summarized in an audit certificate page embedded in the sealed document. This evidence record is sufficient for defensibility under PIPEDA, ESIGN, and UETA.

Is GetSigned compliant with PIPEDA?

GetSigned is designed to produce e-signatures that satisfy PIPEDA's requirements: the signature is in electronic form, it is created by the signer (via OTP-verified identity), it is attached to the document (via field flattening and PKCS#7 seal), and the record is retained. For PIPEDA Schedule 2 "secure electronic signature" requirements (applicable to specific government documents), a qualified certificate-based signature is required — GetSigned uses a service-level seal rather than a per-signer qualified certificate, which is the correct approach for commercial e-signatures under ESIGN/UETA and most PIPEDA use cases.

What is the difference between an e-signature and a digital signature for compliance purposes?

An e-signature is a legally defined concept: any electronic process that indicates a person's intent to sign. A digital signature is a technical implementation: a cryptographic operation using a public/private key pair that proves document integrity. For ESIGN/UETA/PIPEDA compliance, a legally valid e-signature is what matters — the law does not require a PKI-based digital signature. GetSigned collects a legally valid e-signature (with consent, identity verification, and audit trail) and additionally applies a service-level digital seal (PKCS#7) to the document for tamper-evidence. This gives you both the legal standard and the technical proof.

Are there document types that e-signatures cannot be used for?

Yes. ESIGN and UETA both exclude certain categories: wills and codicils, adoption papers, certain family law documents, and specific notices (utility disconnection, eviction). Negotiable instruments and certain real property conveyances may have additional requirements depending on state law. PIPEDA similarly excludes specific document types from electronic signature recognition. The list above covers the most common exclusions — consult qualified legal counsel for your specific document types and jurisdictions.

Does using GetSigned make my documents automatically compliant?

GetSigned provides the technical infrastructure for legally defensible e-signatures: consent capture, identity verification, document integrity sealing, and audit trail. Compliance also depends on: (1) the document type — see exclusions above; (2) your specific use case and jurisdiction; (3) any sector-specific regulations that may apply (financial services, healthcare, government). "The tool was compliant" is necessary but not sufficient — the overall process must also be compliant. Consult qualified legal counsel for your specific use case.