Electronic Signature HR & GDPR: Complete Guide 2026

The digitalization of human resources has accelerated significantly since 2020: employment contracts, amendments, pay slips, IT policies, telework agreements — virtually all of these documents now transit in digital form. Yet, going paperless does not mean escaping legal obligations. Quite the opposite: electronic signature HR document GDPR constitutes a subject with dual regulatory entry points, as it articulates the eIDAS framework on the evidentiary value of signatures and the European regulation on personal data protection. If poorly managed, this dual constraint exposes the company to legal risks and CNIL sanctions. This guide presents the essential rules, best practices and critical points to know absolutely in 2026.

Why does GDPR apply to electronic signature HR?

Electronic signature necessarily processes personal data

Signing a work contract online involves collecting, transmitting and storing personal data within the meaning of Article 4 of GDPR No. 2016/679: name, first name, professional email address, sometimes mobile phone number, signature timestamp and IP address. In an HR context, this data is particularly sensitive because it directly identifies the employee and is linked to their contractual relationship with the employer.

The trusted services provider (TSP) that supplies the signature solution is qualified as a processor within the meaning of Article 28 of the GDPR. The employer remains the controller. This distinction is fundamental: it is the company that is accountable to the CNIL in case of breach, not the software provider.

Applicable legal bases in HR context

For each category of dematerialized HR documents, the employer must identify the most appropriate legal basis for processing:

• Contract performance (Art. 6.1.b GDPR): signature of employment contract, salary amendment, full-time work agreement. This is the most robust legal basis for contractual documents.

• Legal obligation (Art. 6.1.c GDPR): dematerialized delivery of pay slip (authorized since the Macron Law of 2015 under conditions), personnel registers.

• Legitimate interest (Art. 6.1.f GDPR): IT policies, internal regulations, internal policy documents — subject to passing the balancing test.

The consent basis (Art. 6.1.a) should be avoided in HR context: the CNIL and the EDPB (European Data Protection Board) believe that the subordination relationship between employer and employee makes consent rarely free. An employee who refuses to sign electronically may fear professional consequences.

Concrete obligations of the HR controller

Update the Records of Processing Activities (RPA)

Article 30 of the GDPR requires any organization employing more than 250 employees (and SMEs processing sensitive data on a large scale) to maintain a record of processing activities. The introduction of an electronic signature tool for HR documents must be listed with:

• The purpose of processing (e.g.: dematerialization and archiving of HR contractual documents)

• The categories of data processed (identity, contact data, authentication data)

• The retention period (legal retention period for employment contracts: 5 years after the end of the contract according to Labor Code, Art. L. 1234-20)

• The contact details of the processor (the signature platform)

• The security measures implemented

Sign a DPA (Data Processing Agreement) with the service provider

In accordance with Article 28 of the GDPR, any recourse to a processor to process personal data must be formalized by a data processing agreement (DPA). This agreement must specify:

• The subject matter and duration of processing

• The nature and purpose of processing

• The type of personal data and categories of data subjects

• The obligations and rights of the controller

• The location of data (hosting within the EU recommended to avoid transfers outside the EEA)

• Technical and organizational security measures

A reputable electronic signature provider systematically proposes a GDPR-compliant DPA. Its absence constitutes an immediate non-compliance that is sanctionable.

Inform employees before first signature

Article 13 of the GDPR requires prior information of persons whose data is collected. Before rolling out electronic signature for HR documents, the employer must inform employees:

• Of the identity of the controller

• Of the purpose and legal basis

• Of the data retention period

• Of their rights (access, rectification, erasure within the limits of legal retention obligations, portability)

• Of the contact details of the DPO (Data Protection Officer) if appointed

This information can be integrated into the signature process itself (information banner before signature), into the updated internal regulations, or via a service note distributed during rollout.

Required signature level for HR documents: SES, AES or QES?

The hierarchy of eIDAS signature levels

Regulation eIDAS No. 910/2014 defines three levels of electronic signature, each offering increasing evidentiary value:

• SES (Simple Electronic Signature): low evidentiary value, suitable for low-stakes documents (receipts, internal forms)

• AES (Advanced Electronic Signature): linked uniquely to the signatory, created from data under their exclusive control. Suitable for most common HR documents.

• QES (Qualified Electronic Signature): the highest level, equivalent to handwritten signature according to Art. 25.2 eIDAS. Requires reinforced identity verification (face-to-face or video identification).

Which level for which HR documents?

The recommended mapping in 2026, taking into account French case law positions and sector-specific recommendations:

For high-stakes contentious documents (full-time work agreement, conventional termination), QES is de facto required to guarantee enforceability before employment courts. The Court of Cassation has progressively tightened its requirements on proof of employee consent.

