On 18 August 2026, the EU's E-Evidence Regulation (Regulation (EU) 2023/1543) will begin applying directly across all EU member states except Denmark. The framework introduces a fundamentally new mechanism for cross-border access to electronic evidence in criminal proceedings - one that bypasses traditional mutual legal assistance channels and allows law enforcement authorities to issue orders directly to service providers in other member states.
The Regulation creates two new investigative instruments. A European Production Order enables an authority in one member state to compel a service provider in another to produce specified electronic data - including subscriber data, IP address data, traffic data, and content data - within a standard period of ten calendar days. In urgent cases, this period may be reduced to eight hours. A European Preservation Order allows authorities to require a service provider to preserve specific data for 60 days, ensuring it remains available for a subsequent production request.
Service providers - including cloud providers, messaging platforms, email services, and any entity offering services to users within the EU - must designate a permanent point of contact within the EU by the application date. The Regulation also extends to providers based outside the EU, provided they offer services to users within the Union. The accompanying Directive (EU) 2023/1544, which member states were required to transpose by 18 February 2026, establishes the framework for appointing designated establishments or legal representatives.
The privacy implications are significant. Production orders for traffic data and content data must be validated by a judicial authority, but the mechanism nonetheless enables access to communications content across borders without the involvement of authorities in the provider's jurisdiction - a departure from existing mutual assistance procedures. The Regulation includes safeguards, including grounds for refusal and a notification mechanism, but civil liberties organisations have raised concerns about the speed of the process and the limited scope for provider-side review.
Acompli perspective: The E-Evidence Regulation creates a direct channel between law enforcement and service providers that will operate alongside - and sometimes in tension with - GDPR obligations. Organisations that provide digital services to EU users should ensure they have designated a contact point, that their records of processing identify the categories of data that may be subject to production orders, and that their incident response procedures account for law enforcement requests under this new framework. The interaction between E-Evidence production orders and GDPR data subject rights - particularly the right to information - will require careful navigation.