Security
Digital vs electronic signature: which does the law require?
An electronic signature is any electronic sign of agreement, such as a typed name, a drawn signature or a click. A digital signature is a specific technology: a cryptographic signature tied to a certificate from a certificate authority. Most laws accept a simple electronic signature for ordinary contracts, but some countries (for example India, Bangladesh and Turkey) give full legal effect mainly to certificate-based signatures, and tiered systems such as the EU's reserve handwritten-equivalent status for qualified signatures.
Someone has asked you for a "digital signature", or a form says "electronically signed documents accepted", and you are not sure whether typing your name, drawing on a screen or clicking a link is enough. The words are used loosely, even by officials. The law is usually more precise, and it differs a lot from one country to the next.
The short answer
- Electronic signature is the broad category: any electronic data a person uses to sign, from a typed name to a click-to-sign button.
- Digital signature is one technology within that category: a cryptographic signature made with a private key and a certificate issued by a certificate authority (CA). It also proves the document has not changed since signing.
- Most countries accept ordinary electronic signatures for most contracts. You need a certificate-based signature only where a specific law, regulator or office says so, or in countries whose law is built around certificates.
- The label someone uses is less important than the rule that applies to your document. Ask "what signature does the receiving office or the law require?", not "is it digital?"
The vocabulary
Simple electronic signature (SES). Any electronic signature that does not meet a higher standard. A typed name, a scanned signature image, a signature drawn with a mouse, or clicking "I agree" in an email-linked signing flow. Its strength comes from the evidence around it: who received the link, when, from what device.
Advanced electronic signature (AdES or AES). A term from the EU's eIDAS Regulation, copied in many other laws. It must be uniquely linked to the signer, capable of identifying them, created with data under their sole control, and linked to the document so that any later change is detectable. In practice, this usually means a certificate-based digital signature, although other technologies can qualify.
Qualified electronic signature (QES). An advanced signature made with a qualified certificate from a qualified trust service provider, using a qualified signature creation device (a smart card, USB token or certified remote signing service). In the EU it has the same legal effect as a handwritten signature.
Digital signature (PKI). The technical term for a signature based on public key infrastructure: a private key signs, a certificate binds the matching public key to a named person, and anyone can check the signature. Some national laws use "digital signature" as their legal term for exactly this, and give it special status.
Certificate authority (CA) or trust service provider. The organisation that checks your identity and issues your certificate. In many countries CAs must be licensed or accredited by a government body before their signatures get special legal effect.
Three families of signature law
1. Tiered systems (EU, UK, UAE, Brazil)
The EU's eIDAS Regulation (Regulation (EU) No 910/2014, updated by Regulation (EU) 2024/1183) says an electronic signature cannot be denied legal effect just because it is electronic, and that a qualified electronic signature has the equivalent legal effect of a handwritten signature. Member states then decide where their own form rules need a QES. Germany, for example, treats a QES as satisfying statutory written form under section 126a of its Civil Code, but excludes electronic form for some documents such as a termination of employment. Italy requires a qualified or digital signature for electronic contracts transferring real property.
The UK kept the same tiers after Brexit, but English law is very flexible: under the Electronic Communications Act 2000 and case law, most documents can be signed with a simple e-signature, and qualified signatures are rarely required. The UAE's Decree-Law No. 46 of 2021 uses electronic, reliable and qualified tiers, and states that a qualified signature is equal to a handwritten one. Brazil's Law 14.063 of 2020 created simple, advanced and qualified tiers, where qualified means an ICP-Brasil certificate.
2. Technology-neutral systems (US, Canada, Australia, Singapore, UK in practice)
The US ESIGN Act (2000) and the state Uniform Electronic Transactions Act say a signature or contract cannot be denied effect solely because it is electronic. There are no tiers and no government certificates. Canada's provincial Electronic Transactions Acts and Australia's Electronic Transactions Act 1999 work the same way: an electronic method that identifies the person and shows their intention is enough, if it is appropriately reliable and the other side consents. Canada's federal law (PIPEDA, Part 2) does define a "secure electronic signature" for certain federal purposes. Singapore's Electronic Transactions Act accepts electronic signatures generally, and gives extra evidential presumptions to "secure" signatures.
