GDPR and electronic signature: what to keep, and for how long?
The GDPR imposes a right to erasure, but proof of a signature must be retained. Find out how to reconcile these requirements through anonymisation and data sealing.
The GDPR imposes a right to erasure, but proof of a signature must be retained. Find out how to reconcile these requirements through anonymisation and data sealing.
The paradox: erase or retain?
The General Data Protection Regulation (GDPR) gives individuals the right to obtain the erasure of their personal data (Article 17). But an electronic signature creates a contractual commitment: its proof must be able to be provided throughout the entire term of the contract, often several years. How can the right to erasure be respected without sacrificing the proof?
Article 17.3.e of the GDPR provides an exception: the right to erasure does not apply where retention is necessary "for the establishment, exercise or defence of legal claims". This is what makes it possible to retain signed documents and the associated proof data. However, this exception does not justify retaining all connection data indefinitely.
What does French law say?
The French Civil Code, in Article 1367, recognises that an electronic signature has the same evidential value as a handwritten signature, provided that it is reliable and that its link with the instrument is guaranteed. The eIDAS Regulation (No 910/2014) defines three levels: simple, advanced, qualified. The simple signature is the most common: it is sufficient for most contracts, but its evidential value may be challenged.
In France, the retention of commercial documents is governed by the Commercial Code (Article L123-22): books and records must be retained for 10 years. For contracts, the ordinary limitation period is 5 years (Article 2224 of the Civil Code). In practice, it is prudent to retain signature proofs for at least 10 years.
The solution: anonymise connection data
A widespread approach consists in retaining the signed document and the essential metadata (signatory's identity, timestamp, fingerprint) but anonymising the connection data (IP address, technical logs). Anonymisation makes this data non-personal: the GDPR no longer applies. It can therefore be retained without limit, or deleted earlier, with no impact on the proof.
At Sign-Hub, we apply this principle. The proof file contains:
- the document signed in PAdES format (sealed)
- the document fingerprint and the timestamp
- the signatory's identity (name, email)
- proof of consent (checked box)
- the events of the signature chain (sending, opening, signature)
The connection data (IP address, user-agent, logs) is anonymised after processing: the values are replaced with random identifiers. The proof file remains complete and verifiable, but no longer contains any personal data within the meaning of the GDPR.
How long should it be retained?
There is no single legal retention period. Everything depends on the nature of the document:
- Sales contract: 5 years (civil limitation period) or 10 years (accounting obligation)
- Employment contract: 5 years after the end of the relationship
- Surety agreement: 5 years
- Documents relating to a property: 10 years or more
In the event of a dispute, the proof must be available until the final court decision. A good practice: retain the signed proof file for 10 years, then destroy it or anonymise it further. You can define a retention period in your internal policy, taking into account the applicable limitation periods.
How does Sign-Hub handle retention?
Sign-Hub is an API-first electronic signature service. It allows signature requests to be created, links to be sent, and signed webhooks to be received. The service complies with the GDPR:
- Data hosted in the European Union
- Explicit consent of the signatory recorded in the proof file
- Anonymisation of connection data without breaking the proof
- Proof file signed with Ed25519, independently verifiable
The signatory receives an email with a one-time code. They check a consent box before signing. The document fingerprint is frozen at the time of signature. All these elements are recorded in a timestamped proof file.
Verifying the proof without trusting the provider
A key point: the proof must be verifiable even if the provider disappears. Sign-Hub publishes its public key at a stable URL (https://sign-hub.newvisionofapps.fr/.well-known/sign-hub-keys.json). Anyone can verify a proof file (proof.json) using a script or via the online verification page. This transparency strengthens the evidential value.
In practice: what should be done?
- Identify the types of signed documents and their legal retention period.
- Put in place a written retention policy, with precise periods.
- Use a signature service that allows proofs to be exported and retained independently.
- For connection data, require anonymisation (or pseudonymisation) as soon as possible.
- In the event of a signatory's erasure request, explain that retention is necessary for the proof, in accordance with Article 17.3.e.
Try Sign-Hub
Sign-Hub is available in mainland France and in the overseas territories. The Discovery plan is free for 10 transactions per month, with no subscription. You can test the API, create a signature request and verify the proof file. Consult the documentation and the OpenAPI specification to integrate electronic signature into your application.