Trust is the cornerstone of commercial activity and can be enhanced in the online world by the use of e-signatures and trust services. In this blog we review the different types of e-signature and consider their legal validity and security for executing contracts and deeds.
What are e-signatures?
E-signatures take many forms including typewritten, scanned, digital representations of characteristics such as a fingerprints or retina scans, as well as electronic representations of handwritten signatures, such as those used when accepting the delivery of a parcel by signing with a stylus and a handheld touch screen device.
Regulation EU/910/2014 on electronic identification and trust services governs the use of e-signatures and trust services in commercial arrangements and categorises e-signatures according to their level of sophistication for authentication and integrity. Namely these are as follows:
(i) “simple”, meaning data in electronic form such as scanned signatures or tick boxes with declarations;
(ii) “advanced”, meaning signatures that are uniquely linked to an identifiable signatory with sole control of the data used to create it (such as through private encryption); and
(iii) “qualified”, meaning those signatures that meet the “advanced” criteria and are supported by a formal certificate issued by a trust service provider.
What are trust services?
Trust services are provided by the qualified service providers listed on the EC’s website. Trust services are used to verify the authenticity of an e-signature and include measures such as:
(i) electronic time stamping, whereby data in electronic form binds other electronic data to a particular time which proves that the data existed at a particular time;
(ii) electronic seals, which are incorporated into a document to guarantee its origin and integrity; and
(iii) website authentication, a certificate allowing users to verify the authenticity of a website and its link to the website owner.
The UK’s draft withdrawal agreement from the European Union anticipates that a reciprocal arrangement for accepting information in electronic format will continue after Brexit at least for the duration of a transition period.
Contracts
Contracts for commercial arrangements can be made orally or in writing (including through a variety of electronic communications including by email, acceptance procedures and text message). Signature of the parties is a strong indication of their intention to create legal relations. English law allows for e-signatures of all complexities to be used as the basis for entry into a contract with equal treatment to execution by wet-ink signature, so long as the signatory intends for the e-signature to authenticate the document.
E-signatures can be quickly generated and are likely to be more efficient from a cost and time standpoint in high-volume transactions on standard terms (where there is limited scope for negotiation). That said, the need for security may prevail over convenience in high value transactions where sophisticated e-signatures with a secure link to the owner would more usually be used for authentication purposes.
Deeds
The main difference between a deed and a contract is that deeds must be in writing and there is no need for consideration (i.e. payment in some form) for a deed to be legally binding. There is a statutory requirement in certain types of transaction for the parties to use a deed, for example land conveyances or the release of a debt. The execution requirements are also more complex for deeds. For example, the Companies Act 2006 provides that one director may sign on behalf of the company in the presence of a witness, or two authorised signatories may sign on behalf of the company.
The statutory requirements for signing an agreement must also be considered in line with any requirements prescribed by the company’s articles of association. If the articles do not include provisions governing the use of electronic or wet-ink signatures then the company may execute a deed by e-signature. In the case of a deed, the witness who attests the signature must have actual sight of the live signing. It is considered best practice for the witness to be in the same location as the signatory but the requirement can also be fulfilled by using a live videolink. The witness may either attest the signature by affixing their own e-signature or use a wet-ink signature, subject to any provisions of the company’s articles.
Key considerations
- Suitability: legal advice should be sought when contemplating whether to sign documentation by e-signature.
- Trust services: can be used to ensure the security and legal validity of electronic activity and may be helpful where e-signatures are being used.
- Public bodies: a wet ink signature is required for filing documents with certain public bodies such as HMRC, the Land Registry and Companies House (for example stock transfer forms for the payment of stamp duty).
- International arrangements: it is best practice to discuss the use of an e-signature to execute an agreement with the counterparty in advance, particularly if they are based outside the EU where e-signatures may not be common place or enforceable.
- Legislation and constitution: ensure the manner of the execution satisfies the necessary statutory requirements and the company’s articles of association;
- Witnesses: when executing a deed, make sure the witness genuinely observes the act of signing.
If you require such assistance, or you would like to enquire about how else the team could help with your company’s affairs, please contact a member of our technology law team.
Latest blogs and news
When can organisations rely on “consent” under data protection laws? The Court of Appeal clarifies in RTM v Sky Betting and Gaming
The Court of Appeal's recent decision in RTM v Bonne Terre Limited & Hestview Limited [2026] EWCA Civ 488 is an important one for any business/controller that relies on consent as a lawful basis for processing personal data or sending direct marketing communications. In short, the legal test for consent under data protection legislation is an objective one, not a subjective inquiry into the data subject’s internal state of mind.
“Recruitment Rewired”: what employers need to know about automated recruitment
On 31 March 2026, the Information Commissioner’s Office (ICO) published its Report, “Recruitment Rewired: an update on the ICO’s work on the fair and responsible use of automation in recruitment”, setting out its findings and regulatory expectations for employers using AI‑enabled or automated tools in recruitment.
