The E-Evidence Regulation

E evidence rules now apply

The EU's e evidence package has applied since 18 August 2026. It consists of the Regulation on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings (Regulation (EU) 2023/1543) and the Directive on designated establishments and legal representatives (Directive (EU) 2023/1544). Together, they allow prosecutors and judges in one Member State to order a service provider in another Member State to produce or preserve electronic data directly, without going through the authorities of the provider's home state, and they oblige service providers offering services in the EU to appoint an addressee for such orders.

Germany implemented both instruments through the Electronic Evidence Implementation and Enforcement Act (Elektronische-Beweismittel-Umsetzungs-und-Durchführungsgesetz, EBewMG) of 10 March 2026. The Federal Office of Justice (Bundesamt für Justiz) supervises compliance with the duty to designate an addressee, the public prosecutor's office acts as enforcing authority, and fines for non-compliance can reach 2% of total turnover for larger providers.

Which service providers are affected

The Regulation applies to service providers that offer services in the Union (Article 2(1)). Service providers include providers of electronic communications services, domain name and IP numbering services, and information society services that enable users to communicate with each other or store or process data — for example email and messaging services, cloud storage, social networks, online marketplaces and hosting. Whether a provider offers services in the Union depends on whether it enables persons in a Member State to use its services and has a substantial connection to the Union, for example through an establishment, a significant number of users or the targeting of activities towards one or more Member States.

Controllers and processors

A production order must be addressed to the service provider acting as controller under the GDPR. It may be addressed directly to a processor that stores or processes the data on the controller's behalf only where the controller cannot be identified despite reasonable efforts or where addressing the controller might be detrimental to the investigation (Article 5(6)). For German companies that use cloud services for their own data, this means that in most cases the authorities will approach the company itself as controller, but in exceptional cases the order may go directly to the cloud provider. Data processing agreements should address how processors handle e evidence orders, including information duties and cooperation.

For German businesses, the rules are relevant in two ways. Providers of such services — including SaaS and cloud companies, telecommunications providers and platforms — are addressees of orders. Companies that use such services may find that data about their employees, customers or themselves is requested from their providers in criminal investigations, including proceedings in which a legal person could be held liable.

Production and preservation orders

A European Production Order requires the provider to hand over data; a European Preservation Order requires it to preserve data pending a subsequent request for production. Orders are transmitted by means of standardised certificates (EPOC and EPOC-PR).

Orders must be necessary and proportionate and may only be issued if a similar order could have been issued in a comparable domestic case (Article 5(2)). Orders for traffic and content data generally require the involvement of a judge, court or investigating judge.

Deadlines

Upon receiving a production order, the addressee must act expeditiously to preserve the data. It must transmit the data within ten days, or, if the enforcing state has been notified, at the end of the ten-day period unless that state raises a ground for refusal (Article 10(2) and (3)). In emergency cases, data must be transmitted within eight hours (Article 10(4)). Under a preservation order, data must be preserved for 60 days, extendable by 30 days, or longer if a production request is confirmed (Article 11(1) and (2)).

Illustration

Illustration (hypothetical): a German email provider with customers across Europe receives a European Production Order from a Spanish investigating judge for the content of a mailbox belonging to a user resident in Germany, in connection with a fraud investigation. Because the order concerns content data and the user does not reside in Spain, the issuing authority must notify the German enforcing authority, the competent public prosecutor's office. The provider preserves the data immediately and, unless the prosecutor raises a ground for refusal within ten days, transmits them to the Spanish authority at the end of that period. Its internal procedure documents the receipt, review and transmission of the data.

Grounds for refusal and the provider's position

Where notification is required, the enforcing authority — in Germany the public prosecutor's office (§ 11 EBewMG) — can raise grounds for refusal within ten days, or 96 hours in emergencies (Article 12). The grounds include immunities and privileges, rules protecting press freedom, manifest breaches of fundamental rights, ne bis in idem and, with exceptions for listed offences, the absence of double criminality.

