What's the best practice approach using Adobe Sign to sign documents containing PII?

[yvonnef50815421]

We face the following data security issue with using AdobeSign:

Our Company needs to send out several employment contracts containing sensitive Data (PII) for signature.

After both parties have signed the document, the contracts are sent unencrypted as an e-mail attachment to all involved parties. This process does not meet the GDPR requirements.

We found the possibility to protect the documents with passwords. But since it is necessary to enter these passwords every time you want to open the saved document afterward, this option is not practicable for us. We would have to store extensive lists with all these passwords for the employment contracts.

Under “Global Settings” I have the option to choose that no PDF copies are sent to the involved parties after signing. This sounds good at a first glimpse, but after trying this option, I noticed that the e-mail that informs the parties that signing is completed, contains a link to the document. Clicking on this link, the unencrypted signed document is fully visible to anyone who gets access to this e-mail and the link.

Therefore, this option does not work for our purposes to use AdobeSign for the signature of documents containing PII.

Is there any idea what’s the best practice approach using AdobeSign and still meeting the GPDR requirements? Maybe it is possible to password protect the link to the PDF instead of the PDF itself?

[jeds96589707]

Were you ever able to find an acceptable solution to this dilemna? 

We are in the same boat...

Thanks.

[SimonESATS]

The link you mentinon can be protected by a login and since the last release can also be protect by the same 2 factor method if any was used.

the link itself can simply be exluded as well.

for the former option contact support, for the latter there's a setting in account settings.

Also check with your email admin, if encryption is support in your email setup, then the emails are send encrypted via tls 1.2 

[NudeCruzer]

Thanks for this information. I will refuse using Adobe Sign with documents that contain social security numbers, since it is so easy to accidentally distribute the document unencrypted.  If by default all information is encrypted, I would be more enclined to use it. 

[Tran31166112ztyt]

Hi   yvonnef50815421, 

Sorry, can I check with you which Adobe license are you using to access this Disable Attachment in the email notification, please?

Thank you

[MoutonNoir]

I’ve the same issue, I don’t get why Adobe is releasing such an insucure product. I feel like their communications are also misleading on the matter.

[Meenakshi Negi]

Hi MoutonNoir,

Thank you for reaching out.

In the account settings, you can disable both the file attachment and the link to the file in the final email. Go to Account > Account settings > Global settings > Attach a PDF copy of the signed document in emails sent to. Check the screenshot below:

For more information on Account settings, refer to the following help document: https://adobe.ly/4h42MyN. 

Let us know if you have any questions.

Thanks,

Meenakshi