1
Electronic Signature Law of the People’s Republic of China
Full text
Contents
Chapter I General Provisions
Chapter II Data Message
Chapter III Electronic Signature and Certification
Chapter IV Legal Responsibility
Chapter V Supplementary Provisions
Chapter I General Provisions
Article 1
This Law is enacted in order to standardize acts of electronic signature, validate the legal effect of electronic signature, and safeguard the lawful rights and interests of the parties concerned.
Article 2
For the purposes of this Law, electronic signature means the data in electronic form contained in and attached to a data message to be used for identifying the identity of the signatory and for showing that the signatory recognizes what is in the message.
The data message as mentioned in this Law means the information generated, dispatched, received or stored by electronic, optical, magnetic or similar means.
Article 3
The parties concerned may agree to use or not to use electronic signature or data message in such documentations as contracts and other documents, receipts and vouchers in civil activities.
The legal effect of a document, with regard to which the parties concerned have agreed to use electronic signature or data message, shall not be denied only because the form of electronic signature or data message is adopted.
2
The provisions of the preceding paragraphs shall not be applicable to the following documents:
(1) documents relating to such personal relations as marriage, adoption and succession;
(2) documents relating to the transfer of the rights and interests residing in such real estate as land and houses;
(3) documents relating to termination of such public utility services as water supply, heat supply, gas supply and power supply; and
(4) other circumstances where electronic documentation is not applicable, as provided for by laws and administrative regulations.
Chapter II Data Message
Article 4
A data message, which can give visible expression to the contents carried and can readily be picked up for reference, shall be deemed to be the written form which conforms to the requirements of laws and regulations.
Article 5
Data messages that meet the following conditions shall be deemed to satisfy the requirements for the form of the original copies as provided for by laws and regulations:
(1) messages that can give effective expression to the contents carried and can readily be picked up for reference; and
(2) messages that can unfailingly guarantee that the contents remain complete and unaltered from the time when they are finally generated. And the completeness of the data messages shall not be affected when endorsements are added to the data messages or when their forms are altered in the process of data interchange, storage and display.
Article 6
Data messages that meet the following conditions shall be deemed to satisfy the requirements for document preservation as provided for by laws and regulations:
(1) messages that can give effective expression to the contents carried and can readily be picked up for reference;
(2) the format of the data messages is the same as the format when they are generated, dispatched or
3
received, or although the format is not the same, the contents originally generated, dispatched or received can accurately be expressed; and
(3) messages the addressers and receivers of which and the time of their dispatch and receipt can be identified.
Article 7
No data messages to be used as evidence shall be rejected simply because they are generated, dispatched, received or stored by electronic, optical, magnetic or similar means.
Article 8
The following factors shall be taken into consideration when the truthfulness of data messages to be used as evidence is examined:
(1) the reliability of the methods used for generating, storing or transmitting the data messages;
(2) the reliability of the methods used for keeping the completeness of the contents;
(3) the reliability of the methods for distinguishing the addressers; and
(4) other relevant factors.
Article 9
Any of the following data messages shall be deemed to be dispatched by the addresser:
(1) the data message is dispatched with authorization of the addresser;
(2) the data message is dispatched automatically by the information system of the addresser; and
(3) verification of the data message made by the receiver in accordance with the method recognized by the addresser proves that the message is identical with the one dispatched.
If the parties concerned have agreed otherwise with regard to the matters specified in the preceding paragraph, such agreement shall be complied with.
Article 10
If confirmation of receipt of a data message is required pursuant to the provisions of laws and administrative regulations or the agreement reached between the parties concerned, such receipt shall be confirmed. When the addresser receives the confirmation of the receipt sent by the receiver, the data
4
message shall be deemed to have been received.
Article 11
The time when a data message enters into a certain information system beyond the control of the addresser shall be deemed to be the time when the message is dispatched.
If a receiver designates a special system for receipt of a data message, the time when the message enters into the system as designated shall be deemed to be the time when the said message is received; and if no special system is designated, the first time when the data message enters into any systems of the receiver's shall be deemed to be the time when the message is received.
If the parties concerned have agreed otherwise on the time of dispatch or the time of receipt of data messages, such agreement shall be complied with.