The provider itself has limited options. It must inform the issuing authority if it cannot comply because the certificate is incomplete or contains manifest errors, because of de facto impossibility, or because compliance would conflict with the law of a third country, for which a specific review procedure applies. A provider that complies in good faith is not liable to users or third parties for damage resulting exclusively from that compliance, without prejudice to data protection obligations (Article 15(2)).

Designated establishments and legal representatives

The Directive requires service providers offering services in the EU to designate an establishment or appoint a legal representative to receive, comply with and enforce decisions and orders for electronic evidence. Under § 3 EBewMG, providers with establishments in Germany and other Member States must designate at least one establishment as addressee, providers established only in Germany must do so if they offer services in Germany or another Member State, and providers without an establishment in a participating Member State must appoint a legal representative. Providers must notify the details and languages accepted (§ 4 EBewMG). The provider and the addressee can be held jointly responsible for non-compliance (§ 5 EBewMG).

Practical set-up for providers

To comply with the e evidence rules, providers should take several organisational steps:

1. Determine whether the company is a service provider within the scope and in which Member States it offers services.
2. Designate an establishment or appoint a legal representative and notify the competent central authorities.
3. Set up a secure channel and a responsible team for receiving certificates, including emergency availability.
4. Define review steps for certificates, data categories and possible conflicts with third-country law.
5. Build technical processes to preserve and extract data quickly.
6. Keep records of all orders and responses.
7. Align customer contracts, privacy notices and transparency reporting.

Until the decentralised IT system required by Article 19 becomes mandatory, communication may use other secure channels; the obligation to use the system applies one year after the Commission's implementing acts have been adopted (Article 34(2)).

Fines in Germany

§ 18 EBewMG makes breaches administrative offences. Failure to designate an establishment, appoint a representative or make the required notifications, failure to preserve or transmit data in time, and failure to comply with preservation orders can be fined up to EUR 500,000.

For providers with total turnover above EUR 25 million, fines for breaches of the transmission and preservation obligations can reach 2% of total turnover, reflecting the Regulation's requirement that Member States allow penalties of up to 2% of worldwide annual turnover (Article 15(1)). Lesser notification failures are subject to lower caps. The Federal Office of Justice monitors the designation and notification duties, while fines for failures to comply with individual orders follow the procedures of the Administrative Offences Act. Providers that receive a fine notice can challenge it in court, and the EBewMG contains specific rules on judicial review of decisions relating to orders.

Data protection and corporate considerations

Orders override confidentiality obligations towards customers, but the GDPR continues to apply. Providers should limit disclosure to the data requested and document each order. The issuing authority is responsible for informing the person whose data are requested, and may delay or restrict this under the conditions of EU law on data protection in criminal matters (Article 13). Where a processor receives an order, it must inform its customer as controller unless the issuing authority has asked it to refrain from doing so (Article 5(7)). Customer contracts and privacy notices should explain that data may be disclosed in response to orders.

Companies that are themselves subject to investigation should be aware that their data may be obtained from cloud and communication providers across borders without a request to the company. This affects internal investigation strategy, document retention and the assessment of legal privilege. Cross-border investigations involving the United States or other third countries may raise conflicts of laws, for which the Regulation provides a review procedure. See our pages on white-collar defence and internal investigations.

E evidence and other legal instruments

The new orders do not replace existing tools. The European Investigation Order under Directive 2014/41/EU, mutual legal assistance and national investigative powers remain available, and authorities can choose the instrument that fits the case. The German designated establishment or legal representative must also receive orders under these other instruments where they are addressed to it, as § 2 EBewMG extends the addressee regime accordingly. For service providers, this means that a single, well-organised point of contact should handle all types of e evidence requests, applying the specific deadlines and review steps of each instrument.

How TRW & Co helps with e evidence

We advise service providers on the e evidence rules: scope, designation of establishments and legal representatives, procedures for production and preservation orders, conflicts with third-country law and data protection. We review orders received, communicate with issuing and enforcing authorities, and defend against fine proceedings. We also advise companies whose data are requested in criminal investigations. See our page on data and digital and our insight on incident response, or contact us.