Law of the People's Republic of China on Electronic Signatures (Revised in 2015)

Order of the President of the People's Republic of China No.24

April 24, 2015

(Adopted during the 11th meeting of the Standing Committee of the 10th National People's Congress of the People's Republic of China on August 28, 2004, and amended according to the Decision on Revising Six Laws including the Electric Power Law of the People's Republic of China passed at the 14th meeting of the Standing Committee of the 12th National People's Congress of the People's Republic of China on April 24, 2015)

Table of Contents
Chapter I General Provisions
Chapter II Electronic Data
Chapter III Electronic Signatures and Certification
Chapter IV Legal Liabilities
Chapter V Supplementary Provisions

Chapter I General Provisions

Article 1 This Law is enacted in order to regulate the conduct of electronic signatures, establish the legal effect of electronic signatures, and protect the lawful rights and interests of relevant parties.

Article 2 "Electronic Signatures," as mentioned in this Law, shall refer to the data included and attached, in electronic form, in electronic data for the use of identifying the signatory, and for verifying that the signatory has acknowledged the content therein.
"Electronic Data," as mentioned in this Law, shall refer to information created, sent, received or stored by electronic, optical, magnetic or simlar means.

Article 3 The parties may stipulate the use, or non-use, of electronic signatures or electronic data in a contract or other documents and documentations in civil activities.
The legal effect of any document that uses electronic signatures and/or electronic data, as stipulated by the parties, shall not be denied simply because it takes the form of an electronic signature and/or electronic data.
The above-mentioned provisions shall not apply to the following documents:
1. Documents concerning personal relations, such as marriage, adoption and succession, etc.;
2. Documents concerning transfers of real estate rights and interests, such as land and property, etc.;
3. Documents concerning the termination of water supplies, heat supplies, gas supplies, power supplies or other public-utility services; and
4. Other circumstances, under which electronic documents do not apply, as prescribed by laws and administrative regulations.

Chapter II Electronic Data

Article 4 Any electronic data that can show, in material form, the contents that it specifies, and which may be accessed and used at any time, shall be regarded as complying with the written form as prescribed by laws and regulations.

Article 5 Electronic data that meet the following requirements shall be deemed to have satisfied the requirements for the form of original copies as prescribed by laws and regulations:
1. Electronic data that are capable of effectively showing the contents they specify, and which may be accessed and used at any time; and
2. Electronic data that are capable of unfailingly ensuring that the contents are complete and unaltered, from the time when they finally come into being. But the integrity of electronic data will not be influenced by the addition of endorsement to the electronic data and/or alterations of forms that occurs during the course of data interchanges, storage and displays.

Article 6 Any electronic data that meets the following requirements shall be deemed to satisfy the requirements for document preservation, as prescribed by laws and regulations:
1. Being capable of effectively showing the contents it specifies, and which may be accessed for reference and used at any time;
2. The format of the electronic data is the same as the format when it was created, sent or received, or the format is not the same but accurately reflects the contents originally created, sent, or received; and
3. Being capable of identifying the addressor and/or the addressee of the electronic data, and the time that the message was sent and received.

Article 7 No electronic data may be rejected for being used as evidence simply because it was created, sent, received or stored via
electronic, optical, magnetic or other similar means.

Article 8 The following factors shall be taken into consideration when examining the truthfulness of any electronic data as evidence:
1. The reliability of the methods used when creating, storing or transmitting the electronic data;
2. The reliability of the methods used to maintain the integrity of the contents;
3. The reliability of the methods used to identify the addressor and
4. Other relevant factors.

Article 9 Under any of the following circumstances, electronic data shall be regarded as having been sent by the
addressor:
1. Being sent upon the authorization of the addressor;
2. Being sent automatically by the information system of the addressor; or
3. The addressee finds that the consequence complies, upon examination, with the validation on the electronic data, in accordance with the method approved by the addressor.
Unless there are different stipulations by the parties on the matters prescribed in the preceding paragraph, the stipulations shall be followed.

Article 10 In the event the receipt of electronic data must be confirmed as prescribed by laws and administrative regulations or pursuant to an agreement between the parties, the receipt shall be confirmed. If an addresser has received a confirmation of receipt by the addressee, the electronic data shall be regarded as having been received.

Article 11 The time when any electronic data enters into a certain information system, outside the control of the addresser, shall be regarded as the time the electronic data was sent.
In the event an addressee has designated a given system for the receipt of electronic data, the time when the electronic data enters into the given system shall be regarded as the time the electronic data was received. If no given system has been designated, the time when the electronic data enters into a system of the addressee for the first time shall be regarded as the time the electronic data was received
In the event the parties have different stipulations on the time for sending and receiving the electronic data, the stipulations shall be followed.

