Many business owners in Egypt have heard of the Electronic Signature Law No. 15 of 2004, but few have read it or know what follows from it in practice. The result is one of two situations: a company that fears electronic signatures because it thinks they are not recognised, or a company that uses them with no safeguards and is surprised on the day of a dispute that what it holds is not enough to prove its case. The law is in fact clear in its basic idea: the electronic signature is recognised, but its evidentiary force is tied to conditions that must be met.
In this article we explain the law in simple terms, away from legislative drafting: why it was issued, its key definitions, the conditions to which it ties evidentiary force, the role of the Information Technology Industry Development Agency (ITIDA), and what the Executive Regulations issued by Decree No. 109 of 2005 added. We link each point to what it means for you in practice, with the common mistake and an applied example, then a checklist and frequently asked questions at the end.
1. Why was the law issued?
Why it matters: Understanding the purpose helps you interpret any situation the text does not expressly address. Before 2004 the Law of Evidence was built on the paper document and signing by signature, seal or fingerprint, and it was not clear how electronic documents should be treated. With the spread of e-commerce and online banking, a framework became necessary to give these transactions legal value.
What the law achieved: It recognised electronic writing, the electronic document and the electronic signature, and within civil, commercial and administrative transactions gave them the same evidentiary force that the Law of Evidence gives to writing, documents and signatures, provided they meet the conditions. At the same time it established a system for licensing electronic certification providers and entrusted supervision of it to ITIDA.
The common mistake: Thinking the law recognises only one type of electronic signature, the token signature. The correct position is that the law defines the electronic signature broadly, then ties the full evidentiary force it provides to conditions, and gives a signature tied to a certificate issued by a licensed provider a strong standing in evidence.
Example: An e-commerce company sells through its website and asks the customer to accept the terms and conditions with a click of a button. This acceptance is an electronic expression of will, and the law does not deny it, but its strength in evidence in a dispute will depend on what the company has preserved to show that this particular customer is the one who agreed.
2. The most important definitions in the law
Why it matters: The definitions are the keys with which the whole law is read, and any dispute will begin with the question: does what we have fall within the definition of an electronic document and an electronic signature?
| Term | Simplified meaning | What it means for you |
|---|---|---|
| Electronic writing | Letters, numbers or symbols fixed on an electronic medium and capable of being perceived | The contract text on screen is recognised writing |
| Electronic document | A data message containing information created, stored or sent electronically | The contract file itself is a document with evidentiary value |
| Electronic signature | What is placed on the document in any form and has a distinctive character that identifies the signatory | The form is free; what matters is identifying the person |
| Signatory | The person holding the signature creation data who signs on his own behalf or on behalf of the person he represents | You may sign on behalf of another with authority |
| Electronic certification certificate | A certificate issued by a licensed provider proving the link between the signatory and the signature creation data | It is the basis of token signing |
| Electronic certification provider | An entity licensed to issue certificates and provide signature services | You obtain your certificate from it |
The common mistake: Overlooking that the law speaks of "signature creation data" and the signatory's control over it. If the means is in someone else's hands, for instance an employee runs his manager's email and signs from it, the link to the true owner is weakened.
Example: A sales manager asks his secretary to sign contracts in his place from his email. The signature here in fact comes from another person, and if the manager later denies it, proving that it came from him will be difficult. The right course is for him to sign himself, or to authorise someone in writing and have the authorised person sign in that capacity.
3. Conditions for the evidentiary force of an electronic signature
Why it matters: This is the heart of the law. Evidentiary force is not granted automatically to any electronic signature, but to one that meets particular controls, which the Executive Regulations detail technically. The conditions can be summarised in three easy-to-remember ideas.
- The signature is linked to the signatory alone: the signature must have a character that points to a specific person and no one else.
- The signatory alone controls the signing medium: the signing tool, such as the private key, the code or the account, must be in his hands alone at the time of signing.
- Any alteration or substitution can be detected: it must be possible to discover any change made to the data of the document or the signature after it was created.
How to achieve them in practice: The first condition is met by verification means such as a code sent to the signatory's number or email, identity verification by matching the face to an official document, and the digital certificate. The second is met when the code or certificate is in the signatory's hands alone and is used once. The third is met by the document fingerprint and the digital signature on the file, so any change after signing alters the fingerprint.
| Condition | Means of achieving it | Evidence you present in a dispute |
|---|---|---|
| Link to the signatory | Verification code, identity verification, digital certificate | Log of code sending and entry, verification result |
| Control of the medium | A personal link for each party, a one-time code, a token with a password | Event log, device and network address |
| Detecting alteration | Document fingerprint, digital signature on the file, timestamp | Fingerprint match on the verification page |
The common mistake: Focusing on the first condition and neglecting the third. Some verify the signatory's identity well, then store the contract in an ordinary editable file, leaving the question "is this the text that was signed?" unanswered.
Example: A supplier claims that the quantity agreed in the contract was one thousand units, not two thousand. If the contract's fingerprint is preserved and fixed with a timestamp, matching the fingerprint settles that the text saying two thousand is the very one that was signed, with no need for witnesses or correspondence.
4. The role of ITIDA and certification providers
Why it matters: The law established the Information Technology Industry Development Agency and made its tasks include issuing licences to practise electronic signature services and supervising licensed providers. This means there are specific entities that issue certified certificates, and not every technology company is a certification provider.
How this works in practice: You apply to a licensed certification provider, which verifies your identity in person or through the procedures it adopts, then issues you a digital certificate usually stored on a small device called a token. When you sign with this token, your signature carries the certificate data that links it to you, and any party can verify it by referring to the provider's chain of trust.
