Can You Use DocuSign for a Chinese Clinical Data Sharing Agreement?

If your pharma, biotech, or CRO team runs trials with Chinese sites, someone eventually asks: can we just send the data sharing agreement through DocuSign? The honest answer has two layers, and confusing them is where compliance problems start.

This article is general information, not legal advice. China data and life-sciences regulation changes quickly, so involve qualified PRC counsel for your specific trial.

Short Answer: Yes for the Signature, No Free Pass on the Data

Yes — an electronic signature platform such as DocuSign can validly execute a clinical data sharing agreement involving Chinese parties. China's Electronic Signature Law gives reliable electronic signatures the same legal effect as handwritten signatures or company chops, and a commercial data sharing agreement between institutions is not in the law's excluded categories.

But signing is the easy part. The harder question is what the signed agreement does: moving clinical data — especially human genetic resources data — out of China triggers the Personal Information Protection Law (PIPL), the Data Security Law, and potentially the Human Genetic Resources (HGR) regulations administered by HGRAC. Those obligations attach to the data transfer itself, regardless of how the contract was signed. Choose your e-signature tool for signature validity and evidence quality; manage data-transfer compliance as a separate workstream.

What China's Electronic Signature Law Says

China's Electronic Signature Law (most recently amended in 2019) is broadly permissive for commercial contracts. Three points matter here:

1. No discrimination against electronic form. Under Article 3, parties may agree to use electronic signatures and data messages, and a document's legal effect cannot be denied solely because it is electronic.
2. "Reliable" electronic signatures equal wet ink. Articles 13 and 14 provide that a signature meeting the reliability conditions — the creation data is exclusively owned and controlled by the signer, and any post-signing alteration to the signature or document is detectable — has the same legal force as a handwritten signature or seal. Mainstream platforms with tamper-evident audit trails are built around exactly these conditions. See our guide to China's e-signature regulations for a broader overview.
3. The exclusions do not cover your agreement. Article 3 excludes documents on personal relationships (marriage, adoption, inheritance), real estate transfers, termination of public utility services, and other cases specified by law. A B2B clinical data sharing agreement falls outside all of these.

One nuance: in Chinese practice, courts look closely at the reliability of the signing process — how the signer was identified and how the record was preserved — when an e-signed contract is disputed. That is a reason to favor strong identity verification and complete audit trails, not a reason to avoid e-signing.

Why the Signature Is Only Half the Question: PIPL and Cross-Border Transfer

A clinical data sharing agreement signed in DocuSign is valid as a contract. Whether the data flows it authorizes are lawful is governed by a different rulebook.

Under PIPL, personal information collected in China — and clinical data about identifiable participants is usually sensitive personal information — can be transferred abroad only through one of three mechanisms, as summarized in Linklaters' Data Protected guide for the PRC:

• CAC security assessment — mandatory for critical information infrastructure operators, for transfers of "important data," and above volume thresholds set by the Cyberspace Administration of China;
• CAC standard contract — the Chinese SCC, executed on the CAC template and filed with the provincial CAC shortly after it takes effect, together with a personal information protection impact assessment (PIPIA);
• Certification by a CAC-accredited body — most practical for intra-group transfers in multinationals.

Separate consent for the transfer, a completed PIPIA, and contractual guarantees of PIPL-equivalent protection apply across these routes. The Data Security Law adds tighter controls on "important data" and restricts providing data stored in China to foreign judicial or law-enforcement bodies without approval.

The operational takeaway: your e-signature platform executes the agreement; your privacy and regulatory teams must separately clear the transfer mechanism, consent language, and impact assessments. No vendor's signing workflow substitutes for that.

