The Philippines' e-signature framework rests on the Electronic Commerce Act of 2000 (Republic Act No. 8792), a technology-neutral law modeled on the UNCITRAL Model Law on Electronic Commerce. Section 8 gives an electronic signature the same legal effect as a handwritten one whenever four conditions are met: a method identifies the signer and shows their access to the document, that method is reliable and appropriate for the transaction, the signer had to use it to proceed, and the other party can verify it. Section 9 attaches a rebuttable presumption of authenticity and signing intent to any signature meeting that test, unless the relying party knew of a defect or the presumption is unreasonable given the circumstances.

Signature Types Recognized

Electronic signature: RA 8792 recognizes one general category rather than a formal multi-tier system. Firma.dev's audit-trail-backed signing, meaning identity verification, tamper-evident documents, and timestamped logs, satisfies the Section 8/9 reliability test that governs ordinary commercial contracts.

Digital signature: The Philippine Supreme Court's separate Rules on Electronic Evidence (A.M. No. 01-7-01-SC, 2001) define a narrower "digital signature" built on an asymmetric cryptosystem (a public/private key pair), which carries its own evidentiary presumption once authenticated in court. That's an evidence rule courts use for litigation, and it doesn't map cleanly onto an SES/AES/QES-style ladder since it isn't a required tier for contract validity.

RA 8792 itself carries no explicit list of excluded documents. Instead, Section 7(c) preserves the formality requirements of other existing laws, and several of those laws still call for traditional execution. Wills and codicils keep the formalities set by the Civil Code. Negotiable instruments (checks, promissory notes) remain governed by the paper-oriented Negotiable Instruments Law. Deeds transferring or encumbering real property, and powers of attorney used for property or government transactions, require notarization under the Property Registration Decree (PD 1529) and the 2004 Rules on Notarial Practice, both of which call for personal appearance before a notary public: a step no e-signature platform, including Firma.dev, can complete remotely.

For data protection, the Data Privacy Act of 2012 (RA 10173) applies extraterritorially: it covers any entity processing the personal data of Philippine residents even without a local office, similar in reach to GDPR but different in its mechanics. The National Privacy Commission (NPC) requires registration from entities that process sensitive personal information of 1,000 or more individuals, use automated decision-making or profiling, handle vulnerable individuals' data, or employ 250 or more people (NPC Circular No. 2022-04, effective January 2, 2023). Ordinary e-signature audit-trail data, meaning a signer's name, email, IP address, and timestamp, generally falls outside "sensitive personal information" as RA 10173 defines it, so Firma.dev is unlikely to trigger mandatory registration through its own processing; customers acting as the data controller should still confirm their own registration status independently, since their thresholds depend on their full data footprint rather than Firma.dev's.

Cross-border transfers are permitted under RA 10173's implementing rules where the receiving jurisdiction offers adequate protection, the data subject consents, or the transfer is necessary to perform the contract. No mutual adequacy arrangement exists between the Philippines and the EU today, so Firma.dev's EU hosting isn't automatically treated as adequate the way it would be for a jurisdiction with a Commission adequacy decision. In practice, consent captured at signing and standard contractual safeguards cover most B2B use cases.