Electronic Signatures Act

The Minister appoints the date on which the Act comes into force by statutory instrument.

This section provides definitions of terms used in the Act (interpretation section).

Nothing in this Act shall be applied so as to exclude, restrict or deprive of legal effect any method of creating an electronic signature that satisfies the requirements for a signature in this Act or otherwise meets with the requirements of any other applicable law.

The advanced signature verification process must ensure that advanced electronic signatures verified with a qualified certificate meet specified reliability, correspondence, display and authenticity criteria and are treated as equal to autographic signatures.

An electronic signature that, when executed using a prescribed or commercially reasonable security procedure and relied upon in good faith by the relying party, meets specified criteria at the time it was made and at verification will be treated as a secure electronic signature.

In civil cases involving a secure or advanced electronic signature or record, certain facts are presumed (including that the signature is that person’s and was affixed with intent, and that a secure/advanced record has not been altered), and the party who challenges the genuineness of such a signature must both produce evidence to rebut the presumption and persuade the court.

An electronic signature satisfies a legal signature requirement if it is sufficiently reliable for the message's purpose; the signatory's signature creation data must be linked to and controlled by the signatory, alterations to the signature or signed information must be detectable.

Each signatory must promptly notify foreseeable relying parties if signature-creation data are (or may be) compromised, must exercise reasonable care to avoid unauthorised use of signature-creation data, and where a certificate supports the electronic signature must ensure material representations relevant to the certificate are accurate and complete.

The provisions of this Act can be derogated from or varied by agreement, unless that agreement would be invalid or ineffective under any law.

When an electronic signature is supported by a certificate, a relying party must take reasonable steps to verify the signature's reliability, verify the certificate's validity/suspension/revocation, and observe any certificate limitations; the relying party shall bear the legal consequences of failing to do so.

When assessing whether systems, procedures and human resources used by a certification service provider are trustworthy, regard may be had to specified factors such as financial and human resources (including assets), quality of hardware and software, certificate processing and record retention procedures, availability of information to signatories and relying parties, independent audits, declarations of compliance, or any other relevant factor.

A certification service provider that supports legally effective electronic signatures must provide accessible certificate information, act according to its representations, exercise reasonable care for accuracy, offer notice and revocation mechanisms where stated, use trustworthy systems, and is liable for failure to meet these requirements.

A digital signature on part of an electronic record is treated as a secure electronic signature for that part if specific certificate‑trustworthiness or party‑agreement conditions are met.

A digital signature satisfies a signature requirement when the digital signature was affixed by the signer with the intention of signing the message.

Unless law or contract provides otherwise, a recipient who unreasonably relies on a digital signature assumes the risk it is forged; if the recipient decides not to rely, they must promptly notify the signer and state the grounds.

A digitally signed message is treated as if it were written on paper when the digital signature is verified by the public key in a certificate that (a) bears an entire digital signature, (b) was issued by a licensed certification service provider, and (c) was valid when the digital signature was created.

A copy of a digitally signed message is as valid, enforceable and effective as the original unless the signer designated an instance as a unique original, in which case only that instance is valid, enforceable and effective.

A certificate issued by a licensed certification service provider must be an acknowledgement of a digital signature verified by the public key in the certificate, when the signature is verifiable by that certificate and was affixed while the certificate was valid.

When deciding disputes about digital signatures, a court must presume certain listed facts about certificates, signatures, timestamps, and the intentions and authority of subscribers and certification service providers.

This Part applies to digital signatures or signatures that are able to use the public key infrastructure (PKI).

The Controller must monitor and oversee certification service providers, perform its Act functions, follow Ministerial policy directions, keep a public disclosure database for each provider, and publish that database in at least one recognised repository.

A person must not operate as a certification service provider unless they hold a valid licence issued under this Act.

The Minister, together with the National Information Technology Authority-Uganda, must set qualifications for certification service providers and may later vary or amend them, but changes cannot be applied to currently licensed providers until their licence expires.

A certification service provider must issue a certificate to a subscriber when the subscriber applies and meets identity requirements and pays prescribed fees, and must take all reasonable measures to verify the subscriber's identification before issuing the certificate.

An applicant must apply in writing to the Controller for a licence, include prescribed documents, and provide additional information if the Controller requires it.