Article 12
The principal business place of an addresser shall be the place of dispatch of data messages, and the principal business place of a receiver shall be the place of receipt of data messages. If there are no principal business places, their habitual residences shall be the places of dispatch or receipt.
If the parties concerned have agreed otherwise on the place of dispatch or the place of receipt of data messages, such agreement shall be complied with.
Chapter III Electronic Signature and Certification
Article 13
If an electronic signature concurrently meets the following conditions, it shall be deemed as a reliable electronic signature:
(1) when the creation data of the electronic signature are used for electronic signature, it exclusively belongs to an electronic signatory;
(2) when the signature is entered, its creation data are controlled only by the electronic signatory;
(3) after the signature is entered, any alteration made to the electronic signature can be detected; and
(4) after the signature is entered, any alteration made to the contents and form of a data message can be detected.
The parties concerned may also choose to use the electronic signatures which meet the conditions of
5
reliability they have agreed to.
Article 14
A reliable electronic signature shall have equal legal force with handwritten signature or the seal.
Article 15
An electronic signatory shall have the creation data of his electronic signature well preserved. When an electronic signatory learns that the creation data of his electronic signature have got lost or may have got lost, he shall make it known to all the parties concerned in time, and terminate the use of such data.
Article 16
If an electronic signature needs to be verified by a third party, the electronic verification service established according to law shall provide such service.
Article 17
An electronic verification service shall meet the following conditions:
(1) having the professional technicians and managerial personnel suited for provision of electronic verification services;
(2) having the funds and business places suited for provision of electronic verification services;
(3) having the technology and equipment complying with the safety standards of the State;
(4) having the certificates for the use of the codes approved by the code control institution of the State; and
(5) other conditions prescribed by laws and administrative regulations.
Article 18
A person that intends to engage in electronic verification service shall make an application to the department in charge of the information industry under the State Council and submits the materials proving fulfillment of the conditions as specified by Article 17 of this Law. Upon receiving the application, the department in charge of the information industry under the State Council shall examine it according to law and consult with the department in charge of commerce and other relevant departments under the State Council, before making a decision on whether to grant or deny approval within 45 days from the date it receives the application. If it grants approval, it shall issue the license of electronic verification;
6
and if it denies approval, it shall inform the applicant in writing of the fact and of the reasons why.
The applicant shall, upon the strength of the license of electronic verification, go through the formalities for enterprise registration at the administrative department for industry and commerce according to law.
The electronic verification service that has been qualified for verification shall, in accordance with the regulations of the department in charge of the information industry under the State Council, make public in the Internet such information as its name and the number of its license.
Article 19
The electronic verification service shall formulate and publish its rules for electronic verification, which are in conformity with the relevant regulations of the State, and submit them to the department in charge of the information industry under the State Council for the record.
The rules for electronic verification shall include the matters such as the scope of liability, the norms for operation and the protective measures for information safety.
Article 20
When an electronic signatory applies to an electronic verification service for the certificate of his electronic signature, he shall provide truthful, complete and accurate information.
Upon receiving the application for certificate of the electronic signature, the electronic verification service shall check the identity of the applicant and examine the relevant materials.
Article 21
The certificate of an electronic signature issued by the electronic verification service shall be accurate and devoid of error, and the following items shall clearly be stated therein:
(1) the name of the electronic verification service;
(2) the name of the certificate holder;
(3) the serial number of the certificate;
(4) the term of validity for the certificate;
(5) the validation data of the electronic signature of the certificate holder;
(6) the electronic signature of the electronic verification service; and
7
(7) other items as prescribed by the department in charge of the information industry under the State Council.
Article 22
An electronic verification service shall guarantee that the items in the certificate of an electronic signature are complete and accurate within the term of its validity, and guarantee the party relying on the electronic signature the ability to prove or to know the items stated in the certificate of the electronic signature and other relevant matters.
Article 23
If an electronic verification service intends to suspend or terminate the service, it shall, 90 days prior to the suspension or termination of service, notify the parties concerned of how to get continued services and of other relevant matters.
If an electronic verification service intends to suspend or terminate the service, it shall report to the department in charge of the information industry under the State Council 60 days prior to the suspension or termination of service, and shall make proper arrangements by negotiating with other electronic verification services on how to carry on its business.
