The EU’s e-Evidence Regulation began to apply on 18th August 2026, introducing a new framework through which judicial authorities can seek electronic evidence directly from service providers operating across borders.
Regulation (EU) 2023/1543 establishes European Production Orders and European Preservation Orders for use in criminal proceedings and, in specified circumstances, the execution of custodial sentences. Electronic evidence may include subscriber information and other categories of data held by providers, such as emails, messages and traffic data. The European Commission estimates that electronic evidence is relevant in the large majority of criminal investigations, but it may be stored in another jurisdiction and can be easily altered or deleted.
The new process is intended to make access faster and more consistent than relying exclusively on traditional mutual legal assistance channels. A production order requires the recipient to provide identified data, while a preservation order requires it to retain data so that it remains available for a subsequent request.
The regime is important beyond the EU’s borders. Providers offering covered services in the EU must designate an establishment, if established in the Union, or appoint a legal representative if they are not. That addressee must be able to receive and comply with orders. UK-based providers serving EU markets may therefore be directly affected even though the UK is no longer an EU Member State.
Implementation is not simply a matter for the legal team. Providers should establish a reliable intake channel, authenticate orders, classify the requested data, calculate response deadlines, preserve material without accidental deletion and escalate questions concerning conflicts of law or fundamental rights. They should also ensure that disclosures are limited to what an order lawfully requires and that access to responsive information is logged and restricted.
The Regulation contains procedural safeguards and routes for objection or review, but organisations will need trained personnel capable of applying them under time pressure. Incident-response, law enforcement request and data retention procedures should now be tested against the new framework, including out-of-hours coverage and coordination between EU representatives, privacy teams, security staff and operational data owners.
For UK organisations, the immediate task is a scope assessment: identify services offered in the EU, confirm whether the designation rules apply, verify that the appointed representative is operational and map where potentially responsive data are held. Contracts with hosting, communications and support providers should also be reviewed so that preservation and production obligations can be met without avoidable delay or over-disclosure.
For more information, see our course on International Data Transfers – Overcoming the Limitations.
