The Electronic Transactions Act in practice: what a business must do with signatures, records and evidence

The base rule has applied since 2020

The Electronic Transactions Act 4 of 2019 was signed on 7 November 2019 and published in Government Gazette 7068. Notice 75 of 2020 brought most of it into force on 16 March 2020, with section 20, Chapter 4 and Chapter 5 held back. Its objects include legal certainty in electronic transactions, safe environments for consumers and business, and compliance with accepted international technical standards (section 2).

Section 17 states the core rule. No statement, expression of will or transaction is without legal effect solely because it is a data message. Parties are free to agree how data messages work between themselves, and a public body is unable to compel a person to deal with it electronically. A contract formed by data messages stands (section 26), including one formed by automated systems without a person reviewing each step (section 33). A message sent by a system programmed to act for you is treated as sent by you, unless you prove the system did not run its programming properly (section 32).

Records and evidence

Section 24 turns electronic storage into compliance. A legal duty to keep records is met by keeping a data message in the form in which it was generated, sent or received, or in a form shown to represent it accurately. The record must allow identification of origin and destination and of the date and time it was created and first kept. A business is allowed to use another party to store records but remains liable if the party fails.

Section 25 deals with proof. A court must not refuse computer evidence only because it is computer evidence. In weighing it, the court considers how reliably it was generated, stored and communicated, the integrity of the information system, and how the originator was identified. A business record is admissible with an affidavit from the person who was in control of the system when it was created. Software is presumed to work correctly, which shifts the burden to the party challenging it.

Together, these sections make an audit trail a legal asset. A system which records who did what, when, and cannot be altered quietly is built to meet the court’s test.

Invoices, returns and every other record

The Act does not mention invoices. It gives a record legal effect. Tax law decides its content. The Value-Added Tax Act, 2000 requires a tax invoice with the supplier’s registration number, the recipient, a serial number and the tax (section 21, Schedule VI), and five years of records (section 48(5)). No e-invoicing mandate exists yet.

Basic and recognised signatures

Section 1 defines an electronic signature broadly: data, including a sound, symbol or process, adopted to identify a person and show approval of a data message. An advanced signature is unique to the signer, identifies the signer, is created under the signer’s sole control and reveals later changes to the message. A recognised signature is an advanced signature meeting requirements set by regulation.

Section 20 says a reference in law to a signature includes a recognised electronic signature, unless the law or document points the other way. Parties remain free to use other signatures by agreement (section 20(2)). CRAN’s presentation of 14 September 2026 states a basic signature takes forms such as a typed name, a one-time password or a biometric, if it identifies the person, shows approval and is reliable enough for the purpose. A recognised signature needs a certificate from an accredited certification service provider.

The practical sorting question is what the transaction requires. A staff leave form needs a basic signature. A contract where a law demands a recognised signature does not. Chapter 4, on consumer protection, is outside this note, and the June 2026 notice does not commence it.

Accreditation and the offence of holding out

Chapter 5 lets CRAN accredit security products and services, including issuers of digital certificates. CRAN keeps a public database of accredited products and providers, and of suspended or revoked accreditations (section 43). A provider who holds out a product as accredited without accreditation commits an offence, with a fine of up to N$50,000 or imprisonment of up to two years, or both (section 48).

According to CRAN, existing providers must apply for accreditation within twelve months of its notice, and its target for a decision is 90 business days from a complete application. Nothing in the presentation says an existing signature became void. Existing arrangements continue, subject to ordinary validity and evidence rules.

When a message is sent, received and agreed

Sections 29 to 31 settle questions which used to be argued case by case. A data message is dispatched when it enters an information system outside the control of the originator, or, if both parties share one system, when the addressee retrieves it. It is received when it becomes capable of being retrieved at the electronic address the addressee designated. A message sent to some other address is received when it becomes retrievable there and the addressee becomes aware it was sent. Messages are treated as dispatched from the originator’s place of business and received at the addressee’s, and a contract is formed at the time and place the acceptance becomes effective.

These rules settle routine disputes. When was a notice of termination received? Where was a contract concluded? A business should hold the logs which answer such questions, and should designate in its terms the address at which it accepts notices, because designation fixes the moment of receipt.

Section 33(2) protects a person who makes an input error on an automated system offering no chance to correct it. The person withdraws the message by telling the other party promptly, return what they received and have gained no benefit, and a full refund is due within 30 days (section 33(3)).

Platforms, hosts and the duty to act on notice

Chapter 6 deals with service providers: telecommunications, website hosting or development, and data storage or backup. A provider is not liable for third-party material it merely transmits, without initiating the transmission, selecting the addressee or modifying the data (section 50). Caching and information location tools get similar protection (sections 51 and 53). A host is protected if it lacks actual knowledge of infringement and acts expeditiously on a take-down notice (section 52), provided it designates an agent to receive notices and publishes the agent’s contact details.

A valid take-down notice is in writing and states who complains, what right is infringed, which material and what remedy, with statements of good faith and truth (section 54(1)). The provider tells the poster within three days of acting, the poster objects, and the provider restores the material if it believes in good faith the material is reasonably lawful. A false statement at any step is an offence (section 54(8)), and section 55 confirms there is no general duty to monitor.

The parts not yet in force, and the date question

Chapter 4 protects consumers in electronic commerce. Suppliers must publish contact details, the full price and the terms, let consumers review and correct an order, and use a sufficiently secure payment system (section 34). A seven day cooling-off period applies to most goods and services, with financial services excluded (section 35). Marketing by data message needs a working opt-out, with a fine of up to N$500,000 or two years for breach (section 36). The annotated text marks the chapter as not yet in force, and the June 2026 notice does not name it.

For section 20 and Chapter 5 the position is now documented at source. Government Notice 182 of 2026, in Government Gazette 8949 of 15 June 2026, was signed on 19 May 2026 by the Minister of Information and Communication Technology under section 60(2) of the Act. It determines section 20 and Chapter 5 come into operation on the date of publication of the notice in the Gazette, which makes the date 15 June 2026. The notice names no other provision, so it leaves Chapter 4 and the rest of the uncommenced parts as they were. CRAN’s presentation of 14 September 2026 gives the same date. The Computer Evidence Act of 1985 was repealed by section 59 of the Act itself, which is why section 25 now governs computer evidence.

The two sets of regulations, at a high level

Two sets of regulations sit under the Act, and this note does not depend on their clause detail. CRAN’s slides describe them at the level a business needs. The eSignature regulations are issued under section 20. They set the requirements an advanced signature must meet to be recognised, the process for verifying a recognised signature was applied by a specific, identifiable person, and the procedure for applying one to a data message and for checking whether the message changed after signing. The aim is authenticity and non-repudiation.

The accreditation regulations cover who is accredited and how. CRAN’s slides list criteria for providers, including technical standards, personnel qualifications, financial capacity and liability cover, the application process, offences and penalties, appeals and reconsideration, and alignment with international and ISO standards for cross-border recognition. Treat these as the headings of the regime, and read the regulations before drafting a clause which depends on a specific criterion.

What this means for organisations in Namibia

List every document and workflow which needs a signature. For each, decide whether a basic, advanced or recognised signature is required by law or by risk, and write the decision down.

Check CRAN’s registers before relying on recognised status, and never describe a signature tool as recognised unless its provider is on the register. Keep the signed record, the identity evidence and the audit trail together, because section 25 asks about all three.