If an electronic verification service fails to reach an agreement with other electronic verification services on matters of how to carry on its business, it shall apply to the department in charge of the information industry under the State Council for arranging other electronic verification services to carry on its business.
If the license of electronic verification of an electronic verification service is revoked according to law, its business shall be carried on in accordance with the regulations of the department in charge of the information industry under the State Council.
Article 24
An electronic verification service shall have the information relating to verification well preserved. The time limit for preservation of such information shall at least be five years after the certificate of the electronic signature ceases to be valid.
Article 25
The department in charge of the information industry under the State Council shall, in accordance with this Law, formulate the specific measures for administration of the electronic verification services and exercise supervision over the electronic verification services according to law.
Article 26
8
Upon examination and approval by the department in charge of the information industry under the State Council on the basis of relevant agreements or the principle of reciprocity, the certificates of electronic signatures issued by overseas electronic verification services outside of the territory of the People's Republic of China shall have equal legal force with the ones issued by the electronic verification services established in accordance with this Law.
Chapter IV Legal Responsibility
Article 27
An electronic signatory who, having learnt that the creation data of his electronic signature have got lost or might have got lost, fails to notify in time the parties concerned of the fact and to terminate the use of the same, who fails to provide the electronic verification service with truthful, complete and accurate information, or who makes other errors, thus causing losses to the party relying on the electronic signature and to the electronic verification service, shall bear the responsibility for compensation.
Article 28
Where an electronic signatory or the party relying on the electronic signature suffers losses due to engaging in civil activities on the basis of the electronic signature verified by an electronic verification service, and if the electronic verification service fails to prove that it is free from fault, the service shall bear the responsibility for compensation.
Article 29
Where a person provides electronic verification services without permission, the department in charge of the information industry under the State Council shall order him to desist from the illegal act; the unlawful gains, if any, shall be confiscated; if such gains exceed RMB 300,000 yuan, a fine of not less than one time but not more than three times the unlawful gains shall be imposed; and if there are no unlawful gains or the amount of such gains is less than 300,000 yuan, a fine of not less than 100,000 yuan but not more than 300,000 yuan shall be imposed.
Article 30
Where an electronic verification service that intends to suspend or terminate electronic verification services fails to report to the department in charge of the information industry under the State Council 60 days prior to the suspension or termination of service, the said department shall impose a fine of not less than 10,000 yuan but not more than 50,000 yuan on the person who is directly in charge of the service.
Article 31
Where an electronic verification service fails to observe the rules for verification, fails to have the information relating to verification well preserved, or commits other illegal acts, the department in charge of the information industry under the State Council shall order it to rectify within a time limit; if it fails to
9
comply at the expiration of the time limit, its electronic verification license shall be revoked, and the persons who are directly in charge of the service and the other persons who are directly responsible shall be prohibited from engaging in electronic verification services within the period of 10 years. If an electronic verification license is revoked, the fact shall be made known to the public and the administrative department for industry and commerce shall be informed of the same.
Article 32
Where a person counterfeits, copies or usurps the electronic signature of another person's, which constitutes a crime, his criminal responsibility shall be investigated according to law; and if losses are caused to another person, he shall bear civil responsibility according to law.
Article 33
Where a staff member of the department in charge of supervision and administration over the electronic verification industry in accordance with this Law fails to perform his duties of granting administrative license and exercising supervision and administration according to law, he shall be given an administrative sanction according to law; and if a crime is constituted, he shall be investigated for the criminal responsibility according to law.
Chapter V Supplementary Provisions
Article 34
The meanings of the following terms used in this Law are:
(1) the electronic signatory means a person who holds the creation data of an electronic signature and produces the electronic signature either in person or on behalf of the person he represents;
(2) the relying party on the electronic signature means the person who engages in relevant activities on the basis of his trust in the certificate of the electronic signature or the electronic signature;
(3) the certificate of the electronic signature means a data message or other electronic records that can prove the connection between the electronic signatory and the creation data of the electronic signature;
(4) the creation data of an electronic signature means such data as the characters and codes that are used in the course of the electronic signature and that reliably connects the electronic signature with the electronic signatory; and
(5) the validation data of an electronic signature means the data used for verifying the electronic signature, including the code, password, algorithm and public key.
