In 2026, eEvidence will come into force in Europe. This regulation and accompanying directive, which will be implemented in national legislation, will ensure that Member States will soon be able to request direct access to electronic evidence (e-evidence) from providers offering digital services in Europe. That is why NBIP discusses in this article how providers should prepare for eEvidence.
However, according to the European Commission, obtaining this data is a lengthy legal process. This is particularly true if the data is stored on servers located in other European countries. That is why the European Commission has proposed two new rules under the heading of eEvidence. With eEvidence, Member States will soon be able to request direct access to electronic evidence from providers offering services in Europe.
What is eEvidence?
The eEvidence package consists of a regulation and a directive. The regulation is directly applicable, which means that it does not need to be transposed into national law but will enter into force directly in the Member States. This will happen on 18 August 2026.
The regulation and the directive regulate the following matters:
Regulation
The regulation establishes the legal basis for competent authorities to access stored data within a Member State. This falls under the disclosure order. It also states that providers must respond within 10 days, or in urgent cases within 8 hours. Currently, a period of 120 days still applies to disclosure orders, and a period of ten months applies to mutual legal assistance procedures.
The preservation order prevents a provider from deleting electronic evidence while the disclosure order is still pending.
Directive
According to the directive, providers who are not established in the European Union but offer services here must appoint a legal representative in a Member State. This representative is responsible for receiving, complying with and implementing orders and decisions relating to eEvidence.
Who will be affected by eEvidence?
The directive and regulation apply to providers of:
- public electronic communications networks
- internet domain names and IP numbering
- communications, storage and processing services
As a provider covered by eEvidence, you must be registered with the Netherlands Authority for Consumers and Markets (ACM). The ACM acts as the supervisory authority for eEvidence and ensures that companies register in the European Commission’s Court Database (CDB) in a timely manner. If this is not done, the ACM can apply administrative law to enforce compliance when companies fail to register (in a timely manner) or keep their data up to date.
What is expected of me as a provider within eEvidence?
All service providers offering online services in the EU on 18 March 2026 must register by 18 August 2026 at the latest so that eEvidence-orders can be delivered correctly. It is not yet possible to register as an organisation. We will update this page as soon as more information becomes available.
To register on the platform, your organisation must complete the Notification Form. The form specifies:
- who within your organisation is the legal contact point within the EU,
- for which specific services and associated data you provide,
- in which languages your organisation can be contacted,
- and which technical route judicial demands are handled.
Timeline of registration for eEvidence
- Web address announced
At the beginning of 2026, the EU and Member States will announce the web address of the registration portal. Companies that are active on 18 March 2026 must register before 18 August 2026. - Create EU login
The company goes to the portal and first creates an EU login. You will most likely need to use eHerkenning (EH4) for this. - Fill in the form
The company fills in the mandatory information in the portal (establishment/representative, contact details, languages, powers and resources). Additional information may be added voluntarily. - Data to the supervisory authority
The portal forwards the application to the supervisory authority of the chosen country. - Check by the supervisory authority
The supervisory authority checks the data, such as the Chamber of Commerce number. - Validation
The supervisory authority indicates in the portal whether the application has been approved. - Confirmation
Upon approval, both the company and the supervisory authority receive confirmation of the registration. - Listing in EU overview
The data is included in the overview of the European Judicial Network and processed in the EU Court Database so that orders can be delivered correctly.
European orders
For some European orders for the delivery of traffic or content data, the authorities in the Member State of the designated establishment or legal representative (enforcement authorities) of the provider receive the order at the same time as the provider. However, they may refuse an order on the following grounds:The requested data is protected by immunities or privileges or is subject to rules on the determination or limitation of criminal liability relating to freedom of the press or freedom of expression that are applied in the Member State where the provider is established.
- The order:
- could lead to a clear violation of the fundamental rights of the person whose data is being requested;
- is contrary to the principle that a person cannot be tried again in criminal proceedings for an offence for which that person has already been finally acquitted or convicted within the EU.
- he act referred to in the order is not a criminal offence in the executing State.
If a provider fails to comply with an order, the enforcement authority may impose a fine under criminal law or proceed with prosecution if the provider remains in default. However, this is a last resort. The supervisory authority for the eEvidence Directive will first impose a fine under administrative law when it receives a complaint about a provider from a Member State and after conducting its own investigation. This fine can amount to up to 2% of the provider’s total global annual turnover.
What does eEvidence look like in practice?
A platform is being developed in Europe, with a connection point in each European Member State for accessing, sending and receiving requests. The platform will be used by both the applicant and the provider.
It is important to note that there will be no European data storage. There will be national connection points for government and service providers.
The legitimacy of competent authorities is guaranteed in the following respects:
- Information is specified per Member State in the IT system and electronic signatures are provided.
- An eEvidence order can only be sent to the provider via the Dutch national connection point.
When will eEvidence come into force?
Within the Netherlands, the Ministry of Justice and Security (J&V) is responsible for implementing eEvidence in national legislation. According to the European Commission, the directive must be transposed into national legislation by 18 February 2026 at the latest.
It is important to note that the regulation will apply within the European Union as of 18 August 2026. From that moment on, Dutch providers of a public electronic communications service or network may also receive direct requests from competent European authorities to share requested data.
What is the role of NBIP?
Through the lawful interception and disclosure service (Tapdienst) – which has been helping NBIP participants receive, check and process requests for more than 25 years – the team has extensive expertise in handling eEvidence requests on behalf of participants. For many organisations, processing claims can be a financial and organisational burden that is not always easy to bear. That is why the lawful interception and disclosure service (Tapdienst) will soon also offer a solution for eEvidence claims by jointly resolving this common issue in the sector.