Employment law changes tech businesses need to know about
A significant number of employment law reforms are coming into effect in 2026 and 2027 following the introduction of the Employment Rights Act 2025 at the end of last year.
Court of Appeal confirms scope of data controllers’ security obligations
In a recent decision, the Court of Appeal allowed the UK Information Commissioner's appeal against the decision of the Upper Tribunal in proceedings involving DSG Retail Limited ("DSG"). The case arose from a nine-month cyber-attack in 2017-2018 on DSG’s systems, during which the attackers scraped transaction data from point-of-sale terminals from over 5.6 million payment cards. The compromised data included card numbers and expiry dates but not cardholders' names, meaning the attackers could not directly identify individuals from the data alone.
Copyright & artificial intelligence: Progress, pause and persistent uncertainty
The UK Government has now published its March 2026 Report on Copyright and Artificial Intelligence, following its 2024–25 consultation on the use of copyright protected works in AI training. The outcome is significant - not for what it introduces but for what it postpones.
Government announces tough new late payment laws – what happens next?
The UK Government has confirmed a major package of reforms to tackle late payments, a persistent pressure point for small businesses, costing the economy £11 billion a year and contributing to 38 business closures every day.
What tech businesses need to know in 2026
At our recent Tech Briefing, 'What tech businesses need to know in 2026', we explored how the EU’s Digital Omnibus package and the UK’s Employment Rights Act will reshape compliance for UK tech SMEs.
Five common contract weaknesses – and how to fix them
Most commercial disputes don’t come from exotic legal issues - they come from everyday contract weaknesses that could have been avoided with a few smart tweaks
2026 marks a turning point for data governance in the UK
2026 is shaping up to be the most consequential year for UK data protection enforcement since the introduction of the EU/UK GDPR regime. With record fines issued in late 2025, a new enforcement playbook on the horizon, and shifting legislative and regulatory expectations, the Information Commissioner’s Office (“ICO”) is signalling a marked transformation in how it supervises, and sanctions, organisations.
Why limitation of liability clauses deserve more attention than they get
Too often, limitation of liability clauses are treated as standard boilerplate - something to tidy up at the end of a negotiation once the “real” commercial points are agreed.
From Seed to Series A and Beyond: 7 Key Insights for Tech Founders
In this article, we share 7 key considerations to help tech founders navigate the journey from seed funding to Series A and beyond.
Biggest EU Digital Shake-Up Since GDPR? What Businesses Need To Know
In November 2025, the European Commission unveiled its Digital Omnibus package – a set of proposals aimed at simplifying (not deregulating) EU rules on data protection, cybersecurity and AI.
Clearview AI ruling confirms UK GDPR applies beyond borders
In a recent decision on the UK GDPR’s global scope, the Upper Tribunal in The Information Commissioner v Clearview AI Incorporated and Privacy International [2025] UKUT 319 (AAC) confirmed that the UK’s data protection regime can extend well beyond its borders.
UK Tech SMEs & the November Budget
Founders and teams across the country are looking for signals that the UK still backs its innovators. Here’s what’s top of the wish-list:
Why does software ownership matter? Six key legal takeaways for tech businesses
For founders, investors and anyone involved in the tech sector, understanding who owns your software and how to prove it is critical. Whether you’re seeking investment, planning an exit or simply aiming to protect your IP, clarity on ownership can make or break a deal
Court of Appeal clarifies data protection claims for non-material damage: A win for claimants - But what are the implications for controllers and processors?
The Court of Appeal has recently handed down an important decision in respect of data protection law considerations in Farley & Others v Paymaster (trading as Equiniti) [2025] EWCA Civ 1117, providing clarity on the scope of infringement and compensation data protection claims under the UK GDPR and Data Protection Act 2018 (“DPA”). The judgment will be of particular interest to any service provider dealing with and processing large volumes of customer personal data.
Three Cautionary Tales for UK Tech Companies
In tech, the law often arrives after something has gone wrong. Here are three cautionary tales* and the lessons every founder, CTO and in-house counsel should take away.
Top five takeaways from the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 (the “DUAA”), which received Royal Assent on 19 June 2025, introduces targeted reforms to the UK data protection legal framework — particularly the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
A game changer for data processors? The ICO issues a significant fine against a processor
The recent cyberattacks on major UK retailers have put cybersecurity back in the spotlight. But a more significant development for data protection practitioners has been flying under the radar: the Information Commissioner’s Office (ICO) has issued a notable fine directly against a data processor for breaching UK GDPR security obligations - an important shift in enforcement focus.
Key takeaways: What recent consumer law reforms mean for service providers
On 6 April 2025, the first wave of consumer protection provisions under the Digital Markets, Competition and Consumers Act 2024 (“DMCC Act”) came into force, marking the most significant overhaul of UK consumer protection law in over a decade.


Share insightLinkedIn X Facebook Email to a friend Print