E-Evidence: Ten Days Until Emails Reach the State

5 min read

An order from another EU country now lands in the provider’s inbox. Chat histories, customer data and locations must be handed over within ten days, or eight hours in emergencies.

Related:NIS-2 Registration: What Executives Must Do Now  /  Article 50 of the AI Act: What Deployers Must Do from August 2026

What is E-Evidence? Digital subscriber, traffic or content data that law enforcement authorities require providers to preserve or produce. Regulation (EU) 2023/1543 has applied since 18 August 2026; Germany’s core implementing act, the EBewMG, has been part of federal law since 13 March 2026.

The order goes straight to the provider

Previously, requests went through the authorities. A foreign prosecutor sent a mutual legal assistance request or a European Investigation Order to the authority in the country where the provider was established. That authority checked it, forwarded it and waited. Months were common. By then, chat histories had often been deleted.

Regulation (EU) 2023/1543 changes the recipient. Law enforcement authorities in one member state contact the service provider in another directly. Two instruments underpin the new procedure: the European Production Order and the European Preservation Order. One demands the data. The other preserves it until production follows.

The Federal Office of Justice describes the shift clearly. For traffic and content data, authorities in the country of establishment retain an oversight role and can stop transmission within ten days in certain cases. Operationally, the process will bypass those authorities and go directly through the provider.

Germany’s core implementing act, the EBewMG, entered into force on 13 March 2026. It sets out responsibilities, procedures and legal remedies. The Regulation itself applies from 18 August 2026 and covers all member states except Denmark.

Three groups are on the list

The definition of service provider is broad. It covers natural and legal persons. The BfJ identifies three categories.

First: electronic communications services. The BfJ lists messaging and video conferencing services such as Signal, WhatsApp and Zoom, plus internet access services such as Telekom and Vodafone. These services facilitate interaction between users.

Second: certain information society services. The BfJ names Amazon, eBay, Google, Zalando and Meta, alongside cloud and hosting. Gaming providers are included if their service offers communication or data storage.

Third: domain name and IP numbering services, with DENIC as an example. Anyone unsure should use the BfJ’s assessment framework before anyone registers an address on the Notification-Platform. Existing providers should have registered by 18 August 2026. New providers have six months after launching their service in the Union. The provider receiving orders is based in a participating member state where the service actually operates.

The clock runs in days and hours

A production order requires the data within ten days. In emergencies, providers have eight hours. A preservation order requires data to be secured immediately. The BfJ sets out these deadlines in its E-Evidence information and FAQs.

Subscriber data describes the person: name, address, contact details, service type and duration. Traffic data describes service use, such as a message’s origin and destination or a device’s location. Content data covers the remaining digital material: texts, videos and images.

The more sensitive the data, the higher the threshold. Subscriber data and identifying traffic data are subject to the requirements for a preservation order. Content data and other traffic data require more: an offence carrying a maximum prison sentence of at least three years, or certain offences involving cybercrime, child pornography, counterfeiting non-cash means of payment or terrorism. The order must then come from a court or judge.

Failure to comply with an order triggers enforcement proceedings. Providers can challenge an order on grounds of formal defects, lack of jurisdiction, immunities, privileges and press freedom. Breaches of obligations can incur fines: depending on the violation, up to 500,000 euros, or alternatively, for certain violations, up to two percent of total worldwide turnover in the previous year. As the central authority, the BfJ oversees recipients’ appointment of representatives authorised to receive orders and their cooperation. It does not enforce individual orders but intervenes when a provider is systematically uncooperative.

Start by checking your own service

The practical damage rarely comes from the first letter. It comes when nobody can receive the order. Ten days is manageable for a legal department. Eight hours requires clarity about who checks the inbox at night, who finds the data and who reviews the order.

Three questions suffice. Does the company offer one of the three service types the BfJ describes? Is a representative authorised to receive orders based in a participating member state? Is that representative registered on the Notification-Platform?

The Regulation supplements mutual legal assistance and the European Investigation Order with a direct channel. Anyone operating hosting, cloud, marketplace, messaging or conferencing services needs a process that recognises orders, meets deadlines and raises objections in time. The BfJ’s assessment framework and FAQs are the starting point.

Frequently asked questions

Image source: AI-generated (August 2026)

Translated from the German original using artificial intelligence. The German version is authoritative.