Article 22 of the Saudi Electronic Transactions Law

Alongside the duties of the certification services provider, this article sets out the obligations of the certificate holder themselves, which are four:

1. Integrity and confidentiality: the certificate holder is responsible for the integrity of their electronic signature system and its confidentiality, and every use of this system is treated as issued by them. They must comply with the conditions for using their certificate and for creating their electronic signature.
2. Accurate information: they must provide correct information to the certification services provider, or to all parties required to trust their electronic signature.
3. Reporting: they must notify the certification services provider of any change in the information contained in the certificate, or of the loss of its confidentiality.
4. No reuse: if their certificate is suspended or revoked, they may not reuse the electronic signature elements of that certificate with another certification services provider, and the Regulations set out the procedures needed to prevent this.

Why does this matter? Because the first paragraph attributes every use of the signature system to its holder. Neglecting to safeguard the signature elements or sharing them with others may mean that actions are attributed to the holder that they did not intend. An electronic signature system, according to Article 1, is a data system specially prepared to create an electronic signature.

This article is connected to Article 21, which allows the certificate holder to request revocation or suspension and obliges the provider to comply. Deliberately providing false information to a certification services provider is also a violation under Article 23. Anyone to whom a use of their signature that they dispute is attributed would do well to consult a lawyer specializing in electronic transactions.