Article 12 The main place of business of the addresser shall be the place for sending the electronic data, the main place of business of the addressee shall be the place for receiving the electronic data. If there is no main place of business, the habitual residence shall be the respective sending or receiving place.
Unless there are different stipulations by the parties on the place for sending and/or receiving the electronic data, the stipulations shall be followed.

Chapter III Electronic Signatures and Certification

Article 13 If an electronic signature complies with the following conditions, it shall be regarded as a reliable electronic signature:
1. If data made by electronic signature is used for the electronic signature, and if it is owned exclusively by the electronic signatory;
2. The data made by electronic signature is controlled only by the electronic signatory, at the time of signing;
3. Any alteration to the electronic signature, after signing, can be determined; and
4. Any alteration to the contents and form of any electronic data can be determined after signing.
The parties may also choose to use an electronic signature with reliable conditions, which complies with their stipulations.

Article 14 A reliable electronic signature shall have the same legal effect as seal or signature by hand.

Article 15 An electronic signatory shall properly maintain data made by electronic signature. In the event an electronic signatory realizes that data made by electronic signature has revealed official secrets or may reveal official secrets, he/she shall notify the relevant parties in time, and he/she shall terminate the use of the data.

Article 16 In the event there is a need for an electronic signature to be certified by a third party, the certification service shall be provided by a legally established electronic certification service provider.

Article 17 The following conditions shall be met when providing electronic certification services:
1. Having obtained corporate capacity;
2. Having professional technicians and managers who are suited to provide electronic certification services;
3. Having capital and a place of business that meets the requirements for providing electronic certification services;
4. Having technology and equipment that comply with the national safety and technology standards;
5. Having certification documents that use codes that have been approved by the state code administration organ; and
6. Other conditions, as prescribed by laws and administrative regulations.

Article 18 Applicants who are to undertake electronic certification services shall file applications to the department of information industry of the State Council, and shall submit relevant documents as prescribed in Article 17 of this Law. The department of information industry of the State Council shall conduct an examination, in accordance with the law, after the application is accepted, and shall decide whether to approve or reject the application within 45 days from the date when the application is accepted, after it has solicited opinions from the commerce department of the State Council and other relevant departments. If permission is granted, an electronic certification licensing certificate shall be issued. If permission is rejected, the applicant shall be notified in writing and the reasons shall be explained.
An applicant shall complete formalities for enterprise registration at the administrative department for industry and commerce, in accordance with the law, upon the strength of electronic certification licensing certificate.

Article 19 An electronic certification service provider shall formulate and promulgate the electronic certification business rules that comply with relevant state provisions, and shall record them at the department of information industry of the State Council.
Electronic certification business rules shall cover the scope of liabilities, working operational specifications, information safeguard measures and other relevant matters.

Article 20 In the event an electronic signatory provides an electronic signature certification certificate to an electronic certification service provider, he/she shall provide true, complete and accurate information.
After receiving an application for an electronic signature certification certificate, an electronic certification service provider shall check the identity of the applicant and examine relevant materials.

Article 21 An electronic signature certification certificate, signed by an electronic certification service provider, shall be accurate and have no mistakes, and shall specify the following contents:
1. Name of the electronic certification service provider;
2. Name of the certificate holder;
3. Serial number of the certificate;
4. Period of validity of the certificate;
5. Electronic signature validation data of the certificate holder;
6. Electronic signature of the electronic certification service provider; and
7. Other contents, as prescribed by the department of information industry of the State Council.

Article 22 An electronic certification service provider shall ensure the contents of an electronic signature certification certificate are complete and accurate within the period of validity, and he/she shall ensure the party depending on the electronic signature is able to prove, or know, the contents specified in the electronic certification certificate, and other relevant matters.

Article 23 In the event an electronic certification service provider intends to suspend or terminate his/her/its electronic certification service, he/she/it shall notify relevant parties of the carrying-on of business and other relevant matters 90 days prior to the suspension or termination of the service.
In the event an electronic certification service provider intends to suspend or terminate his/her/its electronic certification service, he/she/it shall report the situation to the department of information industry of the State Council 60 days prior to suspending or terminating the service, and shall negotiate with another electronic certification service provider to carry-on the business.
In the event an electronic certification service provider fails to reach an agreement on the carrying-on of business with another electronic certification service provider, he/she/it shall apply to the department of information industry of the State Council to arrange another electronic certification service provider to carry-on its business.
In the event an electronic certification service provider's qualifications are revoked by the electronic certification licensing certificate, the carrying-on its business and other matters shall be handled in accordance with the provisions of the department of information industry of the State Council.