Article 35
10
The State Council or the departments specified by the State Council may, in accordance with this Law, formulate specific measures for the use of the electronic signatures and data messages in administrative and other public activities.
Article 36
This Law shall go into effect as of April 1, 2005.
中华人民共和国电子签名法
- 第一章 总
-
则
第一条 为了规范电子签名行为，确立电子签名的法律效力，维护有关各方的合法权益，制定本法。
第二条 本法所称电子签名，是指数据电文中以电子形式所含、所附用于识别签名人身份并表明签名人认可其中内容的数据。
本法所称数据电文，是指以电子、光学、磁或者类似手段生成、发送、接收或者储存的信息。
第三条 民事活动中的合同或者其他文件、单证等文书，当事人可以约定使用或者不使用电子签名、数据电文。
当事人约定使用电子签名、数据电文的文书，不得仅因为其采用电子签名、数据电文的形式而否定其法律效力。
前款规定不适用下列文书：
（一）涉及婚姻、收养、继承等人身关系的；
（二）涉及土地、房屋等不动产权益转让的；
（三）涉及停止供水、供热、供气、供电等公用事业服务的；
（四）法律、行政法规规定的不适用电子文书的其他情形。
- 第二章 数
-
据电文
第四条 能够有形地表现所载内容，并可以随时调取查用的数据电文，视为符合法律、法规要求的书面形式。
第五条 符合下列条件的数据电文，视为满足法律、法规规定的原件形式要求：
（一）能够有效地表现所载内容并可供随时调取查用；
（二）能够可靠地保证自最终形成时起，内容保持完整、未被更改。但是，在数据电文上增加背书以及数据交换、储存和显示过程中发生的形式变化不影响数据电文的完整性。
第六条 符合下列条件的数据电文，视为满足法律、法规规定的文件保存要求：
（一）能够有效地表现所载内容并可供随时调取查用；
（二）数据电文的格式与其生成、发送或者接收时的格式相同，或者格式不相同但是能够准确表现原来生成、发送或者接收的内容；
（三）能够识别数据电文的发件人、收件人以及发送、接收的时间。
第七条 数据电文不得仅因为其是以电子、光学、磁或者类似手段生成、发送、接收或者储存的而被拒绝作为证据使用。
第八条 审查数据电文作为证据的真实性，应当考虑以下因素：
（一）生成、储存或者传递数据电文方法的可靠性；
（二）保持内容完整性方法的可靠性；
（三）用以鉴别发件人方法的可靠性；
（四）其他相关因素。
第九条 数据电文有下列情形之一的，视为发件人发送：
（一）经发件人授权发送的；
（二）发件人的信息系统自动发送的；
（三）收件人按照发件人认可的方法对数据电文进行验证后结果相符的。
当事人对前款规定的事项另有约定的，从其约定。
第十条 法律、行政法规规定或者当事人约定数据电文需要确认收讫的，应当确认收讫。发件人收到收件人的收讫确认时，数据电文视为已经收到。
第十一条 数据电文进入发件人控制之外的某个信息系统的时间，视为该数据电文的发送时间。
收件人指定特定系统接收数据电文的，数据电文进入该特定系统的时间，视为该数据电文的接收时间；未指定特定系统的，数据电文进入收件人的任何系统的首次时间，视为该数据电文的接收时间。
当事人对数据电文的发送时间、接收时间另有约定的，从其约定。
第十二条 发件人的主营业地为数据电文的发送地点，收件人的主营业地为数据电文的接收地点。没有主营业地的，其经常居住地为发送或者接收地点。
当事人对数据电文的发送地点、接收地点另有约定的，从其约定。
- 第三章 电
-
子签名与认证
第十三条 电子签名同时符合下列条件的，视为可靠的电子签名：
