Since August 18, 2026, new legal requirements regarding “electronic evidence” apply to online service providers within the European Union: These are governed by a comprehensive legal framework commonly referred to as the EU e-Evidence Package. The package consists of the European e-Evidence Regulation (eER) and the associated e-Evidence Directive (eED), supplemented by national enacting legislation applicable in each EU member state individually, which codifies the respective legal and administrative provisions in that particular member state (for example, in Germany, the e-Evidence Transposition and Implementing Act).
What is new is that ongoing criminal investigations within the EU from now on enable law enforcement authorities from any EU country to establish one-on-one contact with online service providers in any other EU country to request direct cross-border transmittal of electronic evidence, via a standardized electronic procedure. So far, the competent national authorities within the EU member state in which the relevant service provider is located, had always to act as intermediaries in cross-border proceedings on a mandatory basis, through a request for mutual assistance in criminal matters.
Under the e-Evidence Regulation, two principal new legal instruments were established to facilitate and speed up proceedings, i. e.
- The European Production Order Certificate (EPOC), allowing a judicial authority in one EU member state to obtain electronic evidence directly from a service provider in another member state.
- The European Preservation Order Certificate (EPOC-PR), allowing a judicial authority in one EU member state to request a service provider in another member state to preserve specified data pending a future production order so as to prevent relevant data from being deleted or lost.
Falling in scope: EU-wide duty for DENIC to disclose domain holder data to judicial authorities
Addressees of the new e-evidence requirements are, next to DENIC, all online service providers that are offering services in the European Union, including electronic communications services (such as internet access providers, messaging services, video conferencing platforms), information society services (such as operators of online platforms and providers of cloud, housing and hosting services) as well as "internet domain name and IP numbering services". The latter, according to the e-Evidence Regulation, include "IP address assignment, domain name registry, domain name registrar and domain name-related privacy and proxy services".
Hence, as a domain registry operator based and operating in the EU, DENIC is also subject to the obligations laid down in the e-evidence legislative package.
Accordingly, DENIC is now compelled to disclose to judicial authorities in another EU member state, upon specific request, a domain holder’s registration data including their identity, postal address, and contact information. Yet, such data cannot be accessed by the authorities themselves, via automated retrieval mechanisms, but need to be actively transmitted from DENIC’s end.
All communication between authorities and service providers under the e-evidence scheme will be carried out through an interoperable, decentralized IT system referred to as JUDEX (JUstice Digital EXchange System) to which all authorities and service providers in the EU are or will be connected. Established specifically by the European Commission in collaboration with the member states, JUDEX is based on the EU’s e-CODEX (e-Justice Communication via Online Data EXchange) technical infrastructure.
So far, no more but a few EU member states have fully completed implementation of the e-evidence provisions. Besides, there is still a lot of unresolved procedural issues regarding the details.
Providing expertise within European Commission advisory body
As part of its political work, DENIC, together with other European country-code top-level domain (ccTLD) registries and their umbrella organization, CENTR, has been involved in the e-evidence legislative process at the European level right from the start. Besides, since 2023, DENIC has been a member of a technical expert group of the European Commission which advises the Commission on the secure implementation and design of the decentralized JUDEX system. In addition, DENIC collaborates with the relevant authorities in Germany, i. e. the Federal Office of Justice (BfJ) and the National Unit for Coordination in Matters of eJustice, NUCE (EKE), as well as with its cooperative members (domain registrars) in order to comply with the new legislation.
Certain domain holder data already open to the public under existing laws
Quite apart from the new disclosure requirements, under the e-Evidence Regulation, certain domain holder data stored with DENIC was already before and will remain freely accessible online to anyone interested via DENIC’s domain lookup service (whois), in line with the provisions of the NIS2 legislation, i.e. depending on whether holders are individuals or legal entities.
