(Adopted at the 11th Session of the Standing Committee of the Tenth NPC on August 28th, 2004)

Chapter I General Provisions

Article 1 This Law is formulated in order to standardize electronic signatures, establish the legal effect of electronic signatures and safeguard the legitimate rights and interests of the parties concerned.

Article 2 The term "electronic signature" as mentioned in this Law refers to the data contained in a data message to identify the identity of the signer and show that the signer approves its contents.

The term "data message" as mentioned in this Law refers to information generated, sent, received or stored by electronic, optical, magnetic or similar means.

Article 3 In civil activities, the parties may agree on the use or non-use of electronic signatures and data messages in contracts or other documents and documents.

A document in the form of electronic signature or data message agreed by the parties shall not be denied its legal effect just because it is in the form of electronic signature or data message.

The provisions of the preceding paragraph shall not apply to the following documents:

(a) involving marriage, adoption, inheritance and other personal relationships;

(two) involving the transfer of real estate rights such as land and houses;

(three) involving the cessation of water supply, heating, gas supply, power supply and other public utilities services;

(4) Other circumstances in which electronic documents are not applicable as stipulated by laws and administrative regulations.

[Edit this paragraph] Chapter II Data Messages

Article 4 A data message that can tangibly express its contents and can be retrieved for reference at any time shall be regarded as a written form that meets the requirements of laws and regulations.

Article 5 A data message that meets the following conditions shall be deemed to meet the original form requirements stipulated by laws and regulations:

(a) It can effectively express the content and can be used at any time;

(2) It can reliably ensure that the content remains complete and unchanged from the time it is finally formed. However, adding endorsements to data messages and changing forms in the process of data exchange, storage and display do not affect the integrity of data messages.

Article 6 A data message that meets the following conditions shall be deemed to meet the requirements for document preservation stipulated by laws and regulations:

(a) It can effectively express the content and can be used at any time;

(2) The format of the data message is the same as that when it was generated, sent or received, or the format is different, but it can accurately represent the content originally generated, sent or received;

(3) Being able to identify the sender and receiver of the data message and the time of sending and receiving.

Article 7 Data messages shall not be refused to be used as evidence just because they are generated, sent, received or stored by electronic, optical, magnetic or similar means.

Article 8 When examining the authenticity of data messages as evidence, the following factors shall be considered:

(a) Reliability of the method of generating, storing or transmitting data messages;

(2) the reliability of the method to maintain the integrity of the content;

(3) the reliability of the method used to identify the sender;

(4) Other relevant factors.

Article 9 A data message shall be deemed to have been sent by the sender under any of the following circumstances:

(a) authorized by the sender;

(2) the sender information system automatically sends;

(3) The results of checking the data message by the receiver in accordance with the method approved by the sender are consistent.

Where the parties have otherwise agreed on the matters specified in the preceding paragraph, such agreement shall prevail.

Article 10 In accordance with the provisions of laws, administrative regulations or the agreement of the parties, if the receipt of a data message needs to be confirmed, it shall be confirmed. When the sender receives the receipt confirmation from the receiver, the data message is deemed to have been received.

Article 11 The time when a data message enters an information system beyond the control of the sender shall be regarded as the time when the data message is sent.

If the addressee designates a specific system to receive the data message, the time when the data message enters the specific system shall be regarded as the receiving time of the data message; If no specific system is specified, the time when the data message first enters any system of the addressee shall be regarded as the time of receipt of the data message.

If the parties have otherwise agreed on the time of sending and receiving data messages, such agreement shall prevail.

Article 12 The main business place of the sender is the sending place of the data message, and the main business place of the receiver is the receiving place of the data message. If there is no main place of business, its habitual residence is the sending place or the receiving place.

Where the parties have otherwise agreed on the place of sending and receiving data messages, such agreement shall prevail.