Retention, archiving and data subject rights: pitfalls to avoid

Legal retention periods for signed HR documents

The retention of electronically signed HR documents is subject to imperative legal periods. These periods take precedence over the right to erasure under the GDPR (Art. 17.3.b):

• Employment contract: 5 years after the end of the contract (employment law limitation period, Labor Code Art. L. 1471-1)

• Pay slips: 5 years (wage prescription period), but retention recommended until employee retirement benefits are settled

• Documents relating to workplace accidents: 30 years (long-term dispute risk)

• Professional training (plans, certificates): 3 years

• Personnel registers: 5 years after the date the employee left the establishment

Long-term electronic archiving with evidentiary value must comply with the requirements of the NF Z 42-013 standard and ideally the ETSI EN 319 162 standard (long-term archiving of electronic signatures). Simple server storage is insufficient: integrity, readability and qualified timestamping of documents must be guaranteed throughout the entire retention period.

Managing employee rights without compromising evidentiary value

An employee may legitimately exercise their right of access (Art. 15 GDPR) to obtain a copy of signature data concerning them. They may also request correction of inaccurate data.

However, the right to erasure (Art. 17 GDPR) cannot be exercised on HR documents subject to legal retention obligations. The employer must be able to clearly explain this refusal, citing the applicable legal basis. Documenting these exchanges in the rights request register is a best practice recommended by the CNIL.

Portability (Art. 20 GDPR) applies to data provided by the employee on the basis of consent or contract performance. In practice, an employee can request their signature data in a structured format — an obligation to anticipate when choosing the signature solution.

Technical and organizational security: essential measures

Technical requirements of the signature platform

In accordance with Article 32 of the GDPR, security measures must be appropriate to the risk. For an electronic signature HR solution, this translates notably into:

• Encryption of data in transit (TLS 1.3 minimum) and at rest (AES-256)

• Multi-factor authentication (MFA) for platform access

• Audit logs with timestamps and tamper-proof, tracing each action on the document

• Hosting within the EU (or EEA) to avoid transfers outside the EEA without adequate safeguards (adequacy decision or standard contractual clauses)

• Annual penetration testing and ISO 27001 certification of the provider

• Business continuity plan guaranteeing service availability and archive recovery in case of incident

Impact Assessment (DPIA): when is it mandatory?

Article 35 of the GDPR requires a Data Protection Impact Assessment (DPIA) when processing is likely to result in high risk. The CNIL has published a list of types of processing requiring a DPIA: large-scale processing of data relating to professional life is mentioned.

In practice, a DPIA is recommended (if not mandatory for large enterprises) when rolling out an electronic signature HR solution affecting all employees. It must identify risks (loss of confidentiality, identity theft, document alteration), assess their severity and likelihood, and propose mitigation measures. This analysis must be documented and reviewed if the processing changes.

Applicable legal framework for electronic signature HR and GDPR

Foundational European texts

Regulation eIDAS No. 910/2014 (and its eIDAS 2.0 revision currently being rolled out): this text defines the three levels of electronic signature (SES, AES, QES) and their legal value across all Member States. Article 25 provides that QES has a legal effect equivalent to a handwritten signature. Article 26 enumerates the technical requirements of advanced signature. Qualified trusted services providers are listed on national trust lists (in France, the list is managed by the ANSSI).

GDPR No. 2016/679: applicable since May 25, 2018, this regulation governs all personal data processing within the EU. Articles 5 (principles), 6 (legal bases), 13-14 (information), 28 (processors), 30 (register), 32 (security), 35 (DPIA) and 37-39 (DPO) are directly relevant to electronic signature HR.

Applicable French law

Civil Code, Articles 1366-1367: Article 1366 establishes the principle of functional equivalence between electronic and paper writing. Article 1367 recognizes electronic signature as a means of proof, provided it consists of a reliable identification process guaranteeing the link with the act to which it is attached. Reliability is presumed for QES but can be demonstrated for AES.

Labor Code: Article L. 1221-1 does not impose a particular form for the employment contract (except exceptions: fixed-term contract Art. L. 1242-12, apprenticeship contract, etc.). The 2015 Macron Law (Law No. 2015-990) opened the door to electronic pay slips. Article L. 3243-2 governs its modalities.

Computer and Freedoms Act amended (Law No. 78-17 of January 6, 1978): French transposition of the GDPR, it confers on the CNIL its investigative and sanctioning powers. Fines can reach €20 million or 4% of annual global revenue for the most serious violations.

Reference technical standards

• ETSI EN 319 132: advanced electronic signature format XAdES, applicable to XML documents

• ETSI EN 319 122: CAdES format for CMS electronic signatures

• ETSI EN 319 162: long-term archiving of electronic signatures (ASiC)

• NF Z 42-013 (AFNOR): functional specifications for a probative electronic archiving system

• ISO/IEC 27001: information security management, certification reference framework expected from providers

Legal risks in case of non-compliance

The cumulative risks are significant: a work contract signed with an insufficient signature level can be contested before the employment court, exposing the employer to requalification or nullity. On the GDPR side, the absence of a DPA with the provider, failure to inform employees or hosting outside the EU without adequate safeguards may result in a CNIL notice to comply, or even public administrative sanctions.