Article 24 An electronic certification service provider shall properly maintain information related to certification. The time limit for keeping the information shall be at least 5 years after the invalidation of the electronic signature certification certificate.

Article 25 The department of information industry of the State Council shall supervise electronic certification service providers, in accordance with law regulating the administration of the electronic certification service industry.

Article 26 Upon the approval of the department of information industry of the State Council, and in light of relevant agreements and/or the principle of reciprocity, any electronic signature certification certificate issued overseas, by any electronic certification service provider outside the territory of the People's Republic of China, shall have the same legal effect as an electronic certification certificate issued by the electronic certification service provider established under this Law.

Chapter IV Legal Liabilities

Article 27 In the event an electronic signatory knows that any data made by electronic signature has revealed official secrets, or may reveal official secrets, but fails to notify relevant parties and terminate the use of the data, or fails to provide truthful, complete and accurate information to the electronic service provider, or has any other fault, which harms the party depending on electronic signature and/or the electronic certification service provider, he/she/it shall be liable for compensation.

Article 28 If an electronic signatory, or any party depending on the electronic signature, suffers losses due to undertaking civil activities on the basis of the electronic signature certification service provided by any electronic certification service provider, and if the electronic certification service provider cannot prove that he/she/it is without blame, he/she/it shall be liable for compensation.

Article 29 In the event anyone provides electronic certification services without approval, the department of information industry of the State Council shall order it to stop the illegal acts; if there are any illegal gains, the illegal gains shall be confiscated; if the illegal gains exceed CNY300,000, he/she/it shall be fined one time up to three times the illegal gains. If he/she/it has not earned illegal gains, or if the illegal gains are less than CNY300,000, he/she/it shall be fined CNY100,000 to CNY300,000.

Article 30 In the event an electronic certification service provider suspends or terminates his/her/its electronic certification service, but fails to report the situation to the department of information industry of the State Council within 60 days prior to the suspension or termination of the service, the department of information industry of the State Council shall impose a fine of CNY10,000 to CNY50,000 on the person directly in charge.

Article 31 In the event an electronic certification service provider does not abide by the certification business rules, fails to properly maintain information related to certification, or commits any other illegal acts, the department of information industry of the State Council may order it to correct the situation within a prescribed time limit; if it fails to correct the situation within the time limit, its electronic certification licensing certificate shall be revoked, and the person directly in charge, and other persons directly liable, shall be banned from undertaking electronic certification service for 10 years. If an electronic certification licensing certificate is revoked, a public notice shall be issued, and the administrative department for industry and commerce shall be notified.

Article 32 In the event anyone forges, falsely uses or embezzles electronic signatures of others and commits a crime, he/she/it shall be subject to criminal liability. If the act harms others, he/she/it shall undertake civil liabilities.

Article 33 In accordance with this Law, if any staff member of the department taking charge of the work for the supervision of electronic certification service fails to perform the duties of administrative license and supervision, he/she/it shall be subject to administrative punishment. If a crime has been committed, he/she/it shall be subject to criminal liability.

Chapter V Supplementary Provisions

Article 34 The following words in this Law shall have the following meanings:
1. "Electronic Signatory" shall refer to the person who holds data made by an electronic signature, and who implements the electronic signature in his/her identity, or on behalf of the person he/she represents;
2. "Party Depending on Electronic Signature" shall refer to the person who undertakes relevant activities, on the basis of his/her trust of an electronic signature certification certificate or electronic signature;
3. "Electronic Signature Certification Certificate" shall refer to the electronic data, or other electronic records, that can prove an electronic signatory has a connection with the data made by electronic signature;
4. "Data Made by Electronic Signature" shall refer to data such as the character, coding, etc., used in the course of electronic signature, and which can connect the electronic signature with the electronic signatory; and
5. "Electronic Signature Validation Data" shall refer to the data used for validating electronic signature, including codes, passwords, arithmetic or public keys, etc.

Article 35 The State Council, or departments designated by the State Council, may formulate concrete measures for the use of electronic signatures and electronic data used in governmental affairs and other social activities, in accordance with this Law.

Article 36 This Law shall come into effect as of April 1, 2005.