The Controller must consider properly made applications, may grant or refuse a licence after satisfaction and payment of the prescribed fee, a licence must state duration and number, the Controller may vary or amend licence terms for just cause but must give the licensee a reasonable opportunity to be heard, and the Controller must notify the applicant in writing within thirty days.

The Controller may revoke a licence for specified grounds; before revocation the Controller must give written notice and require the licensee to show cause within thirty days; if revoking the Controller must notify the licensee within 48 hours; revocation takes effect after 30 days if no appeal, and appeals suspend issuance of certificates until set aside by the Minister; contravention attracts fines up to 240 currency points or imprisonment up to ten years.

The Minister must respond to an appeal within thirty days; a person not satisfied with the Minister's decision may appeal to the High Court.

A certification service provider may surrender its licence by sending the licence and a written notice to the Controller; the surrender takes effect when the Controller receives both the licence and notice (or on a later date specified), and the licensed provider must publish and advertise the surrender within fourteen days.

When a certification service provider's licence is revoked, surrendered or expires they must stop operating; the Minister may authorise continued operation to wind up affairs; an expired licence-holder who has applied for renewal and is pending determination may continue to operate on proof; contravening the duty is an offence with fines and imprisonment; the Controller must appoint another provider to take over certificates and the appointed provider may require subscribers to comply or reissue certificates.

Licensing requirements do not affect the validity of certain digital signatures; Parts IV and V do not apply in specified unlicensed or unverifiable cases.

Licensed certification service providers must return the licence to the Controller within fourteen days when the licence is revoked, has expired without timely renewal application, or renewal is refused.

The Controller may classify and issue licences with specified limitations; licensed certification service providers must not issue certificates that exceed their licence restrictions, and doing so is an offence with specified consequences that do not affect certificate validity.

Persons must not use or claim the expression "certification service provider" or derivatives in relation to their business without the Controller's written consent.

Licensed certification service providers must apply to the Controller and submit required documents at least thirty days before licence expiry to renew; if they do not intend to renew they must publish and advertise that intention at least thirty days before expiry for at least five consecutive days; the Controller may refuse renewal where subsection (1) requirements are not met.

If a certification service provider has lost its license, it must immediately notify the Controller in writing and, as soon as practicable, apply for a replacement license with required information, documents and the prescribed fee.

The Controller may, by order published in the Gazette, recognise certification service providers authorised outside Uganda if they satisfy the prescribed requirements.

Certification service providers must have their operations audited at least once a year; the Controller must maintain and publish the audit date and result.

Certification service providers must only perform activities that are specified in their licence and must carry out activities in accordance with the Act and any regulations made under it.

A certification service provider must at all times display its license in a conspicuous place at its place of business and on its website.

Licensed certification service providers must submit to the Controller information and particulars about their entire business operations, including financial statements, audited balance sheets and profit and loss accounts, within a time the Controller may determine; contravention is an offence punishable by fines or imprisonment and a daily fine for continuing offences.

Certification service providers must inform the Controller in writing before certain amendments or director/CEO changes, and licensed providers must immediately notify the Controller of amendments or alterations to information or documents previously furnished with the licence.

Section Use of trustworthy systems Section A certification service provider shall only use a trustworthy system — to issue, suspend or revoke a certificate ; to publish or give notice of the issuance, suspension or revocation of a

A certification service provider must disclose material certification practice statements and any facts affecting a certificate's reliability or the provider's ability to perform, when an inquiry is made under this Act.

A certification service provider may issue a certificate to a subscriber if specified conditions are met; those requirements cannot be waived or disclaimed by the provider or the subscriber.

If a subscriber accepts an issued certificate, the certification service provider must publish a signed copy in a recognised repository unless a contract provides otherwise; if the subscriber does not accept it, the provider must not publish and must cancel publication if already published.

A certification service provider may conform to standards or contractual requirements that are more rigorous than this Act so long as they remain consistent with the Act.

If a certification service provider finds a certificate was issued not in accordance with sections 31 and 32 it must immediately revoke it; it may suspend a certificate for up to forty-eight hours for investigation; and it must immediately notify the subscriber of any revocation or suspension.

The Controller may order suspension or revocation of a certificate if it was issued without complying with sections 31 and 32 and poses significant risk; before making that determination the Controller must give the certification service provider and the subscriber a reasonable opportunity to be heard; in an emergency, after consultation with the Minister, the Controller may suspend a certificate for up to forty-eight hours.

