The accelerated pace of digitalization and the mass migration of businesses to cloud solutions open up unprecedented opportunities for process optimization and cost reduction. However, for Ukrainian enterprises, this also creates a complex, yet often underestimated, challenge: how to guarantee that their electronic archives remain legally valid, accessible, and usable throughout the legally established retention periods, which can extend for decades?
This tension between the flexibility, scalability, and cost-effectiveness of cloud solutions and the strict, often static, requirements of Ukrainian legislation regarding the integrity, authenticity, and accessibility of electronic archives for ultra-long terms (up to 75+ years or permanently) demands proactive planning. This includes preserving the validity of qualified electronic signatures (QES) and preventing format obsolescence. Avoiding future legal and operational risks is a key priority for CIOs, CTOs, and heads of document management departments.
Legal Framework for Electronic Archiving in Ukraine
The legal force of electronic documents in Ukraine is enshrined in the Law of Ukraine "On Electronic Documents and Electronic Document Management" No. 851-IV. It establishes that an electronic document cannot be denied solely because it is in electronic form and is equivalent to a paper original if it contains all mandatory requisites [2, 5, 8]. One of the most important requisites that gives a document legal force is the electronic signature [8].
According to the Law of Ukraine "On Electronic Identification and Electronic Trust Services" No. 2155-VIII, a qualified electronic signature (QES) has the same legal force as a handwritten signature and is presumed to be equivalent to a handwritten signature [2, 6, 9, 32]. This is fundamental to the legitimacy of electronic document management and archiving. The retention periods for electronic documents must be no shorter than those established by law for corresponding paper documents, which for some types of documents can be up to 75 years or more [5, 14, 15, 19, 21, 25, 28, 29]. Detailed procedures for working with electronic documents and preparing them for archival storage are regulated by the Order of the Ministry of Justice of Ukraine No. 1886/5 [4, 16, 17, 18, 25, 26, 35].
Key Legislative Requirements for Integrity and Accessibility
Article 13 of the Law of Ukraine "On Electronic Documents and Electronic Document Management" defines the main requirements for storing electronic documents [14, 27]:
- Accessibility: Information contained in electronic documents must be available for its further use. This means that an archived document can be opened, sent, or provided for verification at any time, regardless of technological changes [14, 27].
- Integrity and Authenticity: The ability to verify the integrity of data on electronic media must be ensured. Information that allows establishing the origin and purpose of an electronic document, as well as the date and time of its sending or receipt, must be preserved [14, 27, 36, 38].
- Recoverability: The ability to restore an electronic document in the format in which it was created, sent, or received must be ensured [14, 27].
If it is impossible to store electronic documents on electronic media for the established period, the legislation provides for measures such as duplication on multiple media or periodic copying. As a last resort, if these requirements cannot be met, electronic documents may be stored in paper copy form [14, 27]. However, the goal of modern archiving is to avoid paper duplication.
The QES Challenge: Long-Term Validity of Signatures with CAdES-X Long
One of the most complex aspects of long-term storage of electronic documents is maintaining the validity of qualified electronic signatures (QES). The maximum validity period for a QES certificate is typically 1 or 2 years, while the legal retention period for documents can span decades [19, 24, 28, 31]. The question arises: how to verify the authenticity of a signature after the certificate has expired?
The solution is to use the CAdES-X Long (CMS Advanced Electronic Signatures with Long-Term Validation) electronic signature standard. This extended electronic signature format was developed specifically for long-term storage, including documents that must be retained for decades or even centuries [19, 23, 24, 28, 31]. CAdES-X Long includes additional attributes such as time stamps (TSP), signer and provider certificates, the root certificate of the Central Certification Authority (CCA), and OCSP server responses that confirm certificate statuses. This allows verifying the legitimacy of a signature even after the QES certificate expires or if the signature issuing authority is no longer available [19, 23, 28]. Integrating CAdES-X Long support is critical for any long-term cloud archiving architecture.
Architectural Principles of Cloud Archiving for Compliance
To ensure the long-term legal validity and archival compliance of electronic documents in a cloud environment, a comprehensive architectural approach must be applied:
Object Immutability: Utilizing features such as WORM (Write Once, Read Many) or Object Lock, offered by modern cloud storage. This guarantees that once archived, a document cannot be modified or deleted within the established period, ensuring its integrity.
Versioning: Implementing versioning mechanisms allows tracking any changes made to a document and restoring its previous states if necessary, which is important for confirming authenticity.
Lifecycle Policies: Automating the processes of moving documents between different cloud storage tiers (e.g., from hot to cold or archive storage) in accordance with legally defined retention periods. This optimizes costs while maintaining accessibility and compliance.
Data Residency: Selecting cloud regions that comply with Ukrainian legislation requirements for data localization, especially for sensitive information. This ensures legal compliance regarding data storage within Ukraine.
Audit and Monitoring Mechanisms: Implementing robust audit systems that record all actions with archived documents: who performed what operations and when. This ensures transparency, accountability, and is an important element of the evidence base.
Format Migration Strategy: As technologies evolve and file formats become obsolete, a strategy for periodically converting archived documents to newer, current formats is necessary. This ensures the long-term accessibility of the information contained in the documents without losing their legal validity.
Checklist: Evaluating Cloud Solution Readiness for Long-Term Storage
To effectively evaluate and select a cloud solution for long-term archiving, enterprise executives should pay attention to the following key aspects:
- Does the chosen cloud solution comply with the requirements of the Law of Ukraine "On Electronic Documents and Electronic Document Management" and "On Electronic Identification and Electronic Trust Services"?
- Does the storage system support the CAdES-X Long format for long-term QES validation?
- Does the cloud storage ensure object immutability to guarantee integrity?
- Are document lifecycle policies implemented in accordance with legally established retention periods?
- Does the chosen cloud provider's region meet the requirements for data localization in Ukraine?
- Is there a strategy for periodic format conversion to prevent obsolescence and ensure accessibility?
- Are there reliable mechanisms for auditing and monitoring access to and changes in archived documents?
- Is the ability to promptly restore documents in their original format upon request ensured?
Long-term archiving of electronic documents in the cloud is not just a technical task but a strategic decision that requires a deep understanding of both technologies and legislative nuances. Proactive planning and the integration of appropriate architectural and organizational solutions are key to avoiding significant legal and operational risks in the future. SL Global Service is ready to be your reliable partner in navigating this complex, yet critically important, landscape, ensuring the compliance and security of your digital assets for decades to come.
