Electronic Signature Law of the People’s Republic of China — Full English Translation (2004, Amended 2019)

Electronic Signature Law of the People’s Republic of China

Adopted August 28, 2004 · Amended April 24, 2015 · Amended April 23, 2019

This English translation is provided for reference and informational purposes only. The official Chinese text as published by the National People’s Congress of the People’s Republic of China shall prevail in all matters of legal interpretation. Every effort has been made to render the statutory language precisely; where the Chinese legal idiom departs from common-law usage, the translator has followed the source structure to preserve fidelity.

Chapter I — General Provisions

Article 1. This Law is enacted for the purposes of regulating electronic signature activities, establishing the legal validity of electronic signatures, and safeguarding the lawful rights and interests of the parties concerned.

Article 2. For the purposes of this Law, “electronic signature” means data contained in and attached to a data message in electronic form, which is used to identify the identity of the signatory and to indicate that the signatory approves of the content contained therein.

For the purposes of this Law, “data message” means information generated, dispatched, received, or stored by electronic, optical, magnetic, or similar means.

Article 3. In civil activities, the parties may agree to use or not to use electronic signatures or data messages in documents such as contracts or other documents, receipts, or instruments.

The legal validity of documents in which the parties have agreed to use electronic signatures or data messages as mentioned in the preceding paragraph shall not be denied merely on the ground that they are in the form of electronic signatures or data messages.

The provisions of the preceding paragraph shall not apply to the following documents:

(1) documents involving personal relationships such as marriage, adoption, and succession;

(2) documents involving the transfer of rights and interests in real property such as land and houses;

(3) documents involving the cessation of supply of public utility services such as water, heat, gas, and electricity; and

(4) other circumstances where electronic documentation is inapplicable as provided for by laws or administrative regulations.

Chapter II — Data Messages

Article 4. A data message that is capable of tangibly representing the content contained therein and can be accessed for reference and use at any time shall be deemed to be a document in written form that satisfies the requirements of laws and regulations.

Article 5. A data message that meets the following conditions shall be deemed to satisfy the requirements of laws and regulations for the form of an original document:

(1) it can effectively represent the content contained therein and can be accessed for reference and use at any time; and

(2) it can be reliably ensured that the content has remained complete and unaltered from the time of its final formation; provided, however, that the addition of endorsements to a data message and any changes in form occurring in the course of data exchange, storage, and display shall not affect the integrity of the data message.

Article 6. A data message that meets the following conditions shall be deemed to satisfy the requirements of laws and regulations for document retention:

(1) it can effectively represent the content contained therein and can be accessed for reference and use at any time;

(2) the format of the data message is identical to the format at the time of its generation, dispatch, or receipt, or, where the format is not identical, it can accurately represent the content originally generated, dispatched, or received; and

(3) the originator, the addressee, and the time of dispatch and receipt of the data message can be identified.

Article 7. A data message shall not be refused to be admitted as evidence solely on the ground that it is generated, dispatched, received, or stored by electronic, optical, magnetic, or similar means.

Article 8. In examining the authenticity of a data message as evidence, the following factors shall be taken into consideration:

(1) the reliability of the method of generation, storage, or transmission of the data message;

(2) the reliability of the method of maintaining the integrity of the content;

(3) the reliability of the method of identifying the originator; and

(4) other relevant factors.

Article 9. A data message shall be deemed to have been dispatched by the originator under any of the following circumstances:

(1) it is dispatched with the authorization of the originator;

(2) it is dispatched automatically by the information system of the originator; or

(3) the result of verification carried out by the addressee in accordance with a method approved by the originator is consistent with the data message.

Where the parties have agreed otherwise on the matters specified in the preceding paragraph, such agreement shall prevail.

Article 10. Where laws or administrative regulations require, or the parties have agreed, that receipt of a data message be confirmed, such confirmation shall be made. A data message shall be deemed to have been received when the originator receives a confirmation of receipt from the addressee.

Article 11. The time when a data message enters an information system beyond the control of the originator shall be deemed to be the time of dispatch of the data message.

Where the addressee has designated a specific information system for the receipt of data messages, the time when the data message enters that specific system shall be deemed to be the time of receipt; where no specific system has been designated, the time when the data message first enters any information system of the addressee shall be deemed to be the time of receipt.

Where the parties have agreed otherwise on the time of dispatch or receipt of data messages, such agreement shall prevail.

