Canada: e-signature laws and PIPEDA
Portant provides simple electronic signatures. Under Canada's provincial and territorial e-signature laws, a document cannot be refused legal effect only because it is electronic, and a legal requirement for a signature can generally be met by an electronic signature. Most of these acts exclude some documents, such as wills and some powers of attorney (listed below). Portant does not verify a signer's identity.
Electronic signatures in Canada are mainly governed by provincial and territorial law. Each province and territory has its own act, and the names differ: Ontario has the Electronic Commerce Act, 2000, while British Columbia and Alberta each have an Electronic Transactions Act. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) covers how businesses handle personal information. Its Part 2 covers electronic documents only where a federal law calls for paper.
This page is general information, not legal advice. For regulated or high-value documents, check with a lawyer.
Overview of Canada's e-signature and privacy laws
Two kinds of law apply when you sign electronically in Canada. Provincial and territorial acts give electronic documents and signatures legal effect. Privacy laws cover the personal information in them.
Provincial and territorial e-signature acts
- Where: Each province and territory has its own act. Examples are Ontario's Electronic Commerce Act, 2000, British Columbia's Electronic Transactions Act, Alberta's Electronic Transactions Act, and Quebec's Act to establish a legal framework for information technology.
- Key point: A document cannot be refused legal effect only because it is electronic, and a legal requirement for a signature can generally be met by an electronic signature. Some documents are excluded, and some documents named in regulations need a more reliable signature.
PIPEDA (Personal Information Protection and Electronic Documents Act)
- Where: Federal. Part 1 covers private-sector organizations that collect, use or disclose personal information in commercial activities. In Alberta, British Columbia and Quebec, the province's own private-sector privacy law generally applies instead to activity inside the province. PIPEDA still applies there to federally regulated businesses, such as banks and telecoms, and to personal information that crosses provincial or national borders.
- Key point: Part 1 sets privacy rules, including that personal information is protected by safeguards suited to its sensitivity. Part 2 applies only where a federal law calls for paper records or signatures. It does not by itself make private contracts valid.
When and where these laws apply
- Type of transactions: The provincial acts apply to most documents and records, including contracts and other business documents, apart from the documents each act excludes.
- Jurisdictions: Check the e-signature act of the province or territory whose law governs your document. PIPEDA covers private-sector organizations across Canada, except that Alberta's, British Columbia's and Quebec's own private-sector privacy laws generally apply instead to activity inside those provinces. PIPEDA still applies to federally regulated businesses and to information that crosses borders. Some provinces, including Ontario, also have health-information laws that apply instead of PIPEDA to health information custodians.
- Consent: No one has to use or accept an electronic document without their consent. Consent can be inferred from a person's conduct, for example under section 3 of Ontario's Electronic Commerce Act, 2000. Government bodies can have stricter rules.
Documents these laws exclude
Each act lists documents it does not cover. The act's rules on electronic signatures do not apply to these documents, so other laws decide how they must be signed. Check with a lawyer before signing them electronically. For example:
| Province | Act | Documents the act does not cover |
|---|---|---|
| Ontario | Electronic Commerce Act, 2000, section 31 | Wills and codicils, trusts created by wills or codicils, powers of attorney for an individual's financial affairs or personal care, negotiable instruments, most documents of title, and documents named in regulations |
| British Columbia | Electronic Transactions Act, section 2 | Wills, trusts created by wills, powers of attorney for an individual's financial affairs or personal care, documents that create or transfer interests in land and need registration, and records named in regulations. Negotiable instruments and documents of title are outside the main rules. |
| Alberta | Electronic Transactions Act, section 7 | Wills and codicils, trusts created by wills or codicils, enduring powers of attorney, personal directives, records that create or transfer interests in land (including mines and minerals), guarantees under the Guarantees Acknowledgment Act, negotiable instruments, and records named in regulations. Documents of title are outside the Act except for contracts for carriage of goods. |
Other provinces and territories have their own lists. Quebec uses a different framework, the Act to establish a legal framework for information technology. Check the act that applies to your document.
What the law looks for and what Portant does
| Topic | What the law says | What Portant does |
|---|---|---|
| Consent | No one has to use or accept an electronic document without their consent. Consent can be inferred from conduct. | In every signing flow, the signer ticks a box confirming "I understand that this is a legal representation of my signature" before signing. This confirms the signer means to sign. Agreeing to deal electronically is between you and the other party. |
| Signature | A legal requirement for a signature can generally be met by an electronic signature, unless the document is excluded or named in regulations. | Portant provides simple electronic signatures. It does not verify a signer's identity. |
| Document integrity | Where a law calls for an original, an electronic document works if there is a reliable assurance that it has stayed complete and unaltered. | Portant locks and hashes each signed PDF. Anyone can check a signed PDF at sign.portant.co. The check confirms only whether the file is an unchanged Portant document. It does not show who signed, when, or from where. |
| Signing record | The acts do not require an audit trail for most documents. Where a law requires a record to be kept, the acts also require keeping information on where it came from, where it went, and when it was sent or received. A record of the signing can also help if a signature is disputed. | On paid plans (Pro, Team and Enterprise), the audit trail adds a page to the end of the signed PDF. It shows when the request was sent, each time a recipient opened the document, each signature, and when the document was completed, with the signer's email, date and time, IP address, approximate IP location and device. It does not record a cancellation. The Free plan does not include the audit trail. |
| Data protection | PIPEDA requires safeguards suited to the sensitivity of personal information. Your organization stays responsible for information it gives a service provider to process. | Portant hosts data on Google Cloud Platform (GCP). See the Data Protection Addendum. |
| Access | PIPEDA's safeguards include limiting who can see personal information. | Signed PDFs are saved where your workflow sends its outputs, for example the HubSpot record, Google Drive, SharePoint or OneDrive, or Portant hosting. Your own sharing settings there decide who can open them. On the Team plan, team roles control who can create, run and view workflows. A signature request is sent to the email addresses on the request, but anyone who has the signing link can sign. If a recipient forwards the email, the person who receives it can sign. Send sensitive requests only to recipients you trust. |
Practical considerations
- Agree to sign electronically. No one has to accept an electronic document without their consent, though consent can be inferred from conduct. If it matters for your document, say in the agreement or your covering email that it will be signed electronically.
- Keep the signed PDF. Portant locks and hashes each signed PDF and saves it with your workflow's outputs. Keep that copy. To send each signer a copy of the signed PDF, turn on signature receipts.
- Turn on the audit trail if you need it. On paid plans (Pro, Team and Enterprise), the Audit trail toggle adds a page of signing events to the signed PDF. It works for workflow signature requests, signing links and uploads in the Signatures tab. It has to be on before the request is sent, and it cannot be added to a PDF that is already signed. See Audit trail.
- Check the act for your province or territory. Each has its own act and its own exclusions. Some documents named in regulations need a more reliable signature than a simple electronic signature.
- Check the excluded documents. See the list under "Documents these laws exclude" above. If your document is on a list, or you are not sure, check with a lawyer before sending it for signature.
Conclusion
Portant provides simple electronic signatures. Under Canada's provincial and territorial e-signature laws, a document cannot be refused legal effect only because it is electronic, and a legal requirement for a signature can generally be met by an electronic signature, but most acts exclude some documents. Portant does not verify a signer's identity, and the audit trail page is available on paid plans. This page is general information, not legal advice. For regulated or high-value documents, or anything on the excluded lists above, check with a lawyer.
If you have questions about Portant's signatures, get in touch.