On Electronic Document and Electronic Trust Services

Law of Georgia

On Electronic Document and Electronic Trust Services

Article 1. Purpose and Scope of the Law🔗

1. This Law determines the legal grounds for the use of an electronic document, electronic signature and electronic trust service.

2. This Law does not restrict the right of natural persons and legal entities of private law to use, in accordance with their own choice, a material document and/or personal signature, as well as an electronic document and/or electronic signature executed in accordance with conditions different from this Law.

3. This Law does not restrict the right of the National Bank of Georgia and representatives of the financial sector to use an electronic document and/or electronic signature executed in accordance with conditions different from this Law.

4. The application of this Law shall not extend to information that is recognized as a state secret by the legislation of Georgia and is subject to protection by the State.

Article 2. Definition of terms🔗

The terms used in this Law have the following meaning:

a) Electronic document – a set of textual, voice, visual or audiovisual information and/or data stored in electronic form;

b) Material document – a set of information and/or data presented in paper or another material form;

c) Signatory – a natural person who, in accordance with the requirements of this Law, electronically signs an electronic document;

d) Stamp applier – a legal person that creates an electronic stamp on an electronic document. For the purposes of this Law, "legal person" also means an administrative body, an apartment owners' association, an unregistered union, an association;

e) Electronic signature – a set of electronic data that is attached to or logically linked with an electronic document and is used for signing the electronic document;

f) Electronic stamp – a set of electronic data that is attached to or logically linked with an electronic document and is used to confirm the integrity and correctness of the origin of the electronic document;

g) Electronic signature/electronic stamp verification data – data that are used for verifying an electronic signature/electronic stamp;

h) Electronic signature/electronic stamp creation data – unique data that the signatory/stamp applier uses for creating an electronic signature/electronic stamp;

i) Electronic signature/electronic stamp creation means – a set of software and/or hardware means that is used for creating an electronic signature/electronic stamp;

j) Electronic signature/electronic stamp certificate – a unique electronic document that links the electronic signature/electronic stamp verification data to the signatory/stamp applier and contains at least the name and/or pseudonym of the signatory/the full name and identification code of the stamp applier (if such a code exists);

k) Advanced electronic signature – an electronic signature that meets the following requirements:

k.a) it is linked only to the signatory;

k.b) it makes it possible to identify the signatory;

k.c) it is created using such electronic signature creation data as the signatory, with firm confidence, can use under sole control;

k.d) it is linked to the signed data in such a way that it makes it possible to detect any subsequent change thereof;

l) Qualified electronic signature – an advanced electronic signature that is executed using a qualified electronic signature creation means, on the basis of a qualified electronic signature certificate;

m) Advanced electronic stamp – an electronic stamp that meets the following requirements:

m.a) it is linked only to the stamp applier;

m.b) it makes it possible to identify the stamp applier;

m.c) it is created using the electronic stamp creation data which the stamp applier can, with firm confidence, use under his/her own control;

m.d) it is linked to the stamped data in such a way that it enables detection of their subsequent modification;

n) qualified electronic stamp – an advanced electronic stamp which is executed using a qualified electronic stamp creation device, on the basis of a qualified electronic stamp certificate;

o) qualified electronic signature/qualified electronic stamp creation device – an electronic signature/electronic stamp creation device which meets the following requirements:

o.a) the electronic signature/electronic stamp creation data used in creating the electronic signature/electronic stamp are confidential. The signatory/stamp applier has the right to transfer the right to manage the electronic signature/electronic stamp data to a qualified trust service provider, which is authorised to duplicate these data only for the purpose of creating their backup copy. The procedure for the management of electronic signature/electronic stamp creation data by a qualified trust service provider, as well as for the creation of a backup copy of these data, is determined by the technical regulation mandatory for qualified trust service providers, approved by the Government of Georgia (hereinafter – the technical regulation);

o.b) the electronic signature/electronic stamp creation data used in creating the electronic signature/electronic stamp are unique;

o.c) the electronic signature/electronic stamp creation data used in creating the electronic signature/electronic stamp cannot be derived within reasonable limits, and the electronic signature/electronic stamp is reliably protected against forgery using existing technologies;

o.d) the qualified electronic signature/qualified electronic stamp creation device shall not alter the data to be signed/stamped and shall not prevent the data from being presented to the signatory/stamp applier before signing/stamping;

