EU e-Evidence rules force DENIC to share domain data

The European Union’s e-Evidence framework has introduced direct cross-border data requests for online service providers, including domain registries like DENIC. Under the new rules, judicial authorities in any EU member state can now issue production or preservation orders to providers in another member state without intermediaries, streamlining access to electronic evidence in criminal investigations.

How the system works

The e-Evidence Regulation, which took effect in August 2026, establishes two primary legal instruments: the European Production Order Certificate (EPOC) and the European Preservation Order Certificate (EPOC-PR). EPOC allows authorities to obtain electronic evidence directly from service providers, while EPOC-PR enables them to request data preservation pending a future production order. These requests are transmitted through JUDEX, a decentralized IT system built on the EU’s e-CODEX infrastructure, designed to facilitate secure communication between authorities and providers.

DENIC, as the registry operator for .de domains, is now obligated to disclose domain holder registration data—including identity, postal address, and contact information—upon request from judicial authorities in other EU countries. Unlike automated WHOIS lookups, this process requires active transmission of data by DENIC. The system applies to a broad range of online service providers, including internet access providers, cloud hosting services, and domain registrars, all of which must comply with cross-border data requests.

Implementation challenges

While the regulation is now in force, full implementation across the EU remains uneven. Only a few member states have completed the necessary national legislation, and procedural details—such as timelines for compliance and data protection safeguards—are still being resolved. DENIC has been involved in the legislative process since its early stages, contributing technical expertise to the European Commission’s advisory group on JUDEX. The organization is also coordinating with German authorities, including the Federal Office of Justice (BfJ) and the National Unit for Coordination in Matters of eJustice (NUCE), to ensure compliance.

The new rules do not affect public access to certain domain holder data. Under existing NIS2 legislation, DENIC’s WHOIS service continues to provide limited registration details, with distinctions between individual and legal entity holders.

Impact on providers and registrants

For domain registries and other online service providers, the e-Evidence framework introduces operational and compliance burdens. Providers must now process direct requests from foreign judicial authorities, which may require adjustments to internal procedures and IT systems. The decentralized nature of JUDEX aims to standardize these interactions, but its effectiveness depends on widespread adoption and technical readiness across the EU.

Registrants, particularly those using privacy or proxy services, may see increased exposure of their data in criminal investigations. While the regulation targets law enforcement, its implementation could influence broader debates about data privacy and cross-border legal cooperation in the EU.

What to watch

The rollout of the e-Evidence framework will likely face further legal and technical hurdles. Observers should monitor how member states finalize their national implementing laws and whether disputes arise over data sovereignty or procedural fairness. DENIC’s role in advising the European Commission on JUDEX could also shape the system’s long-term functionality.