Understanding the EPOC and EPOC-PR request types is essential for operators subject to the EU e-Evidence Regulation. The EU e-Evidence Regulation (Regulation 2023\/1543) represents one of the most significant developments in cross-border digital evidence gathering within the European Union. At its core, the regulation introduces two new orders, the European Production Order and the European Preservation Order, which reach the provider as standardised certificates (EPOC and EPOC-PR) and enable judicial authorities in one EU member state to order data directly from the designated establishment or legal representative of a provider in another Member State, wherever the provider is headquartered. For telecommunications operators and other service providers, understanding the distinction between these two instruments is essential for building compliant response processes.<\/p>\n\n\n\n
Este art\u00edculo ofrece un an\u00e1lisis detallado del EPOC y el EPOC-PR, explicando cu\u00e1l es la funci\u00f3n de cada instrumento, qui\u00e9n puede emitirlos, qu\u00e9 requisitos exigen a los prestadores de servicios, en qu\u00e9 se diferencian entre s\u00ed y c\u00f3mo se relacionan con los ya existentes interceptaci\u00f3n legal<\/a> obligaciones.<\/p>\n\n\n\n The EPOC is an order requiring a service provider to produce specific electronic evidence to the issuing authority. It is the more consequential of the two instruments, as it compels the actual disclosure of data. EPOCs can be issued for subscriber data, for data requested for the sole purpose of identifying the user (such as an IP address with source port and timestamp), for traffic data, and for content data. The authorisation requirements depend on the category. In this article, ‘EPOC’ and ‘EPOC-PR’ are used as shorthand for the orders they transmit.<\/p>\n\n\n\n For subscriber data and user-identification data \u2014 which include basic registration information and IP addresses with source port and timestamp \u2014 an EPOC can be issued by a judge, a court, an investigating judge, or a prosecutor (or by another competent investigating authority, subject to validation). For traffic data and content data \u2014 which include communication metadata such as connection logs and the actual content of communications \u2014 an EPOC must be issued or validated by a judge, a court or an investigating judge, reflecting the higher privacy impact of these data categories. For these categories the issuing authority usually notifies the enforcing authority at the same time; outside emergencies, the provider then transmits at the end of the 10-day period unless a ground for refusal is raised.<\/p>\n\n\n\n When a service provider receives an EPOC, it must produce the requested data within ten days, or within eight hours in emergency cases. Any problem with an order (an incomplete form, manifest errors, de facto impossibility, immunities or privileges) is reported on the Annex III form to the issuing authority and, where it was notified, to the enforcing authority of the Member State where the provider’s designated establishment or legal representative is located. Potential conflicts with the law of a third (non-EU) country are raised by the provider through a reasoned objection within 10 days (Article 17). However, the provider cannot simply refuse to comply; the regulation obliges the addressee to execute the order within the deadline unless one of these specific procedures applies.<\/p>\n\n\n\n El EPOC supone un cambio significativo con respecto a los procedimientos tradicionales de asistencia judicial rec\u00edproca (MLA), que exigen que las solicitudes se tramiten a trav\u00e9s de las autoridades centrales y cuya tramitaci\u00f3n puede llevar meses o incluso a\u00f1os. Al permitir que las autoridades judiciales dirijan las \u00f3rdenes directamente a los proveedores de servicios, el Reglamento sobre pruebas electr\u00f3nicas reduce dr\u00e1sticamente el tiempo necesario para obtener pruebas digitales transfronterizas. Para los proveedores de servicios, esto significa que deben estar preparados para recibir, validar y responder a las EPOC en plazos muy ajustados.<\/p>\n\n\n\n La EPOC-PR es un instrumento menos intrusivo que exige al proveedor de servicios que conserve determinadas pruebas electr\u00f3nicas a la espera de una solicitud posterior de entrega. A diferencia de la EPOC, la EPOC-PR no exige al proveedor que revele ning\u00fan dato, sino que simplemente le obliga a garantizar que los datos especificados no se borren, se alteren ni dejen de estar disponibles de ning\u00fan otro modo. El EPOC-PR sirve como medida cautelar que evita la p\u00e9rdida de pruebas mientras la autoridad emisora prepara una orden de entrega u otro procedimiento judicial para obtener los datos.