Illustrative usage scenarios: GDPR-compliant HR electronic signature

Scenario 1: a mid-sized industrial company with 600 employees digitalizes its employment contracts

These scenarios are illustrative: they describe typical situations and do not report any measured results from a client. A mid-sized industrial company, spread across four sites in France, processes around 180 permanent/fixed-term hires each year, generating just as many paper files that must be printed, signed in duplicate, scanned, and archived. The time between a job offer and the actual signing of the contract can stretch out considerably.

With an advanced electronic signature (AES) solution integrated into its HRIS, a GDPR-compliant DPA signed with the provider, and a documented DPIA, the company can shorten this timeframe. The proportion of incomplete files may also decrease. Hosting data in France can be set as a contractual criterion, which rules out the risk of transfers outside the EEA. Employees are informed of the processing via an information notice built into the signing journey, which meets the requirements of article 13 of the GDPR. The scale of the gain is to be measured on the company's actual scope, before and after a pilot.

Scenario 2: a retail franchise network deploys QES signatures for full-time work agreements

A distribution network with about sixty retail outlets and a hundred salaried managers faced an identified employment law risk: several full-time work agreements could only be proven through low-quality paper copies. The Court of Cassation having tightened its proof requirements for this type of agreement, the contentious risk was estimated at several hundred thousand euros.

The network can roll out a qualified electronic signature (QES) solution for all new agreements and offer current managers the option to re-sign their existing agreements. Identity verification via video identification can be used. The record of processing activities is updated, and an external DPO can validate the GDPR compliance of the journey. The entire stock of day-rate agreements is thus progressively secured. The cost of the process per QES signature, which varies depending on the provider, should be weighed against the litigation risk it covers.

Scenario 3: a local authority dematerializes its amendments and telework policies

A local authority of approximately 1,200 permanent employees wished to dematerialize the management of its telework amendments following the national framework agreement of 2021 on telework in the public service. The volume to be processed was approximately 400 documents per year, with specific constraints: employees are public persons whose data are subject to particularly regulated processing.

The local authority can opt for advanced signatures (AES), with sovereign hosting at a provider qualified as SecNumCloud by ANSSI. The DPIA is submitted to the authority's DPO before deployment. Staff are informed via a service notice published on the intranet and an information notice built into the digital journey. This lightens the administrative handling of amendments for the HR department, with direct costs decreasing. The scale of the gain is to be measured on the authority's actual scope, before and after a pilot.

Frequently Asked Questions

What is the difference between the controller and the processor in the context of HR electronic signature?

The controller is the employer: it is the employer who determines the purposes and means of processing employees' personal data. The service provider that supplies the electronic signature platform is qualified as a processor within the meaning of Article 28 of the GDPR. In the event of a breach found by the CNIL, it is the employer who bears primary responsibility, regardless of any faults on the part of the service provider.

Why is employee consent considered a discouraged legal basis for electronically signing HR documents?

The CNIL and the European Data Protection Board consider that the subordination inherent in the employment contract deprives the employee of genuine freedom to refuse. Consent given under implicit pressure is not freely given within the meaning of the GDPR and may be invalidated. The legal bases of contract performance or legal obligation are legally more robust for covering the majority of digitalized HR documents.

How long must an employer retain data related to an HR electronic signature?

The retention period must correspond to the legal obligation applicable to the signed document. For an employment contract, the French Labor Code requires minimum retention of five years after the end of the contractual relationship. Authentication data and signature evidence must be retained for at least as long as the document itself, in order to preserve its evidentiary value in the event of dispute.

Is a DPA mandatory even if the electronic signature provider is eIDAS certified?

Yes, eIDAS certification attests to the technical compliance of the provider but does not replace the contractual obligations arising from the GDPR. Article 28 of the GDPR requires a formalized data processing contract, regardless of the provider's qualification level. This document must specify in particular the location of data, the security measures applied, and the modalities for return or deletion of data at the end of the contract.

Is it possible to impose electronic signature on an employee without their express agreement?

The employer may impose electronic signature as a method of contract performance provided that it guarantees the employee a level of security equivalent to handwritten signature and informs them in advance in accordance with Article 13 of the GDPR. However, it cannot compel an employee to use their personal equipment or provide biometric data without a specific legal basis. A refusal based on inadequate information may weaken the legal standing of the signed document.

Conclusion

GDPR compliance of electronic signature for HR documents is not optional: it conditions both the legal value of your acts and the protection of your employees' rights. In 2026, companies that have not yet updated their records of processing, signed a DPA with their provider and adapted the signature level to each document type expose themselves to a double risk — employment law and administrative — whose financial consequences can be significant.

The good news: a well-chosen and well-configured solution allows you to reconcile operational fluidity, eIDAS compliance and GDPR compliance without friction for HR teams or employees.

Certyneo supports you in this endeavor: eIDAS-compliant platform, DPA available, European hosting and signature journeys designed for HR. Discover our HR-dedicated solution or calculate the ROI of your transition to fully digital in just a few clicks.