o.e) other conditions determined by the technical regulation are met;

p) qualified electronic signature/qualified electronic stamp certificate – an electronic signature/electronic stamp certificate which is issued by a qualified trust service provider and which meets the requirements of Article 6 of this Law;

q) time indication – a set of electronic data which links an electronic document to a specific time and is used to confirm the existence of the electronic document at the indicated time;

r) qualified time indication – a time indication issued by a qualified trust service provider which meets the requirements of Article 7 of this Law;

s) trust service – an electronic service the purpose of which is the creation, verification, validation and/or preservation of an electronic signature/electronic seal or time stamp;

t) qualified trust service – a trust service the purpose of which is the creation, verification, validation and/or preservation of a qualified electronic signature/qualified electronic seal or qualified time stamp and of a qualified electronic signature/qualified electronic seal certificate related thereto;

u) qualified trust service provider – a person who is authorised in accordance with this Law and provides one or more qualified trust services provided for by this Law;

v) internal rules – a public statement binding on the qualified trust service provider, concerning the procedure for the provision of services by it;

w) firm conviction – a set of objective circumstances, facts and/or information that provides sufficient grounds for being convinced that the advanced electronic signature creation data are used under the sole control of the signatory, and the advanced electronic seal creation data – under the control of a legal entity.

Article 3. Legal force of electronic signature and electronic stamp🔗

1. A qualified electronic signature shall have the same legal force as a handwritten signature.

2. A qualified electronic stamp enables confirmation of the integrity and correctness of the origin of an electronic document – the integrity and origin of an electronic document shall be considered reliable until the contrary is proved.

3. If a natural person or a legal entity of private law, when interacting with an administrative body, chooses the electronic form of communication and the document submitted by him/her requires a signature and/or stamp, it shall be mandatory to execute a qualified electronic signature and/or affix a qualified electronic stamp on this document. This rule shall not apply to a non-resident person, as well as to the case where the legislation of Georgia does not require the execution of a signature and/or the affixing of a stamp on the document.

4. An administrative body shall be obliged to execute a qualified electronic signature and/or affix a qualified electronic stamp on an electronic document. It is sufficient for the administrative body to affix a qualified electronic stamp on the electronic document.

5. The use of a qualified electronic signature shall not be mandatory in relations between and/or within structural units/subdivisions and territorial bodies of an administrative body. In this case, the electronic document and electronic signature used shall have, respectively, the same legal force as a material document and a handwritten signature.

6. It shall be inadmissible, in administrative proceedings and court proceedings, to refuse an electronic document solely on the ground that it is submitted in electronic form; however, this does not exclude refusal to admit an electronic document in the relevant proceedings if it does not meet the rules established for the said proceedings.

7. It shall be inadmissible, in administrative proceedings and court proceedings, to refuse to grant evidentiary force to an electronic signature and/or electronic stamp solely on the ground that it does not meet the requirements established by this Law for a qualified electronic signature and/or qualified electronic stamp.

8. Notwithstanding the provision of paragraph 1 of this Article, if there is an agreement between natural persons and/or legal entities of private law, the electronic document and electronic signature shall have, for these persons, respectively, the same legal force as a material document and a handwritten signature.

9. When the National Bank of Georgia and representatives of the financial sector carry out activities in accordance with conditions different from this Law, an electronic document and electronic signature executed in accordance with the procedure established by the National Bank of Georgia shall have, respectively, the same legal force as a material document and a handwritten signature.

10. Cases of exemption from the obligations provided for by paragraphs 3 and 4 of this Article shall be determined by a legal act of the Government of Georgia.

Law of Georgia of 9 February 2023 No. 2557 – website, 27.02.2023.

Article 4. Electronic document🔗

1. All copies of an electronic document are originals. An electronic document may not have an electronic copy.

2. An electronic document may be used in all cases where a material document in written form is required, unless otherwise provided by law.

3. A printout of an electronic document is a copy of the electronic document and has the same legal force as the electronic document, if it is certified and/or confirmed by the person responsible for signing or by an authorized person provided for by the legislation of Georgia.

4. An electronic copy of a material document has the same legal force as the original, if it is certified and/or confirmed by the person responsible for signing or by an authorized person provided for by the legislation of Georgia, or by an electronic stamp.

