Obligation to provide digital evidence as supplier of digital services

Do you offer digital services such as internet and communications services in the European Union? Or do you provide cloud or storage services? If the police or the courts in the EU requests digitally stored client data (you get a European order), you must provide these data. This is set out in the European eEvidence regulation.

These rules are intended to make sure that the police and the judicial authorities can gather digital evidence as quickly and easy as possible in order to action against criminals.

Who must share or retain digital evidence?

You have to share or retain data on a European order if you offer 1 or more of the following services to users in the EU:

• electronic communications services such as the internet and telephony
• services that allow users to store data, such as cloud storage
• online services that enable users to communicate with one another, such as hosting platforms, marketplaces, and gaming services
• services relating to internet domains or IP addresses

Which data counts as digital evidence?

Data which police and the courts can use as digital evidence in criminal proceedings are, for example:

• email and other contact data
• IP addresses
• content of communications

The authorities may require you to retain or share this type of data.

Rules for supplying or retaining digital evidence

Do you offer services covered by the eEvidence Regulation? Then you have the following obligations:

• In the Netherlands, from the 1st quarter of the 2027 you must register with a European register (Court Database, CDB, in Dutch) This way the authorities can locate your organisation and request digital evidence from you. The exchange of the evidence itself takes place via a different software system. More information about the registration and exchange system will be available at a later date. 
• You must respond immediately to a judicial authorities’ request.
• You have to supply the digital evidence within 10 days of the judicial authorities’ request. In cases of emergency you must do so within 8 hours. For example in life-threatening situations or where a person’s safety is at risk.
• In case of a preservation order you must retain the digital evidence for 60 days. The judicial authority can extend this with another 30 days within that period.
• You must set up your system in such a way that you can provide digital evidence within the specified time limits.
• You have to keep to privacy and security regulations when sharing data.

The Netherlands Authority for Consumers and Markets (ACM) checks whether you are registered and whether you can supply data within the specified time limits. If you fail to respond in time to a request or if you fail to supply data, the Netherlands Public Prosecution Service (Openbaar Ministerie, OM) may take enforcement action.