The common mistake: Confusing a certification provider with a signing platform. An electronic signature platform is a tool for managing contracts, sending them, collecting signatures and preserving evidence, and it may accept token signing with certificates issued by a licensed provider, but it is not the one that issues the certificate. The Wthaiq platform is of this kind: it is not a licensed certification provider, but it allows parties to sign with their tokens issued by licensed providers, verifies the certificate and records the result of the verification in the contract's record.
Example: A contracting company signs a contract with an entity that requires signing with a certified certificate. The company's manager obtains a token from a licensed provider, then signs the contract through the platform the company uses, so the contract combines the strength of the certificate with the ease of sending and follow-up.
5. What did the Executive Regulations add?
Why it matters: The law laid down principles, and the Executive Regulations, issued by Decree No. 109 of 2005 of the Minister of Communications and Information Technology, set out the technical and procedural details. Whoever wants to understand how the conditions are met on the ground needs to know the broad outline of these regulations.
- Technical controls: They set the technical standards for creating a signature and verifying it, including reliance on public-key technologies and digital certificates.
- Controls on proving the time of creation: They address the importance of proving the time a document and signature were created, which timestamp services achieve.
- Conditions for licensing certification providers: They set the requirements a provider must meet before obtaining an ITIDA licence.
- Certificate data: They specify what a certification certificate must contain about its holder, the issuing provider and the period of validity.
The common mistake: Believing that the regulations impose one type of technology on all transactions. The regulations set the controls for full evidentiary force, but everyday transactions may also be proved by other evidence that the judge assesses.
Example: A monthly service contract signed with a verification code, an event log, a fingerprint and a timestamp. It may not reach the level of a signature with a certified certificate, but it provides coherent evidence of who signed, when, and the integrity of the text, evidence that carries weight when assessed.
6. Scope of the law and its limits
Why it matters: The law grants evidentiary force in civil, commercial and administrative transactions, but some acts are subject to special formal rules in other laws. Knowing the limits protects you from building a whole transaction on a basis that is not enough.
How to deal with it: Before moving any type of contract to electronic signature, ask: does the law require this act to be notarised before an official body or to take a particular form? If the answer is yes, an electronic signature may be one stage and not a substitute for the official procedure. Examples include registering real estate dispositions with the Real Estate Registry and certain personal status procedures.
The common mistake: Signing a real estate sale contract electronically and then assuming that this makes registration unnecessary. The contract may create obligations between the parties, but the transfer of ownership against third parties is subject to registration procedures.
Example: A real estate development company uses electronic signature for reservation forms and preliminary sale contracts and their addenda, and leaves the final registration procedures to the official track. It shortens the time in the early stages without confusing the two. It states in each form that official registration takes place later under the prescribed procedures, so the buyer does not think the electronic signature replaces it.
7. How to apply the law in your company
Moving from understanding the law to applying it requires specific decisions. These are practical steps you can start with:
- Classify your contracts by risk: low, medium and high.
- Set the verification level for each category: verification code, identity verification, or signature with a certified certificate.
- Add the electronic dealing declaration to your templates.
- Choose a platform that preserves the three kinds of evidence: the link to the signatory, control of the medium, and detection of alteration.
- Keep the evidence record with every contract.
The declaration in the template might read as follows:
The Parties agree that this Contract is concluded and signed by electronic means in accordance with the Electronic Signature Law No. 15 of 2004 and its Executive Regulations, that each of them regards the electronic signature issued by him as binding on him, and that each accepts the electronic document and the record of its evidence as admissible in proof.
On the Wthaiq platform a document fingerprint, a timestamp, an audit log and an evidence record are kept for every contract, and the level of verification can be raised to identity verification through a specialised external provider or to token signing when the contract requires it.
Compliance checklist for the law
- Does the signature point to a specific person and no one else?
- Is the signing means under the signatory's sole control?
- Can any change to the contract after signing be detected?
- Is the time of signing fixed with a timestamp from an independent party?
- Does this type of contract need an official form or additional notarisation?
- Is the transaction of high enough value to call for a signature with a certified certificate?
- Does the contract include the electronic dealing declaration?
Frequently asked questions
Is Law No. 15 of 2004 still in force?
Yes. It is the basic framework for electronic signatures in Egypt, together with its Executive Regulations and the regulatory decisions issued by ITIDA.
Does the law recognise signing with a verification code?
The broad definition of the electronic signature covers it, and its strength in evidence depends on how far it meets the conditions of linkage, control and detection of alteration, and on the evidence preserved with it.
Which body grants electronic certification licences?
The Information Technology Industry Development Agency (ITIDA), which supervises licensed certification providers.
Are electronic signature platforms certification providers?
Not necessarily. Most platforms are tools for managing signing and evidence, while certification providers are the licensed bodies that issue certificates.
Is the law suitable for contracts with parties outside Egypt?
The law governs transactions subject to Egyptian law. In international contracts the agreed governing law is observed, and it is advisable to state it expressly in the contract.
Must I cite the law in the text of the contract?
It is not a condition for the validity of the contract, because the law applies to the transactions subject to it whether or not it is mentioned. But citing it in the electronic dealing clause removes any ambiguity and shows that both parties expressly agreed to conclude and sign the contract by electronic means and to rely on its evidence, which closes the road to any party who later tries to argue that he did not know his electronic signature was binding on him.
Conclusion
Electronic Signature Law No. 15 of 2004 did not stop at recognising the electronic signature; it set clear conditions for it: that it be linked to the signatory, that it be under his control, and that any later alteration be detectable. If you build your procedures on these conditions, your electronic contract becomes evidence that carries weight. And if you want to apply this without technical complexity, start by sending your contracts through the Wthaiq platform and keep each contract's evidence record in your archive.
This article is for general awareness and does not constitute legal advice.