Digital Signature

A digital signature in the e-invoicing context is a cryptographic technique that uses public-key infrastructure (PKI) to prove the authenticity and integrity of an e-invoice document. Unlike a handwritten signature or a scanned image of a signature, a digital signature is mathematically bound to the document content — any change to the document after signing renders the signature invalid, providing tamper evidence. In Malaysia's MyInvois system, digital signatures are applied by LHDN to all validated invoices, creating an unforgeable official record.

How MyInvois uses digital signatures: when a business submits an invoice through the MyInvois API or portal, LHDN's system validates the document content against the UBL schema. Upon successful validation, LHDN applies its digital signature to the invoice using LHDN's private key. The resulting signed document — along with the UUID and QR code — is returned to the submitter. Anyone with LHDN's public key can verify this signature and confirm that the invoice was indeed validated by LHDN and has not been modified since.

Why digital signatures matter for businesses: the signed invoice is the definitive legal record of the transaction. In a tax audit or commercial dispute, a digitally signed MyInvois invoice has strong evidentiary value because it proves the document originated from LHDN's system (not a fabrication), the content has not been altered, and the validation occurred at a specific timestamp. Unsigned invoices — PDFs, paper documents, or self-generated files — cannot provide this level of assurance.

Business implications of the digital signature requirement: businesses do not typically need to create their own digital signatures when submitting to MyInvois — the signing is done by LHDN upon validation. However, businesses that use the Peppol network may need to sign documents with their own credentials before transmission, as the Peppol protocol requires sender-signed documents at certain transmission steps. Some advanced e-invoicing software implementations also apply a preliminary business signature before MyInvois submission as an additional layer of authenticity.

From a records management perspective, businesses should store the digitally signed invoice document (as returned by MyInvois, including the LHDN signature and UUID) rather than only the original unsigned UBL file they submitted. The LHDN-signed version is the authoritative record. Some e-invoicing software and cloud storage solutions automatically archive the signed versions of all submitted invoices, which simplifies the seven-year record retention requirement under the Income Tax Act.