EU e-Evidence Regulation introduces new cross-border access rules

The EU e-Evidence Regulation became applicable on 18 August 2026, introducing new rules for obtaining and preserving electronic evidence in cross-border criminal investigations. The framework allows competent judicial authorities in one EU Member State to issue European Production Orders and European Preservation Orders directly to designated establishments or legal representatives of service providers operating in another Member State.

The rules cover a range of digital services, including electronic communications, domain name and IP numbering services, and certain online and cloud-based services that store or process data on behalf of users. Denmark is not bound by the Regulation.

Service providers receiving a European Production Order generally have ten days to provide the requested data, while emergency requests must be handled within eight hours. The Regulation also includes grounds for refusing orders and safeguards related to fundamental rights, privacy and personal data.

The new framework does not require service providers to retain data or decrypt encrypted information. Instead, it establishes a mechanism for accessing data that may already be held by providers, regardless of where the relevant server or storage infrastructure is physically located.

By allowing authorities to address certain cross-border evidence requests directly to service providers, the Regulation changes the traditional process of relying primarily on cooperation between national authorities. For cloud and other digital service providers, this creates a more direct role in responding to requests for electronic evidence and further connects issues of jurisdiction, law enforcement access and data protection.