Article 5. Rights and Obligations of a Qualified Trust Service Provider🔗

1. A qualified trust service provider shall be entitled to provide one or more qualified trust services or trust services provided for by this Law and to establish the corresponding fee.

2. A qualified trust service provider shall be obliged to:

a) develop internal rules and ensure their public accessibility for all services that it provides in accordance with this Law. The internal rules shall contain the following information:

a.a) a description of the secure systems, means and procedures used by the qualified trust service provider;

a.b) the grounds and scope of liability insurance of the qualified trust service provider, including compensation for damage caused by the termination of the qualified trust service provider's activity, compensation for damage caused to the certificate holder, the user of the time-stamping service and/or a third party;

a.c) the retention period and procedure for all necessary information related to the qualified trust service by the qualified trust service provider;

a.d) the procedure for the termination of the qualified trust service provider's activity and the transfer of its activity to another person (if such a person exists);

a.e) the amount of the fee established for the qualified trust service, the procedure for its payment and the procedure for possible changes to the payment terms;

a.f) any other condition established by the technical regulation;

b) notify the supervisory body at least 30 calendar days in advance of the expected termination of the qualified trust service;

c) notify the supervisory body and the user of its service at least 14 calendar days in advance of any change made to the internal rules;

d) use only secure systems, means and procedures that ensure the reliability of the service provided by it and the integrity of protected data, verification of the authenticity of data and protection against forgery and unauthorised use. The creation and modification of data shall be permitted only for persons authorised by the qualified trust service provider;

e) have sufficient financial and technical resources and personnel with appropriate qualifications in accordance with the technical regulation;

f) ensure the protection of personal data and the management of information security incidents in accordance with the procedure established by the legislation of Georgia;

g) in order to fulfil the obligations defined by this Law and the technical regulation and to compensate for possible damage, in the case of an administrative body, have sufficient financial resources and guarantees, and in the case of another person – civil liability insurance;

h) develop a service continuity plan and submit it to the supervisory body;

i) fulfil any other requirement established by the technical regulation.

3. If a qualified trusted service provider terminates the provision of services, it shall notify the user of its services thereof at least 30 calendar days in advance. Otherwise, it shall be obliged to compensate the damage caused by the failure to notify.

4. A qualified trusted service provider shall be obliged to compensate the damage caused by the failure to comply with the requirements of this Article, except where the damage is caused by force majeure circumstances.

5. A qualified trusted service provider shall be obliged to ensure the continuity of the service in accordance with the technical regulation.

6. A qualified trusted service provider shall be obliged to notify the supervisory body, no later than 24 hours, of a breach of the security of its systems or of data integrity, or of any other event that may pose a significant threat to the conduct of the activity defined for it by this Law and the technical regulation.

7. A qualified trusted service provider is entitled to develop additional protection mechanisms in connection with the service provided by it.

Article 6. Qualified electronic signature/qualified electronic stamp certificate🔗

1. A qualified electronic signature/qualified electronic stamp certificate shall contain at least:

a) a machine-readable indication that the certificate is issued as a qualified electronic signature/qualified electronic stamp certificate;

b) a set of data sufficient for the identification of the qualified trust service provider: at least the name of the qualified trust service provider and the code of the country in which it is registered;

c) a set of data sufficient for the identification of the signatory/stamp creator: at least the name and/or pseudonym/full name and identification code;

d) the data for the validation of the qualified electronic signature/qualified electronic stamp which correspond to the data for the creation of the qualified electronic signature/qualified electronic stamp;

e) the dates of the beginning and the end of the validity of the certificate;

f) the identification number of the certificate, which is unique for the trust service provider;

g) the electronic address of the electronic service which may be used to request the validity status of the certificate;

h) a machine-readable indication that the data for the creation of the electronic signature/electronic stamp are located in a qualified means of creating an electronic signature/electronic stamp (where such data are located in such a means).

2. A qualified electronic signature/qualified electronic stamp certificate shall have the advanced electronic signature/advanced electronic stamp of the qualified trust service provider.

