Legality of eSignatures in Timor Leste

Background

Electronic signatures are redefining how agreements are executed, offering a secure, legally recognized alternative to handwritten signatures. In Timor-Leste (East Timor) and across the globe, their significance lies in ensuring the authenticity and integrity of documents, backed by advanced encryption that safeguards against fraud and tampering. Globally, modern advances in the digitalization of transactional and operation-based government and business services has led to seamless processes, fast and efficient engagements, thus creating secure, convenient, and legally acceptable operations and standards.

Users should opt for electronic signature solutions adhering to Timor-Leste’s legislation, especially Decree-Law No. 12/2024 of February 13, which is known as the General Legal Regime for Electronic Commerce and Electronic Signatures, and the country’s Civil Code. The decree provides that electronic signatures may not be denied legal effect solely because they are in electronic form.¹ However, it’s important to note that some documents may still necessitate a physical signature, and legal intricacies can vary; hence, consulting a legal expert is advisable.

Security remains a paramount concern. Providers of electronic signature services must offer robust security measures, including encryption, user authentication, and audit trails, to prevent unauthorized access and confirm the legitimacy of signed documents. BoldSign, for instance, provides these security features to meet compliance and safety standards.

In conclusion, electronic signatures are incredibly advantageous and widely recognized in Timor-Leste. Nevertheless, adhering to legal requirements, ensuring security, and selecting a user-friendly service are vital to their successful application.

Overview of electronic signature legislation in Timor-Leste

The decree establishes that electronic signatures have the same legal effect and reliability in Timor-Leste and comply with international standards and good practices, like the United Nations Commission on International Trade Law (UNCITRAL) on electronic commerce, electronic signatures, and transferable electronic records.²

The use of electronic signatures in Timor-Leste is regulated by:

• Decree-Law No. 12/2024 of February 13 (General Legal Regime for Electronic Commerce and Electronic Signatures)
• Civil Code of Timor-Leste (Law No. 10/2011, of 14 September)

The decree recognizes the following electronic signatures:

• Simple electronic signature.
• Secure electronic signature
• Digital signature

A simple electronic signature, per Article 14 (1) of the decree, is a reliable digital method that identifies a person and indicates their intention to approve the information in an electronic record.³

A secure electronic signature, per Article 14(2), is an electronic signature that meets the following requirements:⁴

• Uniquely linked to the signatory
• Capable of identifying the signatory
• Created in a way that the signatory can maintain their control
• Linked to the data it relates to, so that any subsequent change to the data is detectable

Uniquely linked to the signer

A secure electronic signature must be connected to the person using it. The signature must be uniquely created with methods only the signer can access, like a private key and confidential information, to verify their identity.

Use and incorporation remain in their sole control

The person using the secure electronic signature must have sole control over the means of creating the signature. Typically, this requires managing a key pair or two-factor authentication, with the signer exclusively holding the private key to prevent signature forgery.

Identify the person using the technological process

The process used to create the signature must be capable of identifying the person signing. This may include using a biometric signature, a personal identification number (PIN), an email address, or a company registration number.

Track down any alterations made after signing

It is essential to preserve the authenticity of the signed document. Modifications made to the document post-signature should be identifiable. This is commonly accomplished through an audit trail. Audit trails record the signer’s IP address, timestamps of key-signing events, and location, providing proof of identity, timing, and signature place.

A digital signature is a highly secure electronic signature generated using a certified device and relies on an accredited certificate specific to the electronic signature. It must meet the following validation set of standards:⁵

• A statutory compliant certificate at the time of signing
• A qualified trust service provider issued a valid certificate when signing
• Signature validation data corresponds to the data provided to the relying party
• The unique set of data representing the signatory in the certificate was correctly provided to the relying party
• The use of any pseudonym is clearly indicated to the relying party if used at the time of signing
• The electronic signature is of a qualified electronic signature creation device
• The integrity of the signed data has not been compromised
• Meets all the requirements of a secure electronic signature

Summary analysis

Certification by an accredited entity

The certificate provided by the accredited body must contain the following:⁶

• The name or name of the holder of the signature or a pseudonym of the holder, clearly identified
• Name, country, and electronic signature of the certifying body
• Signature verification data corresponding to the signature creation data held by the holder
• Certificate serial number
• Beginning and end of the certificate's validity
• Identifiers of algorithms used in the verification of signatures of the holder and the certifying body
• Any certificate must indicate if there are usage or period restrictions
• Conventional limitations on the liability of the certifying body, without prejudice
• Reference to a specific status of the holder of the signature, depending on the use for which the certificate is intended
• Indication that it is issued as a certificate

Scope and limitations of electronic signature transactions

The use of electronic signatures for concluding transactions is not uniformly recognized as legally valid. As a result, certain types of transactions and applications are appropriate for electronic signatures, while others are not.

