GDPR and electronic signatures

The General Data Protection Regulation (GDPR) governs how personal data about people in the European Union is collected, processed, and stored — and an e-signature platform handles personal data by definition, since names, email addresses, and identifying details about signers are part of every signature request. GDPR doesn't specifically regulate electronic signatures as a category (that's what the eIDAS Regulation (EU) No 910/2014 does), but it applies to the personal data involved in the signing process itself.

The controller and processor distinction

GDPR distinguishes between a data controller (the party that decides why and how personal data is processed — typically you, the business sending documents for signature) and a data processor (the party that processes that data on the controller's behalf — typically the e-signature platform itself). Esignapi describes its own role specifically as acting as a processor of your documents, not analyzing, selling, or sharing their content with third parties. Understanding this distinction matters because, as the controller, your own business generally carries the primary GDPR compliance obligations toward the individuals whose data you're collecting (your signers), even while relying on a processor to handle the technical processing.

What this means practically for a business sending documents

If you're based in the EU, or you're sending documents to signers in the EU, you're generally the one responsible for having a lawful basis for processing their personal data (name, email, and whatever's in the document itself), being transparent with signers about how their data is used, and ensuring your chosen platform (as your processor) handles that data appropriately on your behalf.

What to look for in a platform acting as your processor

A clear description of its role, ideally stating explicitly that it acts as a processor and doesn't use document content for unrelated purposes like analysis or resale.
Appropriate technical security measures, since GDPR specifically requires processors to implement security appropriate to the risk — encryption in transit and at rest (see AES-256 and TLS 1.3 explained for document signing) is part of what that typically looks like in practice.
A data processing agreement (DPA), if your organization's compliance process requires one — check directly with the vendor whether this is available and what it covers.
Clarity on data retention and deletion, since GDPR gives individuals certain rights regarding their own personal data, and your processor's retention practices affect how you can honor those rights.

An e-signature audit trail necessarily includes personal data — names, email addresses, IP addresses, timestamps — as part of proving who signed what and when. This creates a genuine tension worth being aware of: the record that makes a signature evidentially strong is itself personal data subject to GDPR's requirements, which is part of why retention practices and data minimization (collecting only what's actually needed for the evidentiary record) matter on both sides of the relationship.

GDPR can still apply if you're processing personal data of individuals located in the EU, regardless of where your own business is based — this is a common point of confusion. If your signers are sometimes located in the EU, it's worth confirming your own obligations rather than assuming GDPR only applies to EU-headquartered businesses.

Esignapi states that it is GDPR compliant, and describes its role as acting solely as a data processor for your documents, with encryption at rest and in transit as its primary technical safeguard. For the specifics of any data processing agreement or sub-processor arrangements relevant to your organization's own compliance obligations, check directly with current account or legal documentation rather than assuming based on general marketing language.

This isn't a substitute for your own compliance review

This article explains how GDPR generally relates to e-signature platforms — it isn't a substitute for your own organization's compliance review, particularly if you handle especially sensitive categories of personal data or operate in a regulated industry with additional requirements layered on top of GDPR's general baseline.

Sub-processors and where your data actually travels

A data processor (the e-signature platform) may itself rely on sub-processors — cloud hosting providers, email delivery services for sending signing links — which handle personal data on the processor's behalf as part of delivering the overall service. Under GDPR, a processor is generally expected to disclose its sub-processors and ensure they meet equivalent data protection standards. If this level of detail matters for your organization's own compliance review, it's reasonable to ask a vendor directly which sub-processors are involved and where they're located, rather than assuming based on general marketing language.

International data transfers, in brief

If a platform's infrastructure or sub-processors are located outside the EU, GDPR has specific requirements around transferring personal data internationally — typically relying on mechanisms like standard contractual clauses to maintain an equivalent level of protection. This is a genuinely technical area of GDPR compliance, and if your organization has specific requirements around where EU personal data is stored or processed, it's worth confirming directly with any vendor rather than assuming based on where their website says they're headquartered.

A reminder on where responsibility actually sits

It's worth repeating the core point from earlier: as the controller, your own organization carries the primary responsibility for GDPR compliance toward your signers, even while a processor handles the technical side of signing. Choosing a processor with reasonable safeguards is a necessary part of meeting that responsibility, but it doesn't transfer the responsibility itself away from your own organization.

When to involve your own legal or compliance team

For routine, low-sensitivity documents, the general guidance here is usually sufficient. For anything involving especially sensitive personal data, large volumes of EU signer data, or a regulated industry with its own additional requirements, looping in your own legal or compliance team before relying on a general-purpose platform is the more prudent approach.

Review Esignapi's data practices

Esignapi's security page and privacy documentation describe its data handling and processor role in detail.

Frequently asked questions

No — GDPR governs personal data handling generally, while frameworks like eIDAS specifically address electronic signature validity and tiers. The two regulations address different, related questions.

Am I the data controller or the e-signature platform?

Generally, you (the business sending the document) are the controller, since you decide why and how the signer's personal data is being processed, while the platform acts as a processor carrying out that processing on your behalf.

GDPR generally requires data to be retained no longer than necessary for the purpose it was collected for, which means retention practices should be considered deliberately rather than keeping records indefinitely by default — though legal or evidentiary needs can be a legitimate reason for longer retention in specific cases.

Can EU signers request their personal data be deleted from a signature platform?

Individuals generally have rights under GDPR regarding their own personal data, though these rights can be balanced against a legitimate need to retain records for legal or evidentiary purposes — this is a nuanced area worth reviewing with your own compliance process if it comes up.

No — these address different things. GDPR compliance concerns personal data handling; eIDAS compliance concerns the electronic signature's legal validity and tier. A platform can address both, but one doesn't automatically imply the other.