3. PKI-first systems (India, Bangladesh, Pakistan, Turkey, Indonesia and others)
These laws were written around certificates. India's Information Technology Act 2000 gives legal recognition to digital signatures from licensed CAs and to electronic signature methods listed in its Second Schedule, notably Aadhaar-based eSign. Bangladesh's ICT Act 2006 is built around digital signatures from CAs licensed by the Controller of Certifying Authorities. Turkey's Electronic Signature Law No. 5070 (2004) gives a "secure electronic signature" (backed by a qualified certificate) the same effect as a handwritten one. Indonesia's Electronic Information and Transactions Law distinguishes certified from uncertified e-signatures, with certified ones issued by registered providers carrying more weight. Simple e-signatures are not worthless in these countries, but their status is weaker, less settled, or left to the court.
Country by country
| Country | General rule | When a certificate-based signature is needed |
|---|---|---|
| EU (general) | eIDAS: no denial of effect; QES equals handwritten | Where national law requires written form or a QES |
| Germany | eIDAS plus Civil Code | Statutory written form (QES under section 126a BGB); some documents cannot be electronic at all |
| France | Civil Code accepts reliable e-signatures | QES gets a legal presumption of reliability; some filings require it |
| Spain | eIDAS and Law 6/2020 | Many public administration procedures |
| Italy | Digital Administration Code | Real-property contracts in electronic form; many filings |
| UK | Flexible; SES usually enough | Rarely; specific registries set their own rules |
| US | ESIGN and UETA, technology-neutral | Only where an agency or regulated process specifies it |
| Canada | Provincial acts, technology-neutral | Some federal requirements (secure electronic signature) |
| Australia | Electronic Transactions Act 1999 | Only where a specific process demands it |
| Brazil | MP 2.200-2/2001; Law 14.063/2020 tiers | ICP-Brasil for many public filings and real-estate registration |
| Mexico | Commercial Code; Advanced Electronic Signature Law 2012 | SAT e.firma for tax; many government procedures |
| India | IT Act 2000 | Digital signature (DSC) or listed eSign for full statutory recognition; DSC for company and tax filings |
| Bangladesh | ICT Act 2006 | Digital signature from a CCA-licensed CA for statutory recognition |
| Pakistan | Electronic Transactions Ordinance 2002 | Advanced electronic signature from an accredited provider for stronger presumptions |
| Turkey | Law 5070 (2004) | Secure e-signature for handwritten-equivalent effect |
| Indonesia | EIT Law and Government Regulation 71/2019 | Certified e-signature for stronger evidential weight |
| Japan | Electronic Signatures Act 2000 | Not generally required; strong signatures earn a presumption of authenticity |
| Singapore | Electronic Transactions Act | Not generally required; secure signatures get presumptions |
| UAE | Decree-Law 46/2021 | Qualified signature for handwritten equivalence |
| Saudi Arabia | Electronic Transactions Law 2007 | Where the relevant authority specifies certified signatures |
| South Africa | ECTA 2002 | Advanced electronic signature where a law requires a signature |
| Nigeria | Evidence Act 2011; Cybercrimes Act 2015 | Not generally; check the receiving office |
| Philippines | E-Commerce Act 2000 | Many government transactions use PNPKI digital certificates |
Two rows deserve a note. South Africa is unusual: its Electronic Communications and Transactions Act says that where a law requires a signature, only an advanced electronic signature (from an accredited provider) satisfies it, while ordinary contracts with no such requirement can use any e-signature. Japan does not require certificates, but its Electronic Signatures Act presumes a document authentic when it carries an electronic signature that only the person could have made, which is why certificate-based signatures remain popular there.
For each country, the full rules and exclusions are in our series, starting with the EU, India, Turkey and the US.
Documents that need more than any signature
Some documents cannot be signed electronically at all, whatever the technology, because the law requires a notary, witnesses, a court or a registry. Common examples are wills, many property transfers, and some powers of attorney and family law documents. We cover these in wills and property deeds.
