The E-Evidence Regulation: European Production Orders for Your Data from 18 August 2026

From 18 August 2026, a prosecutor or an investigating judge in any Member State bound by the Regulation can send an order straight to the company that holds your email, your messages or your cloud storage in another Member State, and that company has ten days to hand the data over. No letter rogatory, no central authority, no request routed through a ministry. That is what Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence does, and it is the single most consequential change to cross-border evidence gathering in a decade. This article sets out what the Regulation actually says and where the defence of an investigated person still has purchase.

What Changes on 18 August 2026

Regulation (EU) 2023/1543 of 12 July 2023 (OJ L 191, 28.7.2023) entered into force in 2023 but, under Article 34(2), applies from 18 August 2026. Until now, obtaining electronic evidence held by a provider established in another Member State meant mutual legal assistance or a European Investigation Order: State-to-State instruments, executed by the authorities of the other country under their own law and their own timetable. The Regulation replaces that architecture for the data it covers with a direct channel between a judicial authority and the provider.

Its companion instrument, Directive (EU) 2023/1544, required Member States by 18 February 2026 to oblige providers offering services in the Union to designate an establishment or appoint a legal representative to receive these orders. That is the address the order lands on: Article 7 of the Regulation provides that orders are addressed directly to that designated establishment or legal representative, and only exceptionally, in emergencies where it does not react in time, to any other establishment of the provider in the Union.

Two Orders, Four Categories of Data

The Regulation creates two instruments (Article 3):

• The European Production Order — a decision ordering the provider to produce electronic evidence.
• The European Preservation Order — a decision ordering the provider to freeze data so that it does not disappear before a subsequent request for production is made.

Both operate over four categories of data, and the distinction between them governs almost everything else: subscriber data (identity, address, billing data, type and duration of the service); data requested for the sole purpose of identifying the user (essentially IP addresses, source ports and time stamps); traffic data (the metadata of communications — source and destination, device location, date, time, duration, protocol, log-ins and log-offs); and content data (text, voice, video, images, sound). The providers covered are electronic communications services, internet domain name and IP numbering services, and other information society services that let users communicate with each other or that store data on their behalf where storage is a defining component of the service.

When an Order May Be Issued

Two filters apply, and they are the first place a defence lawyer should look.

Who may issue it (Article 4). For subscriber data and user-identification data, the order may come from a judge, a court, an investigating judge or a public prosecutor. For traffic data and content data, only a judge, a court or an investigating judge may issue or validate it — a prosecutor cannot.

For which offences (Article 5). Subscriber data and user-identification data may be sought for all criminal offences. Traffic and content data may only be sought for offences punishable in the issuing State by a custodial sentence of a maximum of at least three years, or for a closed list of offences committed wholly or partly by means of an information system (non-cash payment fraud under Directive (EU) 2019/713, child sexual abuse under Directive 2011/93/EU, attacks against information systems under Directive 2013/40/EU), or for terrorism offences under Directive (EU) 2017/541. Orders may also be issued to execute a custodial sentence of at least four months where the convicted person has absconded and the decision was not rendered in absentia.

On top of that, Article 5(2) requires every order to be necessary and proportionate to the purpose of the proceedings, taking into account the rights of the suspect or accused person, and permits it only where a similar order could have been issued under the same conditions in a comparable domestic case. That double condition — proportionality plus domestic equivalence — is a substantive limit, not a formality.

The Deadlines: Ten Days, Eight Hours, Sixty Days

Article 10 sets the clock for a production order. On receipt, the addressee must act expeditiously to preserve the data. Where no notification to the enforcing State is required, it must transmit the data within ten days. Where notification is required, it transmits at the end of that ten-day period unless the enforcing authority has raised a ground for refusal. In emergency cases — an imminent threat to a person’s life, physical integrity or safety, or to critical infrastructure — the data must be transmitted within eight hours, and the enforcing authority that wishes to object has 96 hours to say so.

A preservation order works differently (Article 11): the provider must preserve the data without undue delay, and the obligation ceases after 60 days unless the issuing authority confirms that a subsequent request for production has been issued. Within that window the issuing authority may extend preservation by a further 30 days. In practice this is the instrument that will be used first, to stop a mailbox being deleted while the substantive request is prepared.