3. At the request of the certificate holder, within the scope defined by the internal rules, the qualified electronic signature/qualified electronic stamp certificate may contain additional data. The qualified trust service provider shall be entitled to enter additional data in another electronic document related to the qualified electronic signature/qualified electronic stamp certificate (qualified certificate of attributes), which shall meet the following requirements:

a) it shall contain data by which the qualified electronic signature/qualified electronic stamp certificate can be identified;

b) it shall have the advanced electronic signature/advanced electronic stamp of the qualified trust service provider.

4. The rules for placing and managing information in a qualified electronic signature/qualified electronic stamp certificate shall apply to the qualified certificate of attributes.

5. A qualified trust service provider which provides services related to a qualified electronic signature/qualified electronic seal certificate, in addition to meeting the requirements of Article 5 of this Law, shall be obliged to:

a) in accordance with the technical regulation, identify the natural or legal person to whom the certificate is issued;

b) when issuing the certificate, ensure the accuracy of the data contained therein;

c) in cases provided by law, ensure the immediate revocation of the certificate;

d) in cases provided by law, ensure the suspension of the certificate's validity and the re-activation of the certificate, if this service is provided for by the internal rules;

e) maintain a database of the qualified electronic signature certificates issued by it and ensure its updating;

f) in the case of an application by an interested person, immediately, by means of the Internet, in continuous mode, provide him/her with information on the validity status of the certificate or the revocation of the certificate;

g) ensure the recording of the certificates issued by it, as well as of all data and facts related thereto, and their storage for at least 6 years from the revocation of the certificates (in individual cases determined by the internal rules – for more than 6 years) and the precise indication of the respective time, which may be used during legal proceedings or for the purposes of continuity of the service;

h) in cases provided by the legislation of Georgia, issue the identification data of the holder of a certificate registered under a pseudonym.

6. The following information shall additionally be provided in the internal rules:

a) description of the qualified electronic signature/qualified electronic seal creation device;

b) the procedure for issuing a certificate;

c) the scope of services related to the certificate, including the issues of the use of a pseudonym and the issuance of a certificate containing the data indicated in paragraph 3 of this Article;

d) the scope of validity of the certificate;

e) the rules for recording and storing issued certificates;

f) the rules for the creation and storage of qualified electronic signature/qualified electronic seal creation data and qualified electronic signature/qualified electronic seal validation data;

g) the rules and technical procedures for the suspension of the certificate's validity, the re-activation of the certificate and the revocation of the certificate.

Article 7. Qualified time stamp🔗

1. A qualified time stamp provides a presumption of the accuracy of the time and date, as well as of the data set related to this time and date.

2. A qualified time stamp shall meet the following requirements:

a) The time and date shall be linked to the data in such a way that any subsequent change to the time, date and data can be detected;

b) A qualified time stamp shall be based on an accurate time source that is linked to Coordinated Universal Time (UTC).

3. A qualified time stamp shall have the advanced electronic signature/advanced electronic seal of a qualified trust service provider.

4. A qualified trust service provider that provides services related to qualified time stamps, in addition to meeting the requirements of Article 5 of this Law, shall be obliged to:

a) maintain, on a continuous basis, a database of qualified time stamps issued by it and ensure its accessibility;

b) not to issue a qualified time stamp if it establishes that the time indicated by the qualified trust service provider exceeds the maximum permissible deviation from Coordinated Universal Time (UTC) provided for in the internal rules.

5. In the internal rules, which determine the procedure for the provision of qualified time stamp services, the following information shall additionally be provided:

a) the sources of Coordinated Universal Time (UTC) used for the provision of the service;

b) the maximum permissible deviation from Coordinated Universal Time (UTC) when issuing a qualified time stamp.

Article 8. Qualified validation of qualified electronic signature/qualified electronic seal🔗

1. Qualified validation of a qualified electronic signature/qualified electronic seal shall be carried out subject to the following conditions:

a) at the time of creating the qualified electronic signature/affixing the qualified electronic seal, that signature/seal shall be based on a qualified electronic signature/qualified electronic seal certificate;

b) the qualified electronic signature/qualified electronic seal certificate shall be issued by a qualified trust service provider and shall be valid at the time of use of the qualified electronic signature/qualified electronic seal;

c) the validation data of the qualified electronic signature/qualified electronic seal shall correspond to the data presented to the party receiving the qualified validation service of the qualified electronic signature/qualified electronic seal (relying party);

d) the set of data that uniquely identifies the signatory/creator of the seal and is indicated in the certificate shall exactly correspond to the data presented to the relying party;

e) if the qualified electronic signature is created using a pseudonym, the relying party shall be notified thereof;

f) the qualified electronic signature/qualified electronic seal shall be created using a qualified electronic signature/qualified electronic seal creation device;

g) the integrity of the signed data shall be ensured;

h) when using the qualified electronic signature/qualified electronic seal, the requirements laid down by this Law for an advanced electronic signature/advanced electronic seal shall be ensured.

