The E-Evidence Act: Germany’s implementation of the e-evidence package

Germany’s digital and communications sector is facing new requirements of which many businesses may not yet be aware. The e-evidence package has also applied in Germany since 18 August 2026. As of 20 August 2026, Germany is one of three Member States implementing the EU requirements (see the European Commission’s overview).

Although the Federal Office of Justice (Bundesamt für Justiz) sent informative circulars some time ago to selected service providers that may be affected, those circulars address, among other matters, registration for and technical connection to the system. It should nevertheless be assumed that not every business likely to fall within the scope of the regime will have received such correspondence.

Electronic evidence (“e-evidence”) refers to evidence such as e-mails, IP addresses, chat messages and traffic data used for criminal investigations. The e-evidence package is intended to improve the efficacy of cross-border law enforcement. The aim is to enable law enforcement authorities to obtain electronic evidence more swiftly and directly, rather than having to rely on traditional mutual legal assistance channels. This is achieved through a combination of an EU regulation and an EU directive. The German Act Implementing and Giving Effect to the Electronic Evidence Framework (Elektronische-Beweismittel-Umsetzungs-und-Durchführungsgesetz) now implements those measures in Germany.

Businesses falling within the scope of this Act (“service providers”; see the BfJ’s FAQs for further details) (only available in German) are

- Electronic communications services: These include messaging and e-mail services, video conferencing platforms and internet access services (publicly available electronic communications services). These are services which are generally already regulated under the German Telecommunications Act (Telekommunikationsgesetz). Registration with the Federal Network Agency (Bundesnetzagentur), where this has not yet taken place, may be an indication that the provider offers electronic communications services. However, the classification of the services should be reassessed in the light of the new legislative framework.

- Selected information society services: This category includes services that enable users either (i) to communicate with one another or (ii) to store or otherwise process data on behalf of users, provided that data storage is a defining component of the service provided to the user. This term is very broad and not defined in detail but is likely to apply to many businesses.

- Internet domain name and IP numbering services: Unlike electronic communications services, these are not terms defined by telecommunications law, which makes their interpretation more difficult. The category includes providers of internet infrastructure services relating to the allocation of names and numbers, such as domain name registries and registrars, providers of domain name-related privacy and proxy services, and regional internet registries responsible for IP-address allocation. The Federal Office of Justice’s publications suggest that the regime is directed primarily at major providers that perform functions essential to the operation of the internet, rather than at internal DNS or DHCP providers.

In particular, providers subject to these obligations must register (see the guidance here) (only available in German) and comply with any European production orders or European preservation orders served on them (see the Commission services’ informal guidance on calculation of deadlines). Failure to comply may give rise to administrative fines.