When a certification service provider issues a certificate it must warrant to the named subscriber three things: no known false information in the certificate, the certificate meets the Act's requirements, and issuance did not exceed licence limits; the provider may not disclaim or limit those warranties.

A certification service provider who issues a certificate must promptly suspend or revoke it in accordance with Part IV and must notify the subscriber within a reasonable time of any known facts that significantly affect the certificate's validity or reliability.

When issuing a certificate, a certification service provider certifies that the certificate information is accurate, material information affecting reliability is included or incorporated by reference, the subscriber has accepted the certificate, and the provider has complied with applicable laws governing issuance.

When a certification service provider publishes a certificate, it certifies to the repository and to those who reasonably rely on the certificate that the licensed provider issued the certificate to the subscriber.

The subscriber named in a certificate must certify that they hold the corresponding private key and that specified material representations are true.

A person requesting a certificate on behalf of a principal must certify they have authority to apply for the certificate and to sign digitally for the principal; if their signing authority is limited they must ensure safeguards to prevent signatures beyond their authority.

A person must not disclaim or contractually limit this part or obtain indemnity for its effects when that disclaimer, limitation or indemnity would restrict liability for misrepresentation against persons reasonably relying on the certificate.

By accepting a certificate, a subscriber must indemnify the issuing licensed certification service provider for loss or damage caused by issuance or publication of the certificate when the subscriber made a false material representation or failed to disclose a material fact with intent to deceive or through negligence; agents who requested the certificate undertake the same indemnity; the indemnity cannot be disclaimed or contractually limited.

A certification service provider may require a subscriber to swear or affirm that material information given for issuing a certificate is accurate.

A subscriber named in a certificate must take reasonable care to keep their private key under their control and prevent its disclosure to anyone not authorised to create the subscriber’s digital signature.

A private key is the personal property of the subscriber who rightfully holds it.

A certification service provider that holds a subscriber's private key must hold it as a fiduciary of the named subscriber and may use it only with the subscriber's prior written approval, except where the subscriber expressly grants the private key and permits other terms in writing.

A licensed certification service provider must suspend a non-transactional certificate for up to forty-eight hours on request by the subscriber (or a person likely to know of key compromise) or by order of the Controller, unless the provider and subscriber agree otherwise; the provider must verify the requester’s identity or agency.

The Controller may suspend a non-transactional certificate for forty-eight hours when a person identifying the subscriber requests suspension and represents that the issuer is unavailable; the Controller may require evidence and may decline to suspend.

When a certificate is suspended the certification service provider must publish a signed notice of suspension in the repository specified in the certificate (in all specified repositories if more than one); if a specified repository no longer exists or refuses publication or none is recognised under section 69, the certification service provider must also publish in a recognised repository. If the Controller suspends a certificate, the Controller must give the same notice where the requester pays any prescribed repository fee in advance.

A certification service provider must terminate a suspension initiated by request when the subscriber requests termination and the provider has confirmed the requester is the subscriber or an authorised agent, or when the provider discovers the suspension request was unauthorised by the subscriber.

A contract between a subscriber and a licensed certification service provider may limit or prevent requested suspension by the certification service provider or may provide for termination of such suspension; limits that preclude Controller suspension when the issuing provider is unavailable are effective only if notice is published in the certificate.

A subscriber remains obligated to keep their private key secure while a certificate is suspended and is not released from the duty under section 47.

A licensed certification service provider must revoke non-transactional certificates when the named subscriber requests revocation and the requester’s identity (or agent authority) is confirmed, and must confirm and revoke within one business day after receiving a written request plus identity-confirming evidence.

A licensed certification service provider must revoke a certificate it issued when it receives a certified copy of the subscriber's death certificate, confirms the subscriber is dead by other evidence, receives documents effecting dissolution of the subscriber, or confirms the subscriber has been dissolved or ceased to exist.

A licensed certification service provider may revoke certificates it issued if those certificates are or become unreliable; the subscriber may still sue for damages if revocation is wrongful.

When a licensed certification service provider revokes a certificate it must publish a signed notice of revocation in the repository(s) specified in the certificate; if those repositories do not exist or refuse publication (or none is recognised under section 69) it must publish in a recognised repository.