A decision guide
- Is there a rule requiring a particular signature? Check the law, the contract, or the instructions of the office receiving the document. If nothing is specified, a simple electronic signature is usually acceptable in technology-neutral and tiered systems.
- Is it an ordinary contract between private parties in the US, UK, EU, Canada, Australia, Singapore or Japan? A simple e-signature with a good audit trail is normally enough.
- Does the receiving office ask for a DSC, qualified signature, ICP-Brasil, e.firma or similar? Then you need a certificate from an accepted CA. A drawn signature will be rejected.
- Does the law require a notary, witness or physical presence? No signature tool, digital or otherwise, satisfies that on its own.
- Are you in a PKI-first country and the stakes are high? Prefer a certificate-based signature even if a simple one might be accepted.
How to sign with KovaPDF
KovaPDF has three signing tools, and they map neatly onto the vocabulary:
- [Sign PDF](/sign-pdf): a simple electronic signature. Draw, type or upload your signature and place it on the page. Useful for everyday forms. It is an image and does not show whether the file changed afterwards. It is not a digital signature.
- [Request Signatures](/request-signatures): simple electronic signatures with an audit trail. Send a PDF to one or more signers by email. When everyone has signed, all parties receive the PDF with a certificate of completion (document fingerprint, names, emails, times, IP addresses, browsers), and the file is sealed with a trusted timestamp so later edits are detectable. Legally these are still simple electronic signatures, not advanced or qualified ones, and not a DSC, ICP-Brasil or Aadhaar eSign.
- [Digital Signature](/digital-signature-pdf): a certificate-based digital signature. Sign with your own .pfx or .p12 certificate. The result is a PAdES signature with an optional trusted timestamp and long-term validation data. It is advanced or qualified only if your certificate and how it was issued make it so. Qualified certificates held on a smart card, USB token or remote signing service cannot be exported, so they cannot be used on any website, including this one; use your CA's software instead. See how to get a certificate.
To check what kind of signature a PDF you received carries, use Verify PDF Signature. For background, read what a digital signature in a PDF is and what a digital certificate is.
Common questions
Is an electronic signature the same as a digital signature?
No. An electronic signature is any electronic way of signing, such as a typed name or a click. A digital signature is a specific cryptographic technology that uses a certificate and shows whether the document changed after signing. Every digital signature is an electronic signature, but not the other way round.
Which is more legally binding, a digital or an electronic signature?
For most ordinary contracts in the US, UK, EU, Canada and Australia, both are binding. Certificate-based signatures carry stronger evidence and sometimes a legal presumption, and in some countries (India, Bangladesh, Turkey) they are what the statute primarily recognises.
What is the difference between AdES and QES?
An advanced electronic signature is uniquely linked to and identifies the signer and reveals later changes. A qualified electronic signature is an advanced one that also uses a qualified certificate from a qualified trust service provider and a certified signing device; in the EU it has the same effect as a handwritten signature.
Does the US require digital signatures?
No. Under the ESIGN Act and UETA any electronic signature can be valid, and there is no government certificate system. Specific agencies or regulated processes may specify their own methods, so follow the instructions of the office receiving your document.
Is a typed name a valid signature?
In many legal systems, yes, if it was applied with the intention to sign and you can show who applied it. English courts have accepted typed names and email sign-offs. In PKI-first countries, a typed name has weaker or unclear status for documents where the law requires a signature.
When do I need a digital signature certificate?
When a law or office specifically demands one, for example Indian company and tax filings, Brazilian filings requiring ICP-Brasil, Mexican tax procedures using e.firma, or EU documents needing a qualified signature. For ordinary private contracts it is usually optional.
Is a KovaPDF signature a qualified electronic signature?
Sign PDF and Request Signatures create simple electronic signatures. Digital Signature creates a certificate-based signature with your own .pfx file; it counts as advanced or qualified only if your certificate and its issuance meet those standards. KovaPDF is not a qualified trust service provider.
Can I tell what kind of signature a PDF has?
Yes. A signature image is just part of the page, while a digital signature appears in a PDF reader's signature panel. KovaPDF's Verify PDF Signature lists each digital signature, the signer's certificate, whether the file changed, and whether a timestamp is present.