How to Sign a PDF Digitally So the Signature Can Be Proven and Checked

Most people sign a PDF by pasting an image of their signature onto the page and sending the file back. It's quick, but hard to prove if someone later asks who signed or whether the content changed. This guide shows how to sign a PDF with a real electronic signature, when you need the certified kind, and how to check a signed PDF that someone sends you.

It's the practical companion to our guide on electronic vs digital signatures, which covers the legal background in more depth, so this one stays with the steps.

Note: This guide is general information and not legal advice. For high-value contracts, documents likely to be disputed, or rules in a specific sector, talk to your legal counsel.

A signature image is not an electronic signature

Indonesian law uses the term electronic signature (TTE). In everyday use, "digital signature" usually means an electronic signature made with cryptography, and the label has no separate legal definition. So if you're looking for a way to sign a PDF digitally, what you need is an electronic signature that meets the requirements of the ITE Law.

The ITE Law says an electronic signature has valid legal force and effect as long as it meets the requirements in Article 11(1). For PDFs, the two that matter most are that changes to the signature and changes to the signed content after signing can both be detected. The others cover signing data linked only to the signer, a way to identify the signer, and a way to show that the signer agreed to the content.

A pasted image, whether it's a scan or something drawn on a screen, generally struggles to meet these requirements. Anyone with a copy of the image can paste it onto another document, and the PDF can be edited afterwards without anything flagging the change. This is an application of the Article 11 requirements to images, and the regulations contain no specific ban on them. A signature image can still appear on the page as a visual marker, as long as there's a verifiable electronic signature behind it.

Certified or uncertified

GR 71/2019 distinguishes certified and uncertified electronic signatures, and the difference is whether an electronic certificate from an Indonesian electronic certification provider (PSrE) is used. Both can be valid if they meet the Article 11 requirements. The Elucidation of the regulation says the type of signature affects the strength of its evidentiary value, and it does not automatically decide whether a document is valid.

No general rule requires a certified TTE for every contract between private parties. GR 71/2019 only says that a ministry or institution may require its users to have an electronic certificate. In most cases the choice comes down to how much risk the document carries.

In practice, a certified TTE is generally easier to prove in court because a certificate issuer can explain its validity. An uncertified TTE is typically proven through forensic examination and is seen as weaker. Both points are practitioners' views and not the text of an article.

Option 1: an electronic signature in an app with an audit trail

This option suits internal and lower-risk documents. The app does most of the work, because it records who signed and makes later changes detectable.

1. Finalise the document first. Finish review and approval, then convert the document to PDF. Changes made after someone signs will show up during verification, so don't sign a draft that may still be revised.
2. Upload the PDF to the signing app your company uses. Make sure the app applies the signature to the file itself, so later changes to the content show up during verification.
3. Set the signers and their order. Record each signer's name and position, and set who signs first if the order matters.
4. Each signer logs in with their own account. The signature has to be linked only to that person, so nobody should share an account or sign with a manager's login.
5. Signers read the document and sign. A good app records the signing time and the action that shows each signer agreed.
6. Keep the signed PDF with its audit trail. The audit trail is the record of who did what and when. Store it with the signed file, because it's what you'll need if a signature is ever questioned.

Option 2: a certified TTE through a PSrE recognised by Komdigi

This option suits contracts and documents you may need to prove later. A certified TTE uses an electronic certificate from an Indonesian PSrE and is made with a certified signature-creation device.

1. Check the provider on the official list. An Indonesian PSrE must be recognised by Komdigi (formerly Kominfo), and the list of recognised PSrE is published on the ministry's website. Don't rely only on a provider's own claims, because the list can change.
2. Each signer gets their own certificate. Providers generally verify a signer's identity before issuing an electronic certificate, so follow the process your chosen provider sets.
3. Upload the final PDF and place the signature. As with option 1, make sure the document is final before anyone signs.
4. Sign through the provider's service. The signature is applied to the PDF with the signer's own certificate, and each later signer adds their signature to the same file.
5. Download the result and check it. Run the checks in the next section before you send the document to anyone else.

If the other party's signers use a different provider, agree early on the form of signature both sides accept. As a suggested practice, also add a clause in which the parties agree to sign electronically and treat electronic signatures as equal to wet signatures.

How to check a signed PDF

Check every signed PDF you receive before you file it as final. Open the signature panel in your PDF reader and look at the following.

• Whether there is a signature at all. If the panel is empty while the page shows a signature, the document most likely holds only an image.
• The signer's name. Make sure the recorded name matches the person who was supposed to sign.
• Whether the document changed. The panel usually shows whether the document was modified after signing. If you see a warning that it was changed after signing, don't use that file, and ask the sender for a correct copy.
• The certificate issuer. For a certified TTE, check that the issuer is a PSrE on the Komdigi list. Some PDF readers may show the signer's identity as unverified when they don't recognise the issuer. Read the details before you conclude that the signature is faulty.
• The signing time. Compare the times with the order you expect, for example a director's signature after approval was completed.

Verification works on the electronic file, so keep the original PDF you received. A re-printed copy or a file converted to another format usually loses the signature data that lets you check it again.

Signing on behalf of a company

An electronic signature shows who signed, but it doesn't show that the person had authority to act for the company. GR 71/2019 lists parties who are capable or authorised to act among the conditions for an electronic contract, so authority is still something you need to check.

• Check the basis of authority. A person signing for the company must be authorised under the company's articles of association and internal rules. If they act under a power of attorney, keep that document with the signed file.
• State the name and position. Put the signer's name, position and company name in the signature block, so a reader can see they signed as the company's representative.
• Use a certificate in the person's own name. The certificate and account belong to the individual signer, because the signature has to be linked only to them.
• Ask the same of the other party. For important contracts, ask the other side how their signer's authority is established.

If the document needs e-Meterai

Stamp duty is a separate matter from whether a signature is valid, and the Stamp Duty Law's definition of a signature includes electronic signatures under the ITE Law. For agreements, the duty arises when the document is signed. Agreements, statements and similar documents are subject to stamp duty whatever their value. The Rp5,000,000 threshold applies only to documents that mention receipt of money or settlement of a debt.

An e-Meterai is affixed to a PDF through the Electronic Stamp Duty System. A stamp image pasted onto a PDF by hand doesn't count as payment, in the same way that a pasted signature image isn't automatically an electronic signature. No rule sets the order of e-Meterai and signatures. Because the duty arises at signing, a sensible practice is to affix the e-Meterai when signing is complete, in a reserved space so it doesn't overlap a signature. The details are in our guide to e-Meterai for company documents.

Quick checklist

• Don't rely on a signature image pasted onto a PDF.
• Decide per document type whether you need a certified TTE.
• Finalise the document before anyone signs.
• Make sure every signer uses their own account or certificate.
• For a certified TTE, check the PSrE on the Komdigi list.
• Check the signature panel of every signed PDF you receive.
• Confirm that the signer is authorised to act for the company.
• Check whether the document needs e-Meterai.
• Keep the original PDF and its audit trail together.

How Obscura helps

In Obscura, approval and signing run in one route that you set up once, so the signing stage only starts after the approval stages in that route are complete. For certified signatures, a configured PSrE provider applies the signature through the e-sign module, and e-Meterai is applied within the same route. With the e-sign module, external parties can also sign as a step in the route without an Obscura account. Afterwards, the document carries an audit trail of who decided, who signed and when. The details are on the approvals and e-signature page.