<\/p>\n\n\n\n Prosecutors can issue an EPOC-PR for any data category, whereas EPOCs for traffic or content data require a judge, a court or an investigating judge. This broader issuing authority reflects the lower privacy impact of preservation (the data is retained but not disclosed) compared to production (the data is actually disclosed to the requesting authority).<\/p>\n\n\n\n When a service provider receives an EPOC-PR, it must take immediate steps to preserve the specified data. The preservation obligation ends after 60 days. Within that period the issuing authority can extend it once by 30 days if it needs more time to issue a production request. If it confirms (Annex V) that a production request has been issued, the provider must keep preserving the data until it is produced. Without either, the obligation lapses, and the data fall back under the provider’s normal retention rules.<\/p>\n\n\n\n La orden EPOC-PR resulta especialmente \u00fatil en situaciones en las que las pruebas corren el riesgo de ser eliminadas; por ejemplo, cuando un sospechoso tiene conocimiento de una investigaci\u00f3n y podr\u00eda intentar destruir pruebas, o cuando los datos est\u00e1n sujetos a eliminaci\u00f3n autom\u00e1tica en virtud de las pol\u00edticas de conservaci\u00f3n del proveedor de servicios. Al garantizar la conservaci\u00f3n de los datos con rapidez, el EPOC-PR evita la p\u00e9rdida de pruebas y, al mismo tiempo, da tiempo para llevar a cabo el proceso de autorizaci\u00f3n m\u00e1s riguroso que requiere una orden de entrega de pruebas.<\/p>\n\n\n\n Las diferencias entre el EPOC y el EPOC-PR son fundamentales y abarcan varias dimensiones. La distinci\u00f3n m\u00e1s b\u00e1sica radica en la finalidad: un EPOC obliga a la producci\u00f3n (divulgaci\u00f3n) de datos, mientras que un EPOC-PR solo obliga a la conservaci\u00f3n (retenci\u00f3n) de datos. El impacto sobre la privacidad de un EPOC es significativamente mayor que el de un EPOC-PR, lo que se refleja en los diferentes requisitos de autorizaci\u00f3n y garant\u00edas procesales.<\/p>\n\n\n\n Issuing authority requirements differ between the two instruments. EPOCs for traffic and content data must be issued or validated by a judge, a court or an investigating judge, while EPOC-PRs can be issued by prosecutors without judicial validation. This difference reflects the proportionality principle \u2014 the more invasive the measure, the higher the level of judicial oversight required.<\/p>\n\n\n\n Response timescales also differ. EPOCs require production within ten days (or eight hours in emergencies), while EPOC-PRs require immediate preservation with the obligation lasting 60 days (extendable by a further 30 days, and until the data is produced once the authority confirms that a production request has been issued). The EPOC-PR is designed to be a rapid, temporary measure, while the EPOC is a definitive order requiring substantive compliance.<\/p>\n\n\n\n The grounds for refusal differ between the two instruments. For EPOCs that require notification, the enforcing authority can refuse on limited grounds (immunities and privileges, a manifest breach of fundamental rights, ne bis in idem, dual criminality). The provider itself can flag immunities or privileges on the Annex III form, file a reasoned objection on third-country law, and object to enforcement only on the grounds in Article 16(4), points (a) to (f). For EPOC-PRs there is no notification and no ground for refusal by the enforcing authority, and no third-country objection procedure. The provider can report problems on the Annex III form and, if enforcement is sought, object on the grounds in Article 16(5).<\/p>\n\n\n\n Los operadores de telecomunicaciones se encuentran entre los destinatarios m\u00e1s probables tanto de las EPOC como de las EPOC-PR, dado el volumen de datos de abonados, de tr\u00e1fico y de contenidos que poseen. Los operadores deben establecer procesos y sistemas para gestionar ambos tipos de \u00f3rdenes, lo que incluye la capacidad de recibir y validar las \u00f3rdenes entrantes, identificar los datos pertinentes en sus sistemas, conservar los datos en respuesta a las EPOC-PR, facilitar los datos en respuesta a las EPOC, realizar un seguimiento del estado y los plazos de cada orden, y mantener la documentaci\u00f3n y los registros de auditor\u00eda para cumplimiento de la normativa<\/a>.<\/p>\n\n\n\n El plazo de respuesta de diez d\u00edas para los EPOC (y de ocho horas para las emergencias) resulta especialmente exigente. Los operadores deben contar con procesos que permitan la r\u00e1pida identificaci\u00f3n y extracci\u00f3n de los datos solicitados, su revisi\u00f3n por parte de personal jur\u00eddico y de cumplimiento cualificado, y su entrega segura a la autoridad solicitante. Los procesos manuales que dependen de la intervenci\u00f3n individual pueden no ser suficientes para cumplir estos plazos de forma sistem\u00e1tica, por lo que los operadores deber\u00edan plantearse invertir en sistemas automatizados o semiautomatizados para gestionar las solicitudes de pruebas electr\u00f3nicas.