Rules for electronic trust services and digital signatures in Spain

Automatic summary, not yet reviewed

1. The law adapts Spanish rules to the EU Regulation on electronic identification and trust services. It does not repeat what the Regulation already covers; it only fills in the parts left to each Member State, such as the penalty system and identity checks for certificate applicants.
2. Qualified certificates last at most five years and end through expiration or revocation. The law lists the cases of revocation and suspension, such as a breach of signature data, a court order, or the signer's death.
3. Qualified certificates for individuals must include their name and their national ID, foreigner ID, or tax number. To request one, applicants generally must appear in person before the verifier, though remote identification by video call is allowed if it offers equivalent security.
4. Qualified trust service providers must carry civil liability insurance of €1,500,000, plus €500,000 for each additional qualified service, and keep service records for 15 years. If they plan to stop operating, they must notify clients and the supervisor at least two months in advance.
5. Non-qualified providers need no prior verification, but must notify the Ministry within three months of starting. Qualified providers do go through prior verification and must submit a conformity assessment report at least every 24 months.
6. Offenses are classified as minor, serious, and very serious, with fines of up to €300,000. The law repeals the 2003 electronic signature law and Article 25 of the information society services law.

Who it affects

• Public and private trust service providers established in Spain: They must meet security, insurance, reporting, and supervision obligations, with penalties if they fail.
• Individuals and companies requesting electronic certificates: They must prove their identity, and their details will appear on the certificate.
• Companies providing services to the public with special economic importance: They must offer users a secure electronic communication channel, not necessarily based on certificates.
• Public administrations: Their identification, signature, and electronic seal systems have full legal effect.

Words worth knowing

Servicio electrónico de confianza (electronic trust service)

A service that helps identify someone or guarantee documents online, such as electronic signatures or time stamping.

Certificado cualificado (qualified certificate)

An electronic certificate meeting high security requirements, with special evidential value.

Prestador de servicios de confianza (trust service provider)

A company or body that issues certificates and provides these electronic services.

Lista de confianza (trust list)

A public list of qualified providers allowed to offer their services.

Sello electrónico (electronic seal)

The equivalent of an electronic signature, but for companies and entities, not individuals.

It summarizes the law as published in the BOE. It is written by artificial intelligence and may contain mistakes: the official text is what counts. Read the official text · How we make summaries