Article 12. The principal place of business of the originator shall be the place of dispatch of a data message, and the principal place of business of the addressee shall be the place of receipt of the data message. Where there is no principal place of business, the place of habitual residence shall be the place of dispatch or receipt.

Where the parties have agreed otherwise on the place of dispatch or receipt of data messages, such agreement shall prevail.

Chapter III — Electronic Signatures and Certification

Article 13. An electronic signature shall be deemed to be a reliable electronic signature if it simultaneously satisfies the following conditions:

(1) when the electronic signature creation data are used for electronic signature, they are proprietary to the electronic signatory;

(2) at the time of signing, the electronic signature creation data are controlled solely by the electronic signatory;

(3) any alteration to the electronic signature made after signing is detectable; and

(4) any alteration to the content and form of the data message made after signing is detectable.

The parties may also choose to use an electronic signature that meets the reliable conditions as agreed upon by them.

Article 14. A reliable electronic signature shall have the same legal effect as a handwritten signature or seal.

Article 15. An electronic signatory shall properly safeguard the electronic signature creation data. When the electronic signatory knows that the electronic signature creation data have been compromised or may have been compromised, the signatory shall promptly notify the relevant parties and cease using such electronic signature creation data.

Article 16. Where an electronic signature requires third-party certification, the certification service shall be provided by an electronic certification service provider established in accordance with the law.

Article 17. To provide electronic certification services, the following conditions shall be met:

(1) having professional technical personnel and managerial personnel commensurate with the provision of electronic certification services;

(2) having funds and business premises commensurate with the provision of electronic certification services;

(3) having technologies and equipment that conform to national security standards;

(4) having documentary proof of approval from the national cryptography administration authority for the use of cryptography; and

(5) other conditions provided for by laws and administrative regulations.

Article 18. Any person intending to engage in electronic certification services shall file an application with the competent department of the information industry under the State Council and submit the relevant materials certifying compliance with the conditions specified in Article 17 of this Law. The competent department of the information industry under the State Council shall, upon receiving the application, conduct examination in accordance with the law and, after soliciting the opinions of the competent department of commerce under the State Council and other relevant departments, make a decision on whether to grant or deny the license within 45 days from the date of receiving the application. If the license is granted, an electronic certification license certificate shall be issued; if the license is denied, the applicant shall be notified in writing and the reasons therefor shall be stated.

An electronic certification service provider that has obtained certification qualifications shall, in accordance with the provisions of the competent department of the information industry under the State Council, publish its name, license number, and other relevant information on the Internet.

Article 19. An electronic certification service provider shall formulate and publish its electronic certification business rules that conform to the relevant national provisions, and shall file such rules with the competent department of the information industry under the State Council for the record.

The electronic certification business rules shall include matters such as the scope of liability, operational procedure specifications, and information security safeguard measures.

Article 20. When applying to an electronic certification service provider for an electronic signature certification certificate, an electronic signatory shall provide truthful, complete, and accurate information.

Upon receiving an application for an electronic signature certification certificate, the electronic certification service provider shall verify the identity of the applicant and examine the relevant materials.

Article 21. An electronic certification service provider that issues an electronic signature certification certificate shall issue it in accordance with the electronic certification business rules and shall be liable for the consequences arising therefrom.

Article 22. An electronic certification service provider shall ensure that the content of the electronic signature certification certificate is true, complete, and accurate during the valid term of the certificate, and shall ensure that the relying party of the electronic signature can verify or understand the matters recorded in the electronic signature certification certificate.

Article 23. An electronic certification service provider intending to suspend or terminate electronic certification services shall notify the competent department of the information industry under the State Council and other relevant departments 90 days prior to the suspension or termination of services, and shall make a public announcement of the same.

Where an electronic certification service provider intends to suspend or terminate electronic certification services, it shall, prior to the suspension or termination of services, make arrangements with other electronic certification service providers for the continued provision of services to the holders of the electronic signature certification certificates it has issued.

Where an electronic certification service provider fails to make arrangements with other electronic certification service providers for the continued provision of services, the competent department of the information industry under the State Council shall, following an application by the holders of the electronic signature certification certificates, designate an electronic certification service provider to undertake the continued provision of services.

Article 24. An electronic certification service provider shall properly preserve information related to certification and shall keep such information for a period of not less than five years after the electronic signature certification certificate ceases to be valid.