（一）电子签名制作数据用于电子签名时，属于电子签名人专有；
（二）签署时电子签名制作数据仅由电子签名人控制；
（三）签署后对电子签名的任何改动能够被发现；
（四）签署后对数据电文内容和形式的任何改动能够被发现。
当事人也可以选择使用符合其约定的可靠条件的电子签名。
第十四条 可靠的电子签名与手写签名或者盖章具有同等的法律效力。
第十五条 电子签名人应当妥善保管电子签名制作数据。电子签名人知悉电子签名制作数据已经失密或者可能已经失密时，应当及时告知有关各方，并终止使用该电子签名制作数据。
第十六条 电子签名需要第三方认证的，由依法设立的电子认证服务提供者提供认证服务。
第十七条 提供电子认证服务，应当具备下列条件：
（一）具有与提供电子认证服务相适应的专业技术人员和管理人员；
（二）具有与提供电子认证服务相适应的资金和经营场所；
（三）具有符合国家安全标准的技术和设备；
（四）具有国家密码管理机构同意使用密码的证明文件；
（五）法律、行政法规规定的其他条件。
第十八条 从事电子认证服务，应当向国务院信息产业主管部门提出申请，并提交符合本法第十七条规定条件的相关材料。国务院信息产业主管部门接到申请后经依法审查，征求国务院商务主管部门等有关部门的意见后，自接到申请之日起四十五日内作出许可或者不予许可的决定。予以许可的，颁发电子认证许可证书；不予许可的，应当书面通知申请人并告知理由。
申请人应当持电子认证许可证书依法向工商行政管理部门办理企业登记手续。
取得认证资格的电子认证服务提供者，应当按照国务院信息产业主管部门的规定在互联网上公布其名称、许可证号等信息。
第十九条 电子认证服务提供者应当制定、公布符合国家有关规定的电子认证业务规则，并向国务院信息产业主管部门备案。
电子认证业务规则应当包括责任范围、作业操作规范、信息安全保障措施等事项。
第二十条 电子签名人向电子认证服务提供者申请电子签名认证证书，应当提供真实、完整和准确的信息。
电子认证服务提供者收到电子签名认证证书申请后，应当对申请人的身份进行查验，并对有关材料进行审查。
第二十一条 电子认证服务提供者签发的电子签名认证证书应当准确无误，并应当载明下列内容：
（一）电子认证服务提供者名称；
（二）证书持有人名称；
（三）证书序列号；
（四）证书有效期；
（五）证书持有人的电子签名验证数据；
（六）电子认证服务提供者的电子签名；
（七）国务院信息产业主管部门规定的其他内容。
- 第一章 总
-
则
第一条 为了规范电子签名行为，确立电子签名的法律效力，维护有关各方的合法权益，制定本法。
第二条 本法所称电子签名，是指数据电文中以电子形式所含、所附用于识别签名人身份并表明签名人认可其中内容的数据。
本法所称数据电文，是指以电子、光学、磁或者类似手段生成、发送、接收或者储存的信息。
第三条 民事活动中的合同或者其他文件、单证等文书，当事人可以约定使用或者不使用电子签名、数据电文。
当事人约定使用电子签名、数据电文的文书，不得仅因为其采用电子签名、数据电文的形式而否定其法律效力。
前款规定不适用下列文书：
（一）涉及婚姻、收养、继承等人身关系的；
（二）涉及土地、房屋等不动产权益转让的；
（三）涉及停止供水、供热、供气、供电等公用事业服务的；
（四）法律、行政法规规定的不适用电子文书的其他情形。
据电文
第四条 能够有形地表现所载内容，并可以随时调取查用的数据电文，视为符合法律、法规要求的书面形式。
第五条 符合下列条件的数据电文，视为满足法律、法规规定的原件形式要求：
（一）能够有效地表现所载内容并可供随时调取查用；
（二）能够可靠地保证自最终形成时起，内容保持完整、未被更改。但是，在数据电文上增加背书以及数据交换、储存和显示过程中发生的形式变化不影响数据电文的完整性。
第六条 符合下列条件的数据电文，视为满足法律、法规规定的文件保存要求：
（一）能够有效地表现所载内容并可供随时调取查用；
（二）数据电文的格式与其生成、发送或者接收时的格式相同，或者格式不相同但是能够准确表现原来生成、发送或者接收的内容；