<\/p>\n\n\n\n Es importante distinguir las \u00f3rdenes de pruebas electr\u00f3nicas de la interceptaci\u00f3n legal. La interceptaci\u00f3n legal consiste en la captura y entrega en tiempo real de las comunicaciones a medida que se producen. Las \u00f3rdenes de pruebas electr\u00f3nicas, por el contrario, se refieren a datos almacenados, es decir, datos que ya se han generado y que el proveedor de servicios conserva. Una EPOC puede solicitar datos hist\u00f3ricos de tr\u00e1fico, registros de abonados o contenidos almacenados, pero no autoriza la interceptaci\u00f3n en tiempo real.<\/p>\n\n\n\n Sin embargo, ambos marcos son complementarios. Las fuerzas del orden pueden recurrir a \u00f3rdenes de obtenci\u00f3n de pruebas electr\u00f3nicas para recabar datos hist\u00f3ricos sobre los patrones de comunicaci\u00f3n de una persona objeto de investigaci\u00f3n y, a continuaci\u00f3n, utilizar la interceptaci\u00f3n legal para supervisar las comunicaciones actuales de dicha persona. Los operadores deben ser capaces de dar soporte a ambos marcos, con los sistemas y procesos adecuados para cada uno de ellos. El conservaci\u00f3n de datos<\/a> Las pol\u00edticas del operador tambi\u00e9n son relevantes, ya que la disponibilidad de los datos hist\u00f3ricos depende del tiempo que el operador conserve las diferentes categor\u00edas de datos.<\/p>\n\n\n\n Los operadores deber\u00edan empezar a prepararse para Cumplimiento normativo en materia de pruebas electr\u00f3nicas<\/a> by designating a designated establishment (if established in the EU) or appointing a representante legal<\/a> in a Member State where they offer services (if not) to receive and handle e-Evidence orders. This was due by 18 August 2026. They should map which data they actually hold and for how long under existing law and business need, so they can find it quickly. The e-Evidence Regulation does not require them to keep data longer than they already do. They should also develop internal procedures for receiving, validating, and responding to both EPOCs and EPOC-PRs, train relevant staff on the requirements and timescales, and implement technical systems to support the rapid identification, preservation, and extraction of requested data.<\/p>\n\n\n\n The EPOC and EPOC-PR are the two pillars of the EU e-Evidence framework, each serving a distinct purpose in the cross-border evidence-gathering process. The EPOC compels the production of specified data, while the EPOC-PR requires its preservation. Together, they provide law enforcement with a faster, more direct mechanism for obtaining digital evidence across EU borders, complementing the slower EIO and MLA channels, which remain available. For telecommunications operators, compliance with both instruments requires investment in processes, systems, and trained personnel \u2014 but providers that set this up properly gain smoother compliance, reduced regulatory risk, and a constructive relationship with the law enforcement authorities that rely on operator cooperation.<\/p>\n\n\n The e-Evidence Regulation also introduces requirements for the establishment of a decentralised IT system to facilitate the transmission of e-Evidence orders between member states and service providers. Since 18 August 2026, orders and responses must go through the EU’s decentralised IT system (built on e-CODEX), where the Member State concerned has connected it. Providers access it through their Member State’s national system, either through the web-based interface or an API based on ETSI TS 104 144. Where the national components are not yet live, orders arrive by secure alternative means, and providers must handle both. The IT system provides a secure, standardised channel for the exchange of orders and responses, and aligning internal processes with its technical requirements avoids compliance challenges as more Member States connect.<\/p>\n\n\n\n Now that the EU e-Evidence Regulation applies, the volume of EPOC and EPOC-PR requests will increase significantly. Operators must ensure their processes can handle EPOC and EPOC-PR requests within the mandated timelines.<\/p>\n\n\n\n Si desea leer m\u00e1s sobre temas relacionados, consulte estos art\u00edculos:<\/p>\n\n\n\n Los siguientes recursos externos proporcionan contexto adicional y documentaci\u00f3n oficial:<\/p>\n\n\n\nUnderstanding EPOC and EPOC-PR<\/h2>\n\n\n\n
The European Preservation Order (EPOC-PR)<\/h2>\n\n\n\n
Diferencias clave entre EPOC y EPOC-PR<\/h2>\n\n\n\n
Repercusiones para los operadores de telecomunicaciones<\/h2>\n\n\n\n
Relaci\u00f3n con la interceptaci\u00f3n legal<\/h2>\n\n\n\n
Preparaci\u00f3n para el cumplimiento de la normativa sobre pruebas electr\u00f3nicas<\/h2>\n\n\n\n
Conclusi\u00f3n<\/h2>\n\n\n\n
Art\u00edculos relacionados<\/h2>\n\n\n\n
Recursos externos<\/h2>\n\n\n\n