[Edit this paragraph] Chapter III Electronic Signature and Authentication

Thirteenth electronic signatures meet the following conditions at the same time, as reliable:

(1) When the electronic signature production data is used for electronic signature, it belongs to the exclusive rights of the electronic signer;

(2) When signing, the electronic signature production data is only controlled by the electronic signer;

(3) Any changes to the electronic signature after signature can be found;

(4) Any changes to the content and form of the data message after signature can be found.

The parties can also choose to use electronic signatures that meet their agreed reliable conditions.

Article 14 A reliable electronic signature has the same legal effect as a handwritten signature or seal.

Article 15 An electronic signer shall properly keep the electronic signature making data. When the electronic signer knows that the electronic signature production data has been or may have been compromised, he shall promptly inform the relevant parties and stop using the electronic signature production data.

Article 16 Where an electronic signature requires authentication by a third party, a legally established electronic authentication service provider shall provide authentication services.

Article 17 To provide electronic authentication services, the following conditions shall be met:

(1) Having professional and technical personnel and management personnel suitable for providing electronic authentication services;

(2) Having funds and business premises suitable for providing electronic authentication services;

(3) Having technologies and equipment that meet the national safety standards;

(4) Having the certification document that the national password management institution agrees to use the password;

(5) Other conditions stipulated by laws and administrative regulations.

Article 18 To engage in electronic authentication services, an application shall be filed with the competent department of information industry in the State Council, and relevant materials that meet the conditions as stipulated in Article 17 of this Law shall be submitted. After receiving the application, the competent department of information industry in the State Council shall examine it according to law, solicit the opinions of the competent department of commerce and other relevant departments in the State Council, and make a decision of approval or disapproval within 45 days from the date of receiving the application. If the license is granted, an electronic certification license certificate shall be issued; If the license is not granted, it shall notify the applicant in writing and inform the reasons.

The applicant shall go through the enterprise registration formalities with the administrative department for industry and commerce in accordance with the law with the electronic certification license certificate.

An electronic certification service provider that has obtained the certification qualification shall publish its name, license number and other information on the Internet in accordance with the provisions of the competent department of information industry in the State Council.

Nineteenth electronic certification service providers shall formulate and publish electronic certification business rules in line with the relevant provisions of the state, and file with the competent department of information industry in the State Council.

The business rules of electronic authentication shall include matters such as the scope of responsibility, operational norms and information security measures.

Article 20 When applying for an electronic signature certificate from an electronic certification service provider, an electronic signer shall provide true, complete and accurate information.

After receiving the application for electronic signature certificate, the electronic certification service provider shall check the identity of the applicant and review the relevant materials.

Article 21 The electronic signature certification certificate issued by an electronic certification service provider shall be accurate and shall include the following contents:

(1) The name of the electronic certification service provider;

(2) The name of the certificate holder;

(3) the serial number of the certificate;

(4) the validity period of the certificate;

(five) the electronic signature verification data of the certificate holder;

(6) the electronic signature of the electronic certification service provider;

(seven) other contents stipulated by the competent department of information industry in the State Council.

Article 22 An electronic authentication service provider shall ensure that the contents of the electronic signature authentication certificate are complete and accurate within the validity period, and ensure that the relying party of the electronic signature can verify or understand the contents contained in the electronic signature authentication certificate and other related matters.

Article 23 Where an electronic certification service provider suspends or terminates its electronic certification service, it shall notify all parties of the business undertaking and other related matters 90 days before the suspension or termination of the service.

If the electronic certification service provider intends to suspend or terminate the electronic certification service, it shall report to the competent information industry department of the State Council 60 days before the suspension or termination of the service, and negotiate with other electronic certification service providers on business undertaking and make proper arrangements.

If an electronic certification service provider fails to reach a business undertaking agreement with other electronic certification service providers, it shall apply to the competent information industry department of the State Council for arranging other electronic certification service providers to undertake its business.

If the electronic certification service provider has its electronic certification license revoked according to law, the matters it undertakes shall be handled in accordance with the provisions of the competent department of information industry in the State Council.

