European Production and Preservation Orders for cloud data: categories, deadlines, notice and remedies in Austria.
Mag. Christopher Angerer, Rechtsanwalt
Your lawyer for criminal defence
Criminal proceedings are a matter of trust. One lawyer who walks with you from the first consultation through to the trial, everything from one hand.
Since 18 August 2026, Regulation (EU) 2023/1543 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings applies. It creates a specific route through which a competent authority can directly require a service provider in another Member State to produce or preserve stored data.
For a suspect or accused person connected with Austria, the data category, the identified user or account, the reasons for the measure and the information about remedies are decisive. This article explains the main points and distinguishes the procedure from seizure of a phone, interception of communications and conventional mutual legal assistance.
The next step depends on whether data are to be produced, preserved before deletion or used only to identify a user.
Would you like to discuss your situation? Go straight to the enquiry form.
First identify the order and the type of data concerned.
Read the certificate in full. Subscriber data and data requested solely to identify a user are subject to different conditions from traffic or content data. For the latter categories, Article 5(4) of the Regulation requires additional conditions.
Preserve the certificate, the affected account, the relevant period and the information about remedies. Direct production by a cloud provider does not remove the need to examine legality.
A European Preservation Order initially requires existing data to be kept available. Preservation must begin without undue delay and generally ends after 60 days unless the issuing authority confirms a subsequent production order. An additional 30 days may be available under Article 11.
Check whether production has already been ordered or whether the first step is only to prevent deletion. The two steps have different legal effects.
IP addresses and, where needed, source ports and timestamps may be requested solely to identify a user. In that situation they fall under the specific regime for subscriber data. If the request seeks information for a contact or location profile, it may concern traffic data instead.
The purpose stated in the order is therefore important. Read the wording about user identification and the period covered with care.
Article 13 generally requires the issuing authority to inform the person whose data are requested without undue delay about the production and available remedies. Under the national law of the issuing State, information may be delayed, restricted or omitted under the conditions in Article 13(2).
Article 18 provides an effective remedy before a court in the issuing State. The specific time limit and form follow the law of that State and must be established quickly.
The Regulation distinguishes subscriber data, data requested solely to identify a user, traffic data and content data. Subscriber data include a name, address, email address, telephone number and information about a service subscription. An IP address, source port and timestamp may be requested for the sole purpose of identifying a user.
Traffic data provide additional context about the use of a service. They can include the source and destination of a message, the location of a device, time, duration, size or other communications metadata. Content data include digital text, voice, video, images and sound.
The classification has direct consequences. Under Article 5(3), a production order for subscriber data or data requested solely for user identification may be issued for all criminal offences. Under Article 5(4), traffic and content data generally require an offence punishable in the issuing State by a maximum custodial sentence of at least three years, or one of the special offence groups listed there. Article 5(2) also requires necessity and proportionality.
Under Article 7, the order is addressed directly to a designated establishment or legal representative of the service provider within the Regulation. The physical location of individual servers therefore does not alone determine jurisdiction. The order concerns stored data held by or processed for the controller when the certificate is received.
Article 5(6) generally requires the production order to be addressed to the provider acting as controller under the General Data Protection Regulation. A processor may exceptionally be addressed directly if the controller cannot be identified despite reasonable efforts or if addressing the controller might harm the investigation.
There are additional limits for data held for a public authority in infrastructure provided by a service provider. Under Article 5(8), a production order may be issued only if that public authority is located in the issuing State.
The content of the order determines the threshold, authority and available review.
| Data type | Examples | Key question |
|---|---|---|
| Subscriber data | Name, email, address, service data | Is the person or account identified precisely? |
| User identification | IP address, source port, timestamp | Is identification the sole purpose? |
| Traffic data | Contacts, location, time, metadata | Are the higher Article 5(4) conditions met? |
| Content data | Text, voice, images, video, sound | Are purpose, necessity and proportionality explained? |
A European Preservation Order prevents stored data from being removed, deleted or altered while a later production route is prepared. It can lead to production through mutual legal assistance, a European Investigation Order or a European Production Order. It can be issued for all criminal offences where a comparable domestic measure would be available.
Under Article 11, the addressee must preserve the requested data without undue delay. The obligation ends after 60 days unless the issuing authority confirms that a subsequent production order has been issued. Within that period, the authority may extend preservation by another 30 days where necessary for the subsequent production request.
For a production order, the provider must generally begin preserving the data without undue delay. Where no notification to an enforcing authority is required, the data must be transmitted at the latest within ten days after receipt of the certificate. In an emergency the maximum period is eight hours. A required notification can suspend the ordinary transmission obligation until the ten-day period ends.
The certificate, data category and remedy must be reviewed together.
Save the EPOC or EPOC-PR, delivery details and account information.
Separate subscriber, identification, traffic and content data.
Check offence, period, purpose, necessity and proportionality.
Establish delay, confidentiality and references to remedies.
Identify issuing State, court and national deadline.
Article 13 generally requires the issuing authority to inform the person whose data are requested without undue delay about the production. The notice must also include information about available remedies. Under the national law of the issuing State, the authority may delay, restrict or omit the information if the conditions in Article 13(2) are fulfilled. The reasons must be recorded in the file and briefly justified in the certificate.
Article 18 gives any person whose data were requested through a European Production Order an effective remedy. A suspect or accused person may exercise that remedy during the criminal proceedings in which the data are used. The remedy is brought before a court in the issuing State under its national law and may challenge the legality, necessity and proportionality of the measure.
Timing is important for the defence. Preserve the notice, certificate, time of knowledge and all details about the issuing State. The Regulation does not set one identical national deadline for every case. The competent legal system must therefore be identified promptly.
If the enforcing authority is notified under Article 8, Article 12 allows it to raise grounds including protected immunities or privileges, an obvious breach of a relevant fundamental right in exceptional cases, ne bis in idem or lack of dual criminality. The dual-criminality ground has exceptions for specified offence groups where the required penalty threshold in the issuing State is met.
Before refusing, the enforcing authority should discuss appropriate measures with the issuing authority. It may object to the full transfer or set conditions for transfer or use. This is why the certificate must identify the data category, offence and affected person precisely.
Under Article 17, a service provider may also raise a conflict between production and an obligation under applicable third-country law. The fact that data are stored in a third country is not enough by itself. The objection must identify the relevant law, its application to the case and the prohibition on disclosure. If the issuing authority maintains the order, the competent court in the issuing State decides the conflict.
A cloud evidence order does not authorise every form of data collection. The Regulation requires a fitting data category, a specific user designation and a reasoned assessment of necessity and proportionality.
The Regulation covers subscriber data, data requested solely to identify a user, traffic data and content data, where they are stored by the service provider. Traffic and content data generally require higher conditions than subscriber data and sole user identification data.
Under Article 11, preservation generally ends after 60 days. Within that period, the issuing authority may extend it by another 30 days or confirm that a subsequent production order has been issued.
Article 18 provides an effective remedy before a court in the issuing State. The national deadline and procedure follow the law of that State. The notice under Article 13 must refer to available remedies.
No. The Regulation concerns stored electronic evidence held by service providers in cross-border cases. Seizure of a device in Austria, forensic examination of a phone and interception of communications follow other rules.
Evidence, service and the limits of conventional mutual legal assistance.
Seizure, analysis and remedies concerning data already on a device.
Austrian rules for objects, devices and data carriers.
Why the file matters when an evidence measure is reviewed.
In criminal matters every hour counts. Call us directly or send an email, callback within one business day, earlier in urgent cases.
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg
Phone
+43 660 2407152