Eight hours to respond when an authority in another EU Member State requests your customers’ data

It is eight o’clock in the morning when an email lands in your company’s General Counsel’s inbox. A prosecutor in another EU Member State is requesting access to your customer’s messages as part of an investigation into serious fraud, and you have eight hours to respond. In the past, such a request would have gone through a slow mutual legal assistance process and could have taken weeks or months. Now it may be sent directly to your company, without the involvement of the authorities in your home country, and the clock is ticking.

This is the so-called E-evidence Regulation, formally Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings. The Regulation has applied since 18 August 2026. Under it, an authority in one Member State may, in criminal proceedings, order a service provider established in another Member State to produce or preserve electronic evidence, regardless of where the data is located. The authority may address the service provider directly, without involving the authorities in the service provider’s home country. The Regulation does not apply only to major technology companies. It may also apply to a Finnish or other European SaaS, hosting or cloud service provider that offers services in more than one Member State and stores user data.

For the purposes of the Regulation, service providers include in particular:

• providers of electronic communications services, such as telecommunications operators and providers of email and messaging services;
• providers of internet domain name and IP numbering services, such as domain name registries and registrars and providers of WHOIS data; and
• other information society services that enable users to communicate with one another or store data on their behalf, such as cloud storage services, online marketplaces and social media platforms.

In short, the Regulation may also apply to your business, not only to technology giants, if you provide digital services in more than one EU Member State and process or store user data. The good news is that an organisation can navigate an eight-hour deadline successfully, provided it has determined in advance who is responsible for responding to an order and which grounds for refusal may be invoked where necessary. Below, we highlight three of the Regulation’s most critical requirements.

Key practical implications

These are the first three requirements to understand.

• Short response times mean that, as a rule, the requested data must be produced within ten days. In emergency cases, however, the deadline may be as short as eight hours.
• The preservation obligation means that, upon receiving a European Preservation Order Certificate (EPOC-PR), the addressee must preserve the requested data without undue delay until it can be produced. The obligation generally remains in force for 60 days and may be extended by a further 30 days.
• A significant risk of penalties means that failure to comply with an order without an accepted justification may result in a financial penalty of up to 2% of the service provider’s total worldwide annual turnover.

What is the regulation about?

Under Article 3 of the Regulation, an order is addressed directly to the service provider’s designated establishment or legal representative in another Member State. The order must be necessary and proportionate and may therefore be issued only if a similar order could have been issued under the same conditions in a comparable domestic case. In practice, for example, a Finnish prosecutor may obtain data directly from a service provider established in Sweden or Ireland without involving the authorities of that country.

Two Instruments, Two Purposes

Article 3 of the Regulation distinguishes between two instruments: the European Production Order and the European Preservation Order. A European Production Order enables an authority to require the immediate production of data, such as subscriber data, traffic data or content data. A European Preservation Order is a more limited and temporary measure requiring the addressee to preserve the requested data without undue delay until it can be produced. Under Article 11 of the Regulation, the preservation obligation generally ceases after 60 days unless the issuing authority confirms that a subsequent request for production has been issued. The period may be extended by a further 30 days where necessary.

In practice, a European Preservation Order therefore freezes the data, giving the authority time to seek a European Production Order or use the mutual legal assistance procedure.

What about individual rights?

The new powers inevitably raise questions about privacy, and the Regulation therefore includes several safeguards. An order must be necessary and proportionate, and the person whose data is requested has the right to effective remedies to challenge the order throughout the criminal proceedings in which the data is used.

Under Article 12 of the Regulation, the service provider or the authority of the enforcing State may also invoke grounds for refusal in certain circumstances. These may apply, for example, where the data is protected by journalistic source protection or another privilege or immunity, where enforcement would manifestly breach a fundamental right, where it would be contrary to the ne bis in idem principle, or where the conduct under investigation does not constitute an offence in the enforcing State. These safeguards help ensure that the accelerated cross-border procedure does not undermine fundamental rights or the core legal principles of the enforcing State.

Why the regulation may apply to your organisation

As the opening scenario shows, this is not a theoretical risk. An order may arrive unexpectedly and require action within a very short timeframe. Service providers operating in the EU should review, at the latest now, how their organisation identifies and handles European Production Orders and European Preservation Orders, who is responsible for them, the applicable deadlines, the grounds on which they may be challenged and how any grounds for refusal can be invoked in time. If the addressee cannot produce the requested data, for example because the certificate is incomplete, it must inform the issuing authority without undue delay and request clarification.

A service provider may also claim reimbursement from the issuing State for costs incurred in responding to an order, where the national law of that State provides for such reimbursement. For authorities, the reform creates a new and faster route for obtaining electronic evidence. At the same time, it requires careful consideration of the fundamental rights and legal remedies available to the client when challenging an order.

---

What is Morning from Hell? Morning from Hell is Eversheds Sutherland’s way of challenging companies to identify their most critical business risks before they turn into a crisis.