Article 24 An electronic authentication service provider shall properly keep the information related to authentication for at least five years after the electronic signature authentication certificate expires.

Twenty-fifth the State Council information industry authorities shall formulate specific measures for the administration of electronic authentication services in accordance with this law, and supervise and manage electronic authentication service providers in accordance with the law.

Article 26 Electronic signature authentication certificates issued by electronic authentication service providers in People's Republic of China (PRC) and overseas shall have the same legal effect as those issued by electronic authentication service providers established in accordance with this Law after being approved by the competent department of information industry in the State Council in accordance with relevant agreements or the principle of reciprocity.

[Edit this paragraph] Chapter IV Legal Liability

Article 27 If an electronic signer knows that the electronic signature production data has been or may have been compromised, fails to notify the relevant parties in time, stops using the electronic signature production data, fails to provide true, complete and accurate information to the electronic certification service provider, or has other faults, thus causing losses to the relying party of the electronic signature and the electronic certification service provider, he shall be liable for compensation.

Article 28 If an electronic signer or electronic signature dependent suffers losses from engaging in civil activities based on the electronic signature authentication service provided by an electronic authentication service provider, and the electronic authentication service provider cannot prove his innocence, he shall be liable for compensation.

Twenty-ninth without permission to provide electronic certification services, the competent department of information industry in the State Council shall be ordered to stop the illegal act; Illegal income, confiscate the illegal income; If the illegal income is more than 300,000 yuan, a fine of more than one time and less than three times the illegal income shall be imposed; If there is no illegal income or the illegal income is less than 300,000 yuan, a fine of100,000 yuan but not more than 300,000 yuan shall be imposed.

Article 30 If an electronic certification service provider suspends or terminates the electronic certification service and fails to report to the competent information industry department of the State Council 60 days before the suspension or termination of the service, the competent information industry department of the State Council shall impose a fine of 1 10,000 yuan but not more than 50,000 yuan on the directly responsible person in charge.

Thirty-first electronic certification service providers do not abide by the certification business rules, fail to properly preserve certification related information, or have other illegal acts, and the competent information industry department of the State Council shall order them to make corrections within a time limit; If no correction is made within the time limit, the electronic certification license certificate shall be revoked, and the directly responsible person in charge and other directly responsible personnel shall not engage in electronic certification services within ten years. If the electronic certification license certificate is revoked, it shall be announced and notified to the administrative department for industry and commerce.

Article 32 Whoever forges, fraudulently uses or embezzles another person's electronic signature, which constitutes a crime, shall be investigated for criminal responsibility according to law; If losses are caused to others, they shall bear civil liability according to law.

Article 33 If the staff of the department responsible for the supervision and administration of electronic certification services according to this Law fail to perform their duties of administrative licensing and supervision and administration according to law, they shall be given administrative sanctions according to law; If a crime is constituted, criminal responsibility shall be investigated according to law.

[Edit this paragraph] Chapter V Supplementary Provisions

Article 34 The meanings of the following terms in this Law:

(1) The term "electronic signer" refers to a person who holds electronic signature production data and implements electronic signature in his own capacity or in the name of the person he represents;

(2) The relying party of electronic signature refers to the person who engages in relevant activities based on his trust in the electronic signature certification certificate or electronic signature;

(3) Electronic signature authentication certificate refers to a data message or other electronic record that can prove that the electronic signer is connected with the electronic signature creation data;

(4) Electronic signature production data refers to the characters, codes and other data used in the process of electronic signature to reliably link the electronic signature with the electronic signer;

(5) Electronic signature verification data refers to data used to verify electronic signatures, including codes, passwords, algorithms or public keys.

Article 35 The departments designated by the State Council or the State Council may formulate specific measures for the use of electronic signatures and data messages in government affairs and other social activities in accordance with this Law.

Article 36 This Law shall come into force as of April 6, 2005.