2. The system used for the qualified validation of a qualified electronic signature/qualified electronic seal shall provide the relying party with information on the fulfilment of the conditions defined by paragraph 1 of this Article and shall enable the detection of any issue related to data security.

3. Qualified validation of a qualified electronic signature/qualified electronic seal shall be carried out by a qualified trust service provider which:

a) validates the qualified electronic signature/qualified electronic seal in accordance with the requirements of this Article;

b) automatically provides the relying party with reliable information on the validation of the qualified electronic signature/qualified electronic seal, which bears the advanced electronic signature/advanced electronic seal of the qualified trust service provider.

Article 9. Qualified preservation of qualified electronic signature/qualified electronic stamp🔗

A qualified trust service provider is entitled to provide qualified preservation service for a qualified electronic signature/qualified electronic stamp, which implies extension of the reliability of the qualified electronic signature/qualified electronic stamp after expiry of its technological validity period.

Article 10. Revocation, Suspension and Reactivation of a Qualified Electronic Signature/Qualified Electronic Stamp Certificate🔗

1. In the event of revocation of a qualified electronic signature/qualified electronic stamp certificate, its reactivation shall be inadmissible. A qualified electronic signature/qualified electronic stamp that is created/affixed after the revocation of the qualified electronic signature/qualified electronic stamp certificate shall be void.

2. Upon revocation, suspension and reactivation of a qualified electronic signature/qualified electronic stamp certificate, the respective time and date shall be indicated, which are based on an accurate time source linked to Coordinated Universal Time (UTC). It shall be inadmissible to carry out these actions by indicating a past time and date. The qualified trust service provider shall immediately record the revocation, suspension and reactivation of the qualified electronic signature/qualified electronic stamp certificate, indicating the respective time and date.

3. The qualified trust service provider shall be entitled to offer to the user of its service the service of suspension of the qualified electronic signature/qualified electronic stamp certificate, which implies temporary suspension of the certificate's validity. The qualified trust service provider shall be obliged, at the moment of suspension of the qualified electronic signature/qualified electronic stamp certificate, to publish information about its suspension and to ensure the accessibility of this information throughout the entire period of suspension of the said certificate.

4. The validity of a qualified electronic signature/qualified electronic stamp certificate shall be suspended:

a) on the basis of the request of the certificate holder;

b) on the basis of a reasoned request of the supervisory body;

c) by the qualified trust service provider, in a case defined by the internal rules;

d) in other cases provided by the legislation of Georgia.

5. The initiator of the suspension of the validity of the said certificate or a person authorized by the legislation of Georgia may request the reactivation of a qualified electronic signature/qualified electronic stamp certificate whose validity has been suspended.

6. A qualified electronic signature/qualified electronic stamp certificate shall be revoked:

a) on the basis of the request of the certificate holder;

b) after 10 calendar days have elapsed from the suspension of the certificate's validity, if during this period the said certificate was not reactivated;

c) by the qualified trust service provider, in a case defined by the internal rules;

d) in the event of termination of the provision of services by the qualified trust service provider, if the authority to issue the qualified electronic signature/qualified electronic stamp certificate and to provide the service was not transferred to another person;

e) in other cases provided for by the legislation of Georgia.

7. A qualified trust service provider shall immediately notify the holder of a qualified electronic signature/qualified electronic seal certificate of the revocation, suspension and reactivation of the qualified electronic signature/qualified electronic seal certificate.

Article 11. Authorization of a Qualified Trust Service Provider and Supervision of Its Activities🔗

1. A person who wishes to become a qualified trust service provider shall undergo authorization in a Legal Entity of Public Law operating in the area of governance of the Ministry of Justice of Georgia − the Digital Governance Agency (hereinafter − the Digital Governance Agency), in order to determine the compliance of its activities with this Law and the technical regulation.