A subscriber stops certifying and is no longer required to keep the private key secure once revocation is either (a) published as required under section 71, or (b) forty eight hours have lapsed after a written revocation request accompanied by information to confirm the request and payment of any prescribed fee, whichever occurs first.

After notification under section 71, a certification service provider is discharged of warranties for the revoked certificate and must cease certifying that revoked certificate.

When a certificate expires, the subscriber and the licensed certification service provider must stop certifying; the licensed certification service provider will be discharged of duties arising from that expired certificate.

A licensed certification service provider must specify a recommended reliance limit in the certificate when issuing a certificate to a subscriber.

A licensed certification service provider is not liable beyond the amount specified in the certificate as its recommended reliance limit, subject to the section and any waiver by the provider.

The Controller may recognise repositories after confirming they meet regulatory requirements, and must publish a list of recognised repositories in a form and manner he or she determines.

Recognised repositories (including owners or operators) are liable for loss when a person reasonably relies on an electronic signature verified by a public key listed in a suspended or revoked certificate if the loss occurred more than one business day after the repository received a request to publish notice of suspension/revocation and the repository failed to publish the notice; several specified limits and non-liabilities apply.

The Controller may recognise date or time stamp services (subject to regulatory requirements) and shall publish a list of recognised services.

Certification service providers already operating before commencement must obtain a licence within three months from commencement; failure means they are treated as unlicensed and the Act's provisions apply to them.

Certification service providers must not run their business in a way that creates unreasonable risk of loss to subscribers, relying persons, or repositories; the Controller may publish advisories, the named provider may protest, and the Controller must publish decisions and may revoke, continue, amend or take further legal action after hearings.

Persons with powers under this Act must not access or grant access to electronic records or other material except for the purposes of the Act or prosecutions; contravention is an offence with fines or imprisonment.

Making or supplying, knowingly, any declaration, return, certificate or other required document or information that is false or misleading is prohibited and is an offence punishable by a fine not exceeding one hundred and twenty currency points or imprisonment for a term not exceeding five years or both.

Directors, managers and similar officers are deemed to have committed an offence if the body corporate is convicted unless they can prove lack of knowledge and due diligence; persons liable are also liable for acts of employees or agents, and such persons may be charged jointly or severally with the body corporate.

An authorised officer may exercise enforcement powers under this Act.

The Controller may investigate certification service providers and may issue orders to them; authorised officers investigating offences may exercise police investigation powers under the Criminal Procedure Code.

A Magistrate may issue a warrant on written information on oath and reasonable cause; that warrant authorises inspectors or named authorised officers to enter, search and seize relevant items; officers may search persons and seize items; seizing officers must seal items that cannot practicably be removed; breaking or removing seals without authority is an offence.

A police officer of at least Inspector rank may, without a warrant, enter premises and use the powers in section 86 if there is reasonable cause to believe delay would harm the investigation or that evidence might be tampered with, removed, damaged or destroyed.

Police officers conducting searches under sections 86 or 87 are entitled to unlimited access to computerised data.

Seizing officers must prepare a list of seized items and immediately give a signed copy to the occupier (or their agent/servant) at the premises; if premises are unoccupied, the officer must post the list conspicuously and leave a copy with local authorities.

It is an offence for a person to obstruct, impede, assault or interfere with an authorised officer performing his functions under this Act.

An authorised officer may require production and inspection of documents and identification and may make inquiries for executing the Act.

A person who commits an offence under this Act for which no penalty is provided is liable on conviction to a fine not exceeding seventy two currency points or to imprisonment for up to three years or both; for continuing offences an additional daily fine not exceeding two currency points applies.

An officer of the Controller authorised in writing by the Director of Public Prosecutions may conduct prosecutions for offences under the Act.

A Magistrate Grade I shall have jurisdiction to try offences under this Act and to impose the full punishment for those offences, notwithstanding any written law to the contrary.

The Controller and any officer duly authorised under this Act are protected from being the subject of actions or prosecutions in court for acts ordered or done to carry the Act into effect.

A person must not disclaim or contractually limit the application of the Act unless the Act expressly allows it.

The Minister may make regulations for the purposes listed in the section, and regulations may create offences and prescribe penalties (up to a fine of seventy two currency points or three years' imprisonment or both).

If a person is convicted under this Act, the court must order that person to pay compensation to the aggrieved party.

The Minister may amend the Schedule to this Act, subject to Cabinet approval and by statutory instrument.