Act 7 Electronic Signatures Act 5. 2011 Conduct of the signatory. (1) Where signature creation data can be used to create a signature that has legal effect, each signatory shall— (a) exercise reasonable care to avoid unauthorised use of its signature creation data; (b) without undue delay, notify any person that may reasonably be expected by the signatory to rely on or to provide services in support of the electronic signature if— (i) the signatory knows that the signature creation data have been compromised; or (ii) the circumstances known to the signatory give rise to a substantial risk that the signature creation data may have been compromised; (c) where a certificate is used to support the electronic signature, exercise reasonable care to ensure the accuracy and completeness of all material representations made by the signatory which are relevant to the certificate throughout its life-cycle or which are to be included in the certificate. 6. Variation by agreement. The provisions of this Act may be derogated from or their effect may be varied by agreement unless that agreement would not be valid or effective under any law. 7. Conduct of the relying party. A relying party shall bear the legal consequences of his or her failure to— (a) take reasonable steps to verify the reliability of an electronic signature; or (b) where an electronic signature is supported by a certificate, take reasonable steps— 13