（三）能够识别数据电文的发件人、收件人以及发送、接收的时间。
第七条 数据电文不得仅因为其是以电子、光学、磁或者类似手段生成、发送、接收或者储存的而被拒绝作为证据使用。
第八条 审查数据电文作为证据的真实性，应当考虑以下因素：
（一）生成、储存或者传递数据电文方法的可靠性；
（二）保持内容完整性方法的可靠性；
（三）用以鉴别发件人方法的可靠性；
（四）其他相关因素。
第九条 数据电文有下列情形之一的，视为发件人发送：
（一）经发件人授权发送的；
（二）发件人的信息系统自动发送的；
（三）收件人按照发件人认可的方法对数据电文进行验证后结果相符的。
当事人对前款规定的事项另有约定的，从其约定。
第十条 法律、行政法规规定或者当事人约定数据电文需要确认收讫的，应当确认收讫。发件人收到收件人的收讫确认时，数据电文视为已经收到。
第十一条 数据电文进入发件人控制之外的某个信息系统的时间，视为该数据电文的发送时间。
收件人指定特定系统接收数据电文的，数据电文进入该特定系统的时间，视为该数据电文的接收时间；未指定特定系统的，数据电文进入收件人的任何系统的首次时间，视为该数据电文的接收时间。
当事人对数据电文的发送时间、接收时间另有约定的，从其约定。
第十二条 发件人的主营业地为数据电文的发送地点，收件人的主营业地为数据电文的接收地点。没有主营业地的，其经常居住地为发送或者接收地点。
当事人对数据电文的发送地点、接收地点另有约定的，从其约定。
子签名与认证
第十三条 电子签名同时符合下列条件的，视为可靠的电子签名：
（一）电子签名制作数据用于电子签名时，属于电子签名人专有；
（二）签署时电子签名制作数据仅由电子签名人控制；
（三）签署后对电子签名的任何改动能够被发现；
（四）签署后对数据电文内容和形式的任何改动能够被发现。
当事人也可以选择使用符合其约定的可靠条件的电子签名。
第十四条 可靠的电子签名与手写签名或者盖章具有同等的法律效力。
第十五条 电子签名人应当妥善保管电子签名制作数据。电子签名人知悉电子签名制作数据已经失密或者可能已经失密时，应当及时告知有关各方，并终止使用该电子签名制作数据。
第十六条 电子签名需要第三方认证的，由依法设立的电子认证服务提供者提供认证服务。
第十七条 提供电子认证服务，应当具备下列条件：
（一）具有与提供电子认证服务相适应的专业技术人员和管理人员；
（二）具有与提供电子认证服务相适应的资金和经营场所；
（三）具有符合国家安全标准的技术和设备；
（四）具有国家密码管理机构同意使用密码的证明文件；
（五）法律、行政法规规定的其他条件。
第十八条 从事电子认证服务，应当向国务院信息产业主管部门提出申请，并提交符合本法第十七条规定条件的相关材料。国务院信息产业主管部门接到申请后经依法审查，征求国务院商务主管部门等有关部门的意见后，自接到申请之日起四十五日内作出许可或者不予许可的决定。予以许可的，颁发电子认证许可证书；不予许可的，应当书面通知申请人并告知理由。
申请人应当持电子认证许可证书依法向工商行政管理部门办理企业登记手续。
取得认证资格的电子认证服务提供者，应当按照国务院信息产业主管部门的规定在互联网上公布其名称、许可证号等信息。
第十九条 电子认证服务提供者应当制定、公布符合国家有关规定的电子认证业务规则，并向国务院信息产业主管部门备案。
电子认证业务规则应当包括责任范围、作业操作规范、信息安全保障措施等事项。
第二十条 电子签名人向电子认证服务提供者申请电子签名认证证书，应当提供真实、完整和准确的信息。
电子认证服务提供者收到电子签名认证证书申请后，应当对申请人的身份进行查验，并对有关材料进行审查。
第二十一条 电子认证服务提供者签发的电子签名认证证书应当准确无误，并应当载明下列内容：
（一）电子认证服务提供者名称；
（二）证书持有人名称；
（三）证书序列号；
（四）证书有效期；
（五）证书持有人的电子签名验证数据；
（六）电子认证服务提供者的电子签名；
（七）国务院信息产业主管部门规定的其他内容。