2. For the purpose of supervising the activities of a qualified trust service provider, the Digital Governance Agency performs the following functions:

a) as necessary, but at least once every 2 years, verifies the compliance of the activities of a qualified trust service provider with this Law and the technical regulation;

b) in the cases provided for by this Law and the technical regulation, responds to violations detected in the activities of a qualified trust service provider;

c) suspends or revokes the authorization of a qualified trust service provider;

d) maintains and publishes a list of qualified trust service providers and the services offered by them.

3. A person who wishes to become a qualified trust service provider shall submit to the Digital Governance Agency:

a) an application;

b) an audit report on the compliance of its activities with this Law and the technical regulation;

c) relevant documentation which, in the case of an administrative body, confirms that it possesses sufficient financial resources and guarantees, and in the case of another person − the existence of insurance for its civil liability;

d) internal rules.

4. The Digital Governance Agency is entitled, if necessary, to require it to submit additional documentation/information for the purpose of assessing the security of the system and the continuity of the activities of the person wishing to be authorized. The additional documentation/information to be submitted shall be determined by the Order of the Minister of Justice of Georgia provided for by paragraph 8 of this Article.

5. The Digital Governance Agency is entitled to refuse authorization to a person wishing to be authorized if:

a) it submitted documentation/information incompletely and/or inaccurately;

b) its activities do not comply with this Law and the technical regulation.

6. If the person wishing to be authorized submitted documentation/information incompletely and/or inaccurately, the Digital Governance Agency shall set a time limit for it to eliminate the defect. If the defect is not eliminated within this time limit, the Digital Governance Agency is entitled to refuse authorization, however, this does not deprive the person wishing to be authorized of the right to apply again to the Digital Governance Agency with a request for authorization.

7. The Digital Governance Agency is entitled, in the event of non-compliance by a qualified trust service provider with the requirements provided for by this Law and the technical regulation, to suspend or terminate its authorization.

8. The procedure for authorisation of a qualified trust service provider and supervision of its activities shall be determined by an Order of the Minister of Justice of Georgia.

Law of Georgia of 12 June 2020 No. 6298 – website, 26.06.2020.

Article 12. Recognition of qualified trust services operating abroad or of international organisations🔗

Qualified trust services operating abroad or of international organisations shall, in accordance with this Law, have equal legal force to qualified trust services operating in Georgia, if Georgia has concluded an appropriate international treaty on the recognition of qualified trust services.

Article 13. Transitional provisions🔗

1. Before 1 July 2018, the Legal Entity of Public Law operating in the field of governance of the Ministry of Justice of Georgia – the State Services Development Agency shall be considered a qualified trust service provider.

2. An electronic document retrieved from an information system before 1 January 2018 shall have equal legal force to a material document, if the said system ensures automatic confirmation of the electronic document. During the same period, the operation of paragraph 3 of Article 4 of this Law shall not extend to the case provided for by this paragraph.

3. An electronic document and electronic signature used by an administrative body before 1 July 2018 shall have, respectively, equal legal force to a material document and a personal signature.

4. On the basis of a digital signature certificate issued before the entry into force of this Law by the Legal Entity of Public Law operating in the field of governance of the Ministry of Justice of Georgia – the State Services Development Agency, an electronic signature executed during its validity period shall have equal legal force to a qualified electronic signature.

5. The Government of Georgia shall:

a) approve, before 1 October 2017, an action plan for the implementation of the provisions of this Law, which contains measures aimed at ensuring the introduction and use of at least qualified electronic signature/qualified electronic stamp in the country;

b) approve, before 1 March 2018, the technical regulation mandatory for a qualified trust service provider.

6. Before 1 March 2018, the Minister of Justice of Georgia shall approve the procedure for authorisation and supervision of a qualified trust service provider.

Article 14. Final provisions🔗

1. The Law of Georgia of 14 March 2008 "On Electronic Signature and Electronic Document" (Legislative Herald of Georgia, No. 7, 26.03.2008, Art. 46) shall be declared invalid.

2. This Law, except for paragraphs 3 and 4 of Article 3 and Article 11 of this Law, shall enter into force upon publication.

3. Paragraphs 3 and 4 of Article 3 and Article 11 of this Law shall enter into force from 1 July 2018.

President of Georgia Giorgi Margvelashvili

Kutaisi,

21 April 2017

No. 639-IIs