Electronic evidence in criminal proceedings – production and preservation orders

SUMMARY OF:

Regulation (EU) 2023/1543 on European Production and Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings

WHAT IS THE AIM OF THE REGULATION?

It aims to facilitate and speed up access to electronic evidence used to investigate and prosecute criminal offences, regardless of where the data is located.

A judicial authority in one European Union (EU) Member State may require the designated establishment of a service provider, or its appointed legal representatives, in another Member State to:

produce electronic evidence, such as subscriber data, internet protocol (IP) addresses needed to identify a user, emails, texts and in-app messages;
preserve specified data pending a future request.

KEY POINTS

Electronic evidence (e-Evidence), refers to data stored by or on behalf of a service provider, in an electronic form, that is used to investigate and prosecute criminal offences, including subscriber data, data used for identifying the user, traffic data and content data.

For the purposes of the regulation, a service provider is anyone providing one or more of the following categories of services (except for financial services):

electronic communication services, such as:
- internet access services,
- interpersonal communications services;
internet domain name and IP numbering services, such as IP address assignment, domain name registries, and related privacy and proxy services;
other information society services enabling users to communicate with each other, or that store or process data on behalf of the user, such as social networks, online marketplaces and other hosting service providers.

European production order

The European production order allows a judicial authority in one Member State to obtain electronic evidence (such as emails, text or messages in apps, along with information to identify a perpetrator as a first step) directly from a service provider, or its legal representative, in another Member State.
If the electronic evidence includes content data or traffic data, except for data requested for the sole purpose of identifying the user, a court or judge must issue or review the order, and the judicial authority must notify the competent authority of the Member State in which the designated establishment is located, or the legal representative resides. This authority of another Member State can stop the production of data in specific circumstances, based on four grounds for refusals.

European preservation order

The European preservation order allows a judicial authority in one Member State to request that the designated establishment of a service provider, or its legal representative, in another Member State, preserve specified data prior to a subsequent request to produce the data.

European production and preservation order certificates

European production or preservation orders are transmitted through a European Production Order Certificate (EPOC) or a European Preservation Order Certificate (EPOC-PR).

Additional points

When an EPOC is received, the requested data must be transmitted directly to the issuing authority or the law enforcement authorities within 10 days, or in cases of emergency within 8 hours. In cases where a notification is required, the enforcing authority has 96 hours to raise a ground for refusal.
When an EPOC-PR is received, the data requested must be preserved without delay for a period of 60 days (which can be extended for another 30 days by the issuing authority), unless there has been a subsequent request for the data to be produced. If preserving the data is no longer necessary, the issuing authority must inform the addressee without delay.
The issuing authority has 5 days to provide clarification or correction when the addressee cannot comply with the order because it is incomplete or contains manifest errors.
The addressee must contact the issuing authority without undue delay if they cannot comply because of factors beyond their control, notably where the person whose data is requested is not their customer, or the data has been deleted before receiving the order.
The issuing authority must inform the person whose data is being requested without undue delay.
Service providers must ensure the confidentiality, secrecy and integrity of the EPOC or the EPOC-PR and of the data produced or preserved.

Penalties

Member States must ensure that pecuniary penalties of up to 2% of the service provider’s total worldwide annual turnover can be imposed.
Service providers are not held liable in Member States for any prejudice to their users or third parties exclusively resulting from compliance with an EPOC or an EPOC-PR in good faith.

Remedies

Individuals subject to a European production order have the right to:

information,
effective remedies, including during criminal proceedings.

Decentralised IT system

Written communication between authorities and designated establishments or legal representatives of service providers under this regulation must be carried out through a secure and reliable decentralised IT system.

FROM WHEN DOES THE REGULATION APPLY?

The regulation applies from 18 August 2026.

BACKGROUND

The regulation is part of a package that includes a directive on the designation of establishments and appointment of legal representatives of service providers for the purpose of gathering evidence in criminal proceedings (see summary).

For further information, see:

e-Evidence (European Commission).

MAIN DOCUMENT

Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the execution of custodial sentences following criminal proceedings (OJ L 191, 28.7.2023, pp. 118–180).