Notification to the Enforcing State and Grounds for Refusal

The Regulation does not leave the enforcing State entirely out. Under Article 8, where a production order seeks traffic or content data, the issuing authority must notify the enforcing authority at the same time as it sends the order to the provider — and that notification has suspensive effect on the provider’s obligation to hand over the data, except in emergencies. There is an important exception: notification is not required where the issuing authority has reasonable grounds to believe both that the offence was, is being or is likely to be committed in the issuing State and that the person whose data is requested resides there.

Where notification does take place, Article 12 allows the enforcing authority to raise, within ten days (96 hours in emergencies), a limited set of grounds for refusal: that the data is protected by immunities or privileges under the law of the enforcing State, or by rules on criminal liability relating to freedom of the press or of expression; that execution would, in exceptional situations, entail a manifest breach of a fundamental right under Article 6 TEU and the Charter; that it would be contrary to ne bis in idem; or that the conduct is not an offence in the enforcing State, unless it falls within the listed categories of the Regulation’s Annex IV. Immunities and privileges are the ground with the most practical bite, because it is where legal professional privilege lives.

Penalties for Providers, and What Happens if They Refuse

Article 15 requires Member States to provide for pecuniary penalties of up to 2 % of a provider’s total worldwide annual turnover in the preceding financial year for infringements of the production, preservation and confidentiality obligations. In exchange, providers are not liable to their users for prejudice resulting exclusively from good-faith compliance with an order. The incentive structure is therefore asymmetric: a provider that hesitates risks a turnover-based fine, while a provider that complies is shielded. Nobody should expect a provider to litigate on a customer’s behalf.

Where the provider does not comply, Article 16 lets the issuing authority ask the enforcing authority to enforce the order; that authority decides on recognition within five working days. And where compliance would conflict with the law of a third country — the classic scenario with a United States provider — Article 17 gives the addressee ten days to file a reasoned objection, which triggers a review by a court of the issuing State, with execution suspended in the meantime. A reasoned objection cannot be based merely on the fact that the data is stored outside the Union.

What It Means for the Defence

Three consequences follow for anyone under investigation whose communications sit on a foreign server.

You will normally be told — but not always immediately. Article 13 obliges the issuing authority to inform the person whose data has been produced without undue delay, and to include information about available remedies. It may delay, restrict or omit that information under the conditions of Article 13(3) of Directive (EU) 2016/680, recording the reasons in the case file. The moment the notification arrives is the moment the clock starts on a challenge, so it should never be filed away unread.

The challenge is heard in the issuing State. Article 18 guarantees the right to an effective remedy against a production order and, crucially, provides that it must include the possibility of challenging the legality of the measure, including its necessity and proportionality. That remedy is exercised before a court of the issuing State under its national law, on the same time limits as comparable domestic cases. Article 18(5) adds that the rights of the defence and the fairness of the proceedings must be respected when the evidence obtained is assessed.

Spanish evidentiary standards still apply to the result. Data arriving through a European Production Order is not immune from the ordinary controls on digital evidence in a Spanish courtroom: authenticity, integrity and chain of custody, and the exclusion of evidence obtained in breach of fundamental rights under Article 11.1 of the Organic Law on the Judiciary. We examine both in our analysis of the Supreme Court case law on digital evidence and in our guide to unlawfully obtained evidence and the fruit of the poisonous tree. The Regulation changes how the material is obtained; it does not lower the threshold for what a court may rely on to convict.

Nor does the Regulation displace the other cross-border instruments. The European Investigation Order and mutual legal assistance remain in place for everything the Regulation does not cover, alongside surrender procedures under the European Arrest Warrant; we map that landscape in our guide to transnational criminal proceedings.

How We Can Help

If you have been notified that your data has been produced under a European Production Order, or you suspect that a preservation order has been served on your provider, the useful work is done early: reading the order against the thresholds of Article 5, checking whether the category of data matched the issuing authority’s powers under Article 4, testing necessity and proportionality, identifying any privilege that should have triggered a ground for refusal, and preserving the objection so that it can be raised when the evidence is assessed at trial. Our practice covers the defence against digital evidence in criminal proceedings and cross-border investigations affecting clients based in cybercrime and technology cases. If this affects you, we can review the order and set out your options.