GDPR and electronic signatures: who is responsible for what

Every electronically signed document contains personal data: names, email addresses, signatures, and in the audit trail IP addresses, device details and timestamps. If you send documents from the UK or the EU, or to people there, the UK GDPR and EU GDPR apply. This guide explains who is responsible for what when you use an e-signature service, which lawful basis covers the processing, what signers must be told, how long to keep things, and how signers' rights work. It uses AiresDocs as the worked example; the principles apply to any provider.

Who is controller and who is processor

The GDPR assigns responsibilities by role. A controller decides why and how personal data is processed; a processor processes it on the controller's behalf and instructions. In e-signing:

So when you send a tenancy agreement to a tenant, you decide the purpose (concluding a tenancy), you choose to use an e-signature service, and you are the controller of the tenant's data in that document. AiresDocs stores and processes it on your instructions as processor, under the data processing terms built into its terms of service, which contain the Article 28 clauses: processing only on instructions, confidentiality, security, sub-processor rules, assistance with rights requests, deletion or return at the end, and audit information. The ICO's controller-and-processor guidance explains the distinction in more depth.

What personal data e-signing involves

• Identity and contact: each recipient's name and email address, supplied by the sender.
• The document itself, which may contain anything: salary, address, bank details, health information in a consent form. The sender is responsible for what goes into it.
• The signature image (drawn, typed or uploaded) and any text fields the signer fills.
• Audit data: timestamps, IP addresses, user agent strings and event types for every action, plus the consent wording accepted.
• Email delivery data held briefly by the email provider: addresses, subject, delivery status.

Special category data (health, ethnicity, biometrics and so on) may appear inside documents such as medical consent forms. A drawn signature is not usually biometric data in the GDPR sense, because it is stored as an image rather than processed to identify a person by their physical characteristics; but a document's contents can be special category data, and the sender needs an Article 9 condition for them.

Lawful bases

The sender needs a lawful basis for each purpose. For e-signing, the ICO's lawful-basis guidance points to these:

• Contract (Article 6(1)(b)): processing necessary to enter into or perform a contract with the signer. This covers sending the contract, collecting the signature and keeping the signed copy.
• Legitimate interests (Article 6(1)(f)): collecting the audit trail (IP, device, timestamps) to attribute the signature and prevent fraud, and keeping it to defend claims. The sender's interest and the signer's interest in a reliable record both weigh in favour; the data is modest and expected. Record a short legitimate-interests assessment.
• Legal obligation (Article 6(1)(c)): where a law requires the record, for example deposit information under housing law or employment particulars.
• Consent (Article 6(1)(a)) is rarely the right basis here: the signer has no real alternative if they want the contract, and consent can be withdrawn, which does not suit a contract record. The e-sign consent checkbox is agreement to the method, recorded as evidence, not a GDPR lawful basis for processing.

AiresDocs, as controller of sender accounts, relies on contract (providing the service) and legitimate interests (security, fraud prevention, service improvement without profiling); the privacy policy sets this out.

Telling signers

Articles 13 and 14 require that people are told what happens to their data. For signers this is shared: the signing page tells them, before they sign, that their signature will be applied to the document and recorded with the date, time, IP address and browser, and links to how electronic signatures work and to AiresDocs's privacy policy for its own processing. The sender remains responsible for its own privacy information to the signer about the purposes of the document (a tenancy, a job, a service), which it normally provides through its usual privacy notice. A one-line reference in the document or the invitation message ("Our privacy notice is at ...") is good practice.

Retention

Keep personal data no longer than necessary for the purpose. For a signed contract and its audit trail, "necessary" is as long as the contract may need to be relied on or defended, which usually means the contract's life plus the limitation period for claims (six years in England and Wales for simple contracts, twelve for deeds; other jurisdictions differ). That justifies keeping the sealed PDF and certificate for years. It does not justify keeping unrelated drafts, duplicate copies or the data of candidates you never contracted with.

In AiresDocs, documents persist until the sender deletes them or deletes the account; the sender controls retention. Signing links expire; signature images are kept with their documents; email delivery logs at the email provider are short-lived. Senders should set their own retention schedule and use the export and delete functions to apply it. AiresDocs's own retention of account data is in the privacy policy.

Signer rights

Signers have the usual rights: access, rectification, erasure, restriction, objection, portability. Requests about a document should go to the sender, as controller; AiresDocs, as processor, assists the sender and will redirect requests it receives. Practical notes:

• Access: the signer already receives the completed PDF and certificate, which contain most of the data about them. The sender can export the audit JSON for the rest.
• Rectification: a signed document cannot be edited without breaking its hash. If a name is wrong, void and resend; record the correction in your files rather than altering the sealed PDF.
• Erasure: can be refused where the data is needed to establish, exercise or defend legal claims. Keep the contract; delete what you do not need.
• Objection to legitimate-interests processing: consider it, but attribution data for a contract the person signed will normally have compelling grounds.

International transfers

AiresDocs stores documents and audit data in London. Two sub-processors are US companies: Stripe (billing, which concerns the sender, not signers) and Resend (email delivery, which handles recipient names, email addresses and, for completed documents under 10 MB, the attached PDF). Transfers to the US rely on the UK International Data Transfer Agreement or Addendum and, where the provider is certified, the UK extension to the EU-US Data Privacy Framework; the ICO's international transfers guide describes the mechanisms. Senders outside the UK and EU should check their own rules; Australian senders, for instance, work under the Australian Privacy Principles, which include a cross-border disclosure principle.

Security and breaches

Article 32 requires appropriate security; the security page describes AiresDocs's measures (encryption in transit and at rest, hashed tokens, row-level access control, an append-only audit log, London storage). As processor, AiresDocs must notify the sender without undue delay of a personal data breach affecting their documents, so the sender can meet its own 72-hour notification duty to the ICO or an EU supervisory authority where required. Senders should also protect their side: use the account's secure sign-in, do not forward signing links, and use access codes for sensitive documents.

Checklist for senders

1. Know your role: you are the controller of your documents; AiresDocs is your processor under the DPA in the terms.
2. Pick the lawful basis for each document type (usually contract plus legitimate interests for the audit trail) and note it in your record of processing.
3. Tell signers through your privacy notice; the signing page covers the signature mechanics.
4. Only put in the document what the document needs. A tenancy agreement does not need a passport scan.
5. Set a retention period and apply it with export and delete.
6. Route rights requests through your normal process; ask AiresDocs for help when you need data you cannot see.
7. Use access codes for documents containing sensitive data, and never share a signer's link with anyone else.

For the product-side details see the privacy policy, the DPA summary and the security page.

This guide explains how electronic signature law works in general terms and links to the primary sources. It is not legal advice: rules differ by country and document type and they change. For a specific transaction, ask a qualified lawyer in the relevant jurisdiction. Spotted something out of date? Email support@airesdocs.com and we will check it against the source.