GDPR and Digital Signatures — What You Need to Know

What Is GDPR?

GDPR (General Data Protection Regulation) is the European Union's general data protection regulation. The regulations entered into force in May 2018 and define strict rules for the processing, storage, and use of personal data of EU citizens.

It is important to understand: GDPR also applies to Israeli companies that process data of EU citizens. If you have clients, employees, suppliers, or business partners from Europe — you must comply with GDPR. Penalties for GDPR violations can reach 20 million euros or 4% of annual turnover.

How GDPR Affects Digital Signatures

When using a digital signature, personal data is collected — names, email addresses, IP addresses, timestamps, and sometimes phone numbers. All of this data is protected under GDPR and must be handled accordingly.

Here are the key GDPR requirements relevant to digital signatures:

1. Lawful Basis for Processing

All processing of personal data requires a legal basis. In the context of digital signatures, the most common basis is contract performance (Article 6(1)(b)) — that is, processing the data is required to execute the contract being signed. Alternatively, you can rely on explicit consent (Article 6(1)(a)).

2. Data Minimization

Only collect the information necessary for the signing process — nothing more. If a name and email are sufficient to identify the signer, do not require additional information without justification.

3. Transparency

Signers need to know what data is being collected, why, and what happens to it. A clear and accessible privacy policy is mandatory.

4. Data Security

Appropriate security measures must be implemented to protect personal data: encryption, access controls, backups, and prevention of unauthorized access.

5. Data Subject Rights

Data subjects (signers) have rights that must be respected:

• Right of access: The right to know what data is stored.
• Right of rectification: The right to correct inaccurate data.
• Right of erasure: The right to request deletion of personal data (the "right to be forgotten").
• Right of portability: The right to receive data in a digital format.

Note: The right to erasure does not always apply to signed documents, because there is a legitimate need to retain them as evidence. However, personal data that is not part of the document itself can be deleted.

Compliance Checklist

To ensure your use of digital signatures complies with GDPR, here is a checklist:

1. Do you have a legal basis for processing the data of signers?
2. Does your privacy policy cover the digital signing process?
3. Are you collecting only the necessary information?
4. Does your platform provide appropriate encryption?
5. Do you have a DPA (Data Processing Agreement) with your digital signature provider?
6. Can you honor rights of access, rectification, and erasure?
7. Do you have a process for reporting data breaches within 72 hours?
8. Does your audit trail document all processing operations?

SignFlow and GDPR Compliance

SignFlow was designed from the ground up with GDPR compliance. Here is how the platform meets the requirements:

• Data minimization: Collects only name, email, and signature — the minimum required for the process.
• Encryption: AES-256 for storage, TLS 1.3 for transmission.
• Access controls: Role-based permissions, two-factor authentication.
• Right to erasure: Personal data deletion mechanism available.
• DPA: Data Processing Agreement available for all clients.
• Audit trail: Full documentation of all processing operations.
• Retention policy: Clear policy on how long data is retained.

GDPR vs. Israeli Privacy Protection Law

Israel has its own Privacy Protection Law (1981) with data security regulations. The Israeli law is similar to GDPR in many respects, but GDPR is stricter in certain areas (such as penalties, right of portability, and the obligation to appoint a DPO).

An Israeli business that complies with GDPR generally also complies with Israeli law. Therefore, adopting the GDPR standard is a smart approach that ensures compliance with both regulations.

Practical Tips

1. Choose a compliant platform: Make sure your digital signature provider (like SignFlow) complies with GDPR.
2. Update your privacy policy: Make sure your privacy policy covers the use of digital signatures.
3. Sign a DPA: Make sure you have a data processing agreement with your signature provider.
4. Train your team: Make sure the team knows what is and is not permitted under GDPR.
5. Document everything: Keep documentation of all data processing operations.

For more details on security and privacy in SignFlow, or contact our team.

Frequently Asked Questions