Documents that can be signed

Electronic signatures can be employed to affix signatures and provide countersignatures on an array of documents, such as:

• Human resources
• Procurement
• Non-disclosure agreements (assuming they are contracts, not formal deeds)
• Software license agreements
• Insurance industry
• Educational field, etc.

Exempted transactions

Electronic signature regulation in Timor-Leste lacks an express provision on which class of transactions are exempted from completion using an electronic signature. Caution should, however, be taken when dealing with transactions as below, which tend to be exempted through the procedural laws of Timor-Leste:

• Wills and acts of succession law
• Marriage, adoption, divorce, and acts of family law
• The transfer of immovable property and any real estate matters requiring notarial intervention
• Documents whose validity requires notarial intervention
• Procedural acts of justice, e.g, court orders
• Default, acceleration, repossession, foreclosure, or eviction, or the right to redress under a credit agreement secured by a lease agreement for an individual's primary residence, or an individual's primary residence
• Cancellation or termination of health insurance or life insurance benefits
• Securities, such as shares and bonds, and other investment instruments
• Recall of a product or warning of material failure of a product that may endanger health or safety

Summary

To ensure the validity of an electronic signature, it is recommended to adhere to the following best practices while also complying with all relevant legal regulations:

• Verify the identity of the person affixing their signature and, in cases involving a corporate entity, confirm that the person is authorized to legally bind the company with their signature.
• Obtain explicit consent from the person signing electronically, which can be included within the contract itself or through a separate form of acknowledgment, to demonstrate their agreement to sign the document electronically using the chosen method.
• Secure the document against any alterations once the electronic signature has been placed.
• Maintain a detailed record of the signing process, documenting each action performed by the person executing the signature.

How does BoldSign help?

The following elements of compliance available within BoldSign can be used to comply with eSignature laws in Timor-Leste:

• Secure and unique signing link: A secure and unique link to sign a document is sent directly to the signer's email address. This ensures that the document is only accessed by the intended signer and cannot be tampered with.
• Password protection: Senders can specify a password that needs to be entered before viewing and signing a document. This adds another layer of security to the signing process.
• Audit trail: The IP address of the signer and timestamps for all significant events in the signing process are recorded in an audit trail. This provides a record of who signed the document, when, and where.
• Digital signature: The final document is digitally signed with an AATL-compliant certificate. This ensures that the document cannot be tampered with without invalidating the signature.
• Consent: Signers are asked to confirm their intent to sign electronically and informed that they could opt out. This ensures that the signer is aware of the implications of signing electronically and has given their consent.
• Custom terms: Get your signers to agree to a custom set of terms. This can be useful to ensure additional security or that the signer understands the terms of the document.

Disclaimer: The information on this page is intended to help businesses understand the legal framework of electronic signatures for this particular country.

However, Syncfusion’s officers, directors, stockholders, affiliates, attorneys, accountants, employees, or agents cannot provide legal advice. You should consult your personal attorney regarding your specific legal questions. Laws and regulations are subject to frequent changes, and the information may not be current or accurate. To the maximum extent permitted by law, Syncfusion provides this material on an “as-is” basis. Syncfusion disclaims and makes no representation or warranty of any kind with respect to this material, express, implied, or statutory, including representations, guarantees, warranties of merchantability, fitness for a particular purpose, or accuracy.

Syncfusion makes no warranties of any kind, including but not limited to the information or the product, whether express, implied, statutory, or otherwise. To the maximum extent permitted by law, Syncfusion disclaims all conditions, representations, and warranties, whether express, implied, or statutory, with respect to this information, without limitation of any implied warranty of merchantability, fitness for a particular purpose, accuracy, or currentness of this information.

Syncfusion nor its officers, directors, stockholders, employees, affiliates, attorneys, accountants, or agents shall be liable for indemnification, nor does this create an express or implied, contractual or statutory, equitable or otherwise, under this agreement. The officers, directors, stockholders, affiliates, attorneys, accountants, or agents will not have any liability in any form.