From 18 August 2026, digital service providers within the European Union will face new obligations regarding electronic evidence in criminal proceedings. The new rules will change the way in which companies respond to requests from judicial authorities concerning the disclosure or preservation of data required for a criminal investigation.

Specifically, service providers in the fields of electronic communications, internet domain names and IP numbering, as well as providers of information services relating to communication, data storage and data processing, will be obliged to respond directly to orders issued by the judicial authorities of EU Member States regarding the disclosure or preservation of electronic evidence.

These obligations apply to the extent that companies in the relevant sectors hold data relevant to criminal investigation; this does not automatically mean that the entities in question are themselves the subject of ongoing proceedings.

To ensure compliance, service providers established within the EU must designate at least one office responsible for receiving and executing such orders, whilst those established outside the EU must appoint at least one legal representative for this purpose. Failure to comply with these obligations may result in financial penalties of up to 2% of total annual global turnover recorded in the previous financial year.

The New European Framework on Electronic Evidence

The European Union has adopted a legislative package designed to facilitate judicial authorities’ access to electronic evidence required in cross-border criminal proceedings. Regulation (EU) 2023/1543 (on European orders for the disclosure and preservation of electronic evidence) establishes the legal framework under which an authority in a Member State may, exclusively in criminal proceedings, issue an order for the disclosure or preservation of electronic evidence directly to a service provider within the EU, regardless of where the data is located.

Specifically, the new European legislative framework allows judicial authorities (judges, courts, investigating judges, prosecutors) to request data or its preservation to prevent its deletion or alteration before the conclusion of the judicial proceedings.

Furthermore, Directive (EU) 2023/1544 (on the designation of establishments and the appointment of legal representatives) introduces the obligation to designate a contact person responsible for receiving and executing orders relating to electronic evidence. Thus, for providers established within the EU, this obligation involves designating one or more a registered office, whilst for those established outside the EU, it involves appointing one or more legal representatives.

Which Providers Are Directly Affected and What Are Their Obligations?

The impact of the new legislation is significant for many economic operators providing digital services within the EU.

As regards the scope of services provided, the legislation does not apply exhaustively, financial services are excluded, but it does cover electronic communications, internet domain names and IP numbering, as well as information services relating to communication, data storage and data processing. An important point to note is that the Regulation does not apply to those providing services exclusively within their own Member State, but rather to providers established in another Member State or legally represented in another Member State.

European judicial authorities will address their requests directly to the designated offices or to the legal representative appointed by the provider, serving them with a European Production Order for Electronic Evidence (EPOC) or a European Preservation Order for Electronic Evidence (EPOC-PR). Upon receipt of an EPOC, the addressee shall act promptly to transmit the requested data within a maximum of 10 days, and in urgent cases, within a maximum of 8 hours. Upon receipt of an EPOC-PR, the addressee shall take the necessary measures to preserve the requested data. The obligation to retain the preserved data ceases after 60 days unless the issuing authority confirms that a subsequent request for disclosure of the data has been issued.

There is a possibility that the execution of orders may encounter difficulties, such as issues relating to immunity, privileges, the protection of freedom of expression, as well as problems concerning the unclear or incorrect completion of certificates by the issuing authorities. In all such cases, the recipient is obliged to inform the issuing authority without delay.

Fines of Up to 2% of Global Turnover

The new legal framework is accompanied by a system of sanctions, namely an enforcement mechanism designed to ensure compliance with the obligations imposed on service providers. The Regulation leaves it to Member States to establish financial penalties that are effective, proportionate and dissuasive, but limited to a maximum of 2% of the service provider’s total annual turnover worldwide in the previous financial year.

To ensure the effectiveness of the penalty mechanism, Member States were required to transpose the Directive by 18 February 2026. This is necessary given that, under the Directive, by 18 August 2026, service providers existing as of 18 February 2026 are required to designate a registered office and to appoint a legal representative responsible for receiving, complying with and executing European orders. For service providers that commence operations after 18 February 2026, the deadline for designation or appointment is six months from the date of commencement of operations. The deadlines set out in the Directive are based on the fact that Regulation (EU) 2023/1543 enters into force on 18 August 2026.

The Implementation Process in Romania

Romania is currently at an advanced stage of implementing the Directive. In this regard, of particular interest is the draft law transposing Directive 2023/1544, adopted by the Government on 4 May 2026 and submitted to Parliament for debate and adoption.

The draft law designates ANCOM as the responsible central authority and sets out the penalty mechanism to be applied by the Romanian state. Thus, amongst other things, it constitutes an administrative offence for a provider to fail to designate at least one person responsible for receiving, complying with and implementing decisions and orders, as well as for designated offices and legal representatives to fail to comply with the obligation to receive, comply with and implement the decisions issued.

The draft law provides for penalty limits ranging from 10,000 to 100,000 lei, and for certain administrative offences (e.g. a service provider’s failure to fulfil the obligation to provide designated premises or legal representatives with the necessary powers and resources to comply with orders to preserve or disclose electronic evidence) the maximum limit is set at no more than 2% of the service provider’s annual global turnover recorded in the previous financial year.

Conclusion

Although the penalty regime and the obligations regarding the designation of a designated office or a legal representative will only become applicable in Romania upon the transposition of Directive (EU) 2023/1544, the obligation to receive, comply with and execute European orders regarding the disclosure and preservation of electronic evidence will enter into force on 18 August 2026, following the direct applicability of Regulation (EU) 2023/1543.

It is therefore advisable for digital service providers not to wait for the completion of the national legislative process on electronic evidence before ensuring that the necessary internal processes are adapted to comply with the new European framework.

Magdalena Roibu, Partner Schoenherr și Asociații SCA
Ștefan Costăchescu, Attorney at Law Schoenherr și Asociații SCA
Nicu Petrușan, Associate Schoenherr și Asociații SCA