Human Genetic Resources: When HGRAC Gets Involved

If the collaboration touches human biospecimens from China — blood, saliva, tissue — or data derived from them, the Regulation on the Management of Human Genetic Resources (effective July 1, 2019) applies on top of PIPL:

• Foreign organizations, and entities they establish or control, may use China's human genetic resources only through collaboration with a Chinese partner; they cannot collect, preserve, or ship HGR materials out of China themselves.
• International collaborative research generally requires advance approval; clinical trials in China for drug or device marketing authorization, with no export of HGR materials, follow a lighter notification/filing route.
• Providing HGR information to foreign parties — in HGRAC's broad reading, including clinical trial data transmitted to foreign sponsors or regulators — requires a filing with backup copies of the data, and may trigger security review where public health, national security, or public interests could be affected (see Mondaq's analysis of HGRAC's approach).

For a data sharing agreement, the signature workflow is the least of your concerns: HGRAC approval or filing status, the permitted data scope, and co-ownership rules for collaboration-derived patents all need to be settled in the agreement's substance before anyone signs.

Where DocuSign Hosts Your Agreement Data

Vendor diligence still matters, because the signed agreement and audit trail contain personal data (signer names, emails, IP addresses, timestamps). Per DocuSign's data management and privacy documentation, paid customers choose the account's hosting region at provisioning; eDocuments are stored in the account's geographic location, encrypted with AES-256 or equivalent; some user data is currently replicated globally to support the service.

For China-involved agreements, ask precisely:

• In which region will this account's envelopes and audit logs be hosted, and is any content or personal data replicated outside that region?
• What identity verification is available for Chinese signers, and does the evidence package support the "reliable electronic signature" conditions a Chinese court would examine?
• Is a Chinese-language signing experience available so both parties can rely on the executed record?
• Are in-China or in-APAC data residency options offered if your PIPL assessment points toward localization?

These questions apply to any vendor — our security checklist for evaluating e-signature platforms walks through the same diligence.

Compliance Checklist Before You Sign

Use this table as a pre-signature gate.

A Pre-Signing Workflow for China-Involved Clinical Agreements

1. Classify the data. Map what the agreement covers: coded vs. identifiable participant data, biospecimen-derived data, and whether any of it is human genetic resources information.
2. Clear the regulatory path. Confirm with PRC counsel whether HGRAC approval or filing applies, and which PIPL transfer mechanism the collaboration will use.
3. Draft the substance first. Bake the permitted data scope, security measures, IP co-ownership, and breach duties into the text before routing it for signature.
4. Diligence the signing platform. Verify hosting region, identity verification for Chinese signers, Chinese-language support, and audit-trail completeness against the checklist above.
5. Execute and archive. Route the agreement for e-signature, then retain the certificate of completion and audit log alongside the PIPIA and any HGRAC filings so the evidence package is inspection-ready.

DocuSign vs Alternatives for China and APAC

DocuSign is a defensible choice: it is mature, widely accepted by global counterparties, and offers regional hosting. Teams with China-heavy portfolios often weigh it against alternatives on three APAC-specific axes — regional data residency depth, integration with Asian government digital identity schemes, and cost structure for large signer bases. Our comparisons of DocuSign vs Adobe Sign for APAC enterprises and our overview of DocuSign alternatives cover these trade-offs. Whichever platform you choose, the China-side analysis stays the same: the tool must deliver a reliable, well-evidenced signature, while PIPL and HGRAC compliance lives in your regulatory workflow.

Signing China-Involved Clinical Agreements with Nota Sign

Nota Sign is FaDaDa's global e-signature platform, built on a provider ranked #1 by IDC in China's e-signature software market for consecutive years. For life-sciences teams working across China and APAC, it offers legal coverage across 100+ countries and regions, APAC compliance depth including iAM Smart and Singpass integration, support for SES/AES/QES signature levels, and regional data centers — directly relevant when diligence turns to hosting location and Chinese-court-grade evidence. Nota Sign charges no per-seat fees, which keeps it friendly to small clinical operations teams, and offers tailored plans for mid-market and enterprise organizations with heavier compliance needs. We have also published on our GxP-oriented e-signature solution for life sciences. To discuss a China-involved clinical agreement workflow, talk to the Nota Sign team.