Legality of eSignatures in Malaysia

Background

The adoption of electronic signatures is transforming the document validation, enhancing efficiency across Malaysia and globally. These digital mechanisms provide a swift and environmentally friendly alternative to traditional signing processes, reducing reliance on paper and enabling faster completion of transactions. Nevertheless, it is essential to grasp the critical factors involved in implementing eSignatures within the Malaysian context.

Choosing a compliant electronic signature provider is a pivotal step, one that must align with Malaysian regulations such as the Digital Signature Act 1997 (Act 562),¹ the Electronic Commerce Act 2006 (Act 658)², and the Electronic Government Activities Act 2007³. Compliance ensures that eSignatures are recognized as legally equivalent to their handwritten counterparts for most transactions in Malaysia⁴. However, certain documents still mandate a handwritten signature, and local regulations may vary; thus, seeking legal advice is advisable.

Security is paramount in the realm of eSignatures. Service providers must offer comprehensive security features, including encryption, authentication, and audit trails, to protect against unauthorized access and verify a document's authenticity. BoldSign is an example of a provider that meets these stringent security and compliance standards.

As electronic signatures gain widespread acceptance and offer significant advantages, it is crucial to address legal compliance, prioritize security, and select an accessible service for effective integration into Malaysian business practices.

Overview of the electronic signatures’ regulatory framework in Malaysia

Electronic signatures are considered just as valid as traditional wet-ink signatures; however, their use is subject to specific regulations spelled out in:

• Digital Signature Act 1997 [Act 562]
• Electronic Commerce Act 2006 [Act 658]
• Electronic Government Activities Act 2007 (Act 680)

The regulations categorize eSignatures into:

• Standard electronic signatures
• Digital signatures

A standard electronic signature consists of any combination of letters, characters, numbers, sounds, or other symbols generated electronically and chosen by an individual to serve as their signatory mark.⁵

A digital signature is an electronic signature that applies an asymmetric cryptographic system to a message in a way that enables someone with access to the original message and the signer's public key to confirm two key points:⁶

• The digital signature was generated using a private key matching the signer's public key.
• That the message has remained unchanged since the digital signature was applied.

Reliability and validity of eSignatures

The validity of both electronic signatures, alongside all other provisions for both standard electronic signatures and digital signatures is achieved by employing a set of standards.⁷

• Uniquely linked to the signer
• Capable of identifying the signatories
• Developed through means that the signatory can maintain their control
• Linked to the data it relates to so that any subsequent change to the data is detectable.

Uniquely linked to a person, you must show

A secure electronic signature must be uniquely connected to the person using it. The signature must be created with methods only the signer can access, like a private key and confidential information, to verify their identity.

Use and incorporation remain in their sole control

The person using the secure electronic signature must have sole control over the means of creating it. Typically, this requires managing a key pair or two-factor authentication, with the signer exclusively holding the private key to prevent signature forgery.

Identify the person using the technological process

The process used to create the signature must be capable of identifying the person signing. This may include a biometric signature, a personal identification number (PIN), an email address, or a company registration number.

Track down any alterations made after signing

It is essential to preserve the authenticity of the signed document. Modifications made to the document post-signature should be identifiable. This is commonly accomplished through an audit trail. Audit trails record the signer's IP address, timestamps of key signing events, and location, providing proof of identity, timing, and signature place.

Summary analysis

Under the Digital Signature Act 1997 (Act 562), the Electronic Commerce Act 2006 (Act 658), and the Electronic Government Activities Act 2007(680)

Scope and limitations of eSignature transactions

The use of electronic signatures is not legally recognized for all document types. Some transactions are appropriate for eSignatures, while others are not. Below is a brief analysis and a summary table of these transactions.

Documents that can be signed

Electronic signatures can be employed to affix signatures and provide countersignatures on a diverse array of documents, such as:

1. Legal opinions
2. Offer letters
3. Public petitions
4. Memoranda and internal correspondence
5. Non-disclosure agreements
6. Purchase orders
7. Human resource documents
8. Procurement
9. Employee onboarding
10. End user agreements, etc.

Exempted transactions

In Malaysia, the following transactions cannot be concluded using an electronic signature⁸:

• Power of attorney
• Wills and codicils
• Trusts
• Negotiable instruments

Summary scope

To ensure the credibility of an electronic signature, it's advisable to follow these best practices in addition to complying with all applicable legal provisions:

1. Confirm the signer's identity and, in business dealings, verify that the individual is duly authorized to act on behalf of the company in affixing their signature.
2. Secure explicit agreement from the individual signing, which may be incorporated in the contract itself or into a separate accord, to signify their intention to use the specified electronic signature for the document in question.
3. Safeguard the document to prevent any modifications after the application of the signature.
4. Keep an exhaustive log of the signing procedure, recording each step the signer performs.

How does BoldSign help

The following elements of compliance available within BoldSign can be used to comply with Malaysia’s eSignature laws:

• Secure and unique signing link: A secure and unique link to sign a document is sent directly to the signer's email address. This ensures that the document is only accessed by the intended signer and cannot be tampered with.
• Password protection: Senders can specify a password that needs to be entered before viewing and signing a document. This adds another layer of security to the signing process.
• Audit trail: The IP address of the signer and timestamps for all significant events in the signing process are recorded in an audit trail. This provides a record of who signed the document, when, and where.
• Digital signature: The final document is digitally signed with an AATL-compliant certificate. This ensures that the document cannot be tampered with without invalidating the signature.
• Consent: Signers are asked to confirm their intent to sign electronically and are informed that they could opt out. This ensures that the signer is aware of the implications of signing electronically and has given their consent.
• Custom terms: Get your signers to agree to a custom set of terms. This can be useful to ensure additional security and that the signer understands the terms of the document.
• QES compliance: BoldSign offers fully compliant qualified electronic signatures (QES) that are simple, secure, and legally binding across Malaysia. QES guarantees that essential documents are protected with the highest level of eSignature security, giving peace of mind in digital transactions. Using BoldSign, users can confidently manage important documents while ensuring compliance with Malaysia’s regulations.

Disclaimer: The information on this page is intended to help businesses understand the legal framework of electronic signatures for this particular country.

However, Syncfusion’s officers, directors, stockholders, affiliates, attorneys, accountants, employees, or agents cannot provide legal advice. You should consult your personal attorney regarding your specific legal questions. Laws and regulations are subject to frequent changes, and the information may not be current or accurate. To the maximum extent permitted by law, Syncfusion provides this material on an “as-is” basis. Syncfusion disclaims and makes no representation or warranty of any kind with respect to this material, express, implied, or statutory, including representations, guarantees, warranties of merchantability, fitness for a particular purpose, or accuracy.

Syncfusion makes no warranties of any kind, including but not limited to the information or the product, whether express, implied, statutory, or otherwise. To the maximum extent permitted by law, Syncfusion disclaims all conditions, representations, and warranties, whether express, implied, or statutory, with respect to this information, without limitation of any implied warranty of merchantability, fitness for a particular purpose, accuracy, or currentness of this information.

Syncfusion nor its officers, directors, stockholders, employees, affiliates, attorneys, accountants, or agents shall be liable for indemnification, nor does this create an express or implied, contractual or statutory, equitable or otherwise, under this agreement. The officers, directors, stockholders, affiliates, attorneys, accountants, or agents will not have any liability in any form.