Experience airSlate SignNow to eSign and export data to CSV when dealing with your company and private documents.
This system permits users to customize any form, contract or other kind of documentation and approve it having a legally-binding signature that is recognized by governmental authorities. All documents contained in an airSlate SignNow account are safeguarded with high-level encryption and each of them will get its individual one of a kind identification number immediately after becoming executed.
airSlate SignNow's capabilities provide a variety of opportunities which make the completion and signing process a breeze. Easily insert fillable fields and label them, assign specific roles for various recipients, and gather payments while signing a document. By turning a form or agreement into a template, users will be able to make use of it several times while preventing monotonous and repetitive steps.
They are able to then distribute it to as many recipients as required.
GDPR compliance in eSigning
Back in 2018, GDPR became the biggest legal hype worldwide despite the fact this legislation change seems to be applicable (at first glance!) to the EU area only.
GDPR stands for General Data Protection Regulation. It came into effect in May 2018 to become the most significant legal change in the field of information security in Europe.
GDPR overall covers a really wide scope of issues - from online behavior and cookies's use by sites up to formulation of new rules on the use of personal data for marketing purposes.
In relation to eSigning specifically, GDPR covers the following provisions:
1.Consent for online storage of personal information must be explicit. All users must be well informed what sort of data on them will be stored, where exactly and for how long. Also, all users of line services must have an option to request full deletion of their personal data, at any point of time.
2. Two key roles have been officially introduced into the process of eSignature service provision - data controller and data processor.
Data controller: an individual responsible for determining which data is to be processed and in what way. A customer, basically.
Data processor: an individual (or a legal entity) responsible for data processing on behalf of data controller.
Data processor also has the right to assign data subprocessors to assist in data processing but in this case, data processor will be responsible for making sure subprocessors are also GDPR compliant.
3. Physical location/legal address of a service provider is not important for GDPR compliance. If a company processes personal data of the EU residents, it must be GDPR compliant, even if its head office is somewhere overseas. In other words, personal data of European customers must be processed and stored within the same region, that is, on European servers.
Here is how this switch between the servers is realized in airSlate SignNow, for example:
4. According to GDPR regulation, all customers, at any point of service use, have the right to request information on what sort of their personal data is stored, where exactly and how it is processed further. For this reason, many companies preparing to be GDPR compliant, have rewritten (or wrote from scratch) the so-called data processing addendums.
You can read the full text of GDPR-compliant data processing addendum HERE.
5. In case of data breach or leakage, data processor is legally responsible for informing the affected data controllers about this fact and also the data protection body of an EU country the citizens of which has been affected.
When you are choosing an eSigning tool for your office and you know that you will need a GDPR-compliant solution, things to pay attention to include the following:
- GDPR policy of the service provider along with the data processing addendum must be explicitly presented directly on the site (preferably as a separate page with all the details)
- In the text of their GDPR policy, types of personal information to be stored should be specified in a clear and exact way
- The procedure of user data full deletion is easy to find and can be requested at any point of time.