Article 25. An electronic signature certification certificate issued by an electronic certification service provider shall accurately record the following:

(1) the name of the electronic certification service provider;

(2) the name of the certificate holder;

(3) the serial number of the certificate;

(4) the valid term of the certificate;

(5) the electronic signature verification data of the certificate holder;

(6) the electronic signature of the electronic certification service provider; and

(7) other content provided for by the competent department of the information industry under the State Council.

Article 26. When the relying party of an electronic signature becomes aware, or ought to become aware, that the electronic signature certification certificate is no longer trustworthy, it shall immediately cease the verification operation using the certificate and immediately notify the electronic certification service provider of the same.

Where the relying party of an electronic signature knows that the electronic signature creation data have been compromised or may have been compromised, or becomes aware of other circumstances that affect the security of the electronic signature, it shall immediately notify the electronic certification service provider and suspend the use of the electronic signature.

Chapter IV — Legal Liability

Article 27. Where an electronic signatory, having become aware that the electronic signature creation data have been compromised or may have been compromised, fails to notify the relevant parties and to cease using the electronic signature creation data, or fails to provide truthful, complete, and accurate information to the electronic certification service provider, or otherwise causes damage to the electronic certification service provider or the relying party of the electronic signature, the electronic signatory shall bear the liability for compensation in accordance with the law.

Article 28. Where an electronic signature is known by the relying party thereof or the electronic certification service provider to have ceased to be secure, and the relying party or the electronic certification service provider fails to notify the relevant parties and to cease using the electronic signature, the relying party or the electronic certification service provider shall bear the corresponding liability for compensation in accordance with the law.

Article 29. Where any person counterfeits, fraudulently uses, or misappropriates another person’s electronic signature, and thereby commits a crime, criminal liability shall be pursued in accordance with the law; where such act is insufficient to constitute a crime, the public security authority shall impose an administrative penalty in accordance with the law.

Article 30. Where an electronic certification service provider, in violation of the provisions of Article 18 of this Law, provides electronic certification services without a license, the competent department of the information industry under the State Council shall order it to cease the illegal act; any illegal gains shall be confiscated; where the illegal gains exceed 300,000 yuan, a fine of not less than one time but not more than three times the illegal gains shall be imposed; where there are no illegal gains or the illegal gains are less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan shall be imposed.

Article 31. Where an electronic certification service provider fails to comply with the certification business rules or fails to properly preserve information related to certification, the competent department of the information industry under the State Council shall order it to make corrections within a specified time limit and issue a warning; where the circumstances are serious, its electronic certification license shall be revoked; where a crime is constituted, criminal liability shall be pursued in accordance with the law.

Article 32. Where any person counterfeits, fraudulently uses, or misappropriates another person’s electronic signature certification certificate, and thereby commits a crime, criminal liability shall be pursued in accordance with the law; where such act is insufficient to constitute a crime, the public security authority shall impose an administrative penalty in accordance with the law.

Article 33. Where a staff member of the department responsible for the supervision and administration of the electronic certification services industry in accordance with this Law neglects his or her duties, engages in malpractices for personal gain, or abuses his or her powers, and thus commits a crime, criminal liability shall be pursued in accordance with the law; where such act is insufficient to constitute a crime, an administrative sanction shall be imposed in accordance with the law.

Chapter V — Supplementary Provisions

Article 34. For the purposes of this Law, the following terms shall have the meanings set forth below:

(1) “electronic signatory” means a natural person, legal person, or other organization that holds the electronic signature creation data and acts either on its own behalf or on behalf of the natural person, legal person, or other organization it represents;

(2) “relying party” means a natural person, legal person, or other organization that conducts relevant activities based on reliance on an electronic signature or electronic signature certification certificate;

(3) “electronic certification service provider” means a legal person that provides services for verifying electronic signatures and issues electronic signature certification certificates;

(4) “electronic signature certification certificate” means a data message or other electronic record that can verify the relationship between an electronic signatory and the electronic signature creation data;

(5) “electronic signature creation data” means data such as codes, ciphers, algorithms, or rules used by an electronic signatory in the course of creating an electronic signature, which link the electronic signature to the electronic signatory in a reliable manner; and

(6) “electronic signature verification data” means data such as codes, ciphers, algorithms, or rules used to verify an electronic signature.

Article 35. The State Council or the departments designated by the State Council may, in accordance with this Law, formulate specific measures for the administration of electronic certification services in government affairs and other social activities.

Article 36. This Law shall come into force as of April 1, 2005.