Understanding the EPOC and EPOC-PR request types is essential for operators subject to the EU e-Evidence Regulation. The EU e-Evidence Regulation (Regulation 2023\/1543) represents one of the most significant developments in cross-border digital evidence gathering within the European Union. At its core, the regulation introduces two new orders, the European Production Order and the European Preservation Order, which reach the provider as standardised certificates (EPOC and EPOC-PR) and enable judicial authorities in one EU member state to order data directly from the designated establishment or legal representative of a provider in another Member State, wherever the provider is headquartered. For telecommunications operators and other service providers, understanding the distinction between these two instruments is essential for building compliant response processes.<\/p>\n\n\n\n
Este artigo apresenta uma an\u00e1lise detalhada do EPOC e do EPOC-PR, explicando qual \u00e9 a fun\u00e7\u00e3o de cada instrumento, quem os pode emitir, quais s\u00e3o os requisitos que imp\u00f5em aos prestadores de servi\u00e7os, em que diferem um do outro e como se relacionam com os interce\u00e7\u00e3o legal<\/a> obriga\u00e7\u00f5es.<\/p>\n\n\n\n The EPOC is an order requiring a service provider to produce specific electronic evidence to the issuing authority. It is the more consequential of the two instruments, as it compels the actual disclosure of data. EPOCs can be issued for subscriber data, for data requested for the sole purpose of identifying the user (such as an IP address with source port and timestamp), for traffic data, and for content data. The authorisation requirements depend on the category. In this article, ‘EPOC’ and ‘EPOC-PR’ are used as shorthand for the orders they transmit.<\/p>\n\n\n\n For subscriber data and user-identification data \u2014 which include basic registration information and IP addresses with source port and timestamp \u2014 an EPOC can be issued by a judge, a court, an investigating judge, or a prosecutor (or by another competent investigating authority, subject to validation). For traffic data and content data \u2014 which include communication metadata such as connection logs and the actual content of communications \u2014 an EPOC must be issued or validated by a judge, a court or an investigating judge, reflecting the higher privacy impact of these data categories. For these categories the issuing authority usually notifies the enforcing authority at the same time; outside emergencies, the provider then transmits at the end of the 10-day period unless a ground for refusal is raised.<\/p>\n\n\n\n When a service provider receives an EPOC, it must produce the requested data within ten days, or within eight hours in emergency cases. Any problem with an order (an incomplete form, manifest errors, de facto impossibility, immunities or privileges) is reported on the Annex III form to the issuing authority and, where it was notified, to the enforcing authority of the Member State where the provider’s designated establishment or legal representative is located. Potential conflicts with the law of a third (non-EU) country are raised by the provider through a reasoned objection within 10 days (Article 17). However, the provider cannot simply refuse to comply; the regulation obliges the addressee to execute the order within the deadline unless one of these specific procedures applies.<\/p>\n\n\n\n O EPOC representa um afastamento significativo dos procedimentos tradicionais de Assist\u00eancia Judici\u00e1ria M\u00fatua (MLA), que exigem que os pedidos sejam encaminhados atrav\u00e9s de autoridades centrais e cujo processamento pode demorar meses ou mesmo anos. Ao permitir que as autoridades judiciais dirijam as ordens diretamente aos prestadores de servi\u00e7os, o Regulamento relativo \u00e0s provas eletr\u00f3nicas reduz drasticamente o tempo necess\u00e1rio para obter provas digitais transfronteiri\u00e7as. Para os prestadores de servi\u00e7os, isto significa que devem estar preparados para receber, validar e responder \u00e0s EPOC dentro de prazos apertados.<\/p>\n\n\n\n O EPOC-PR \u00e9 um instrumento menos intrusivo que exige que um prestador de servi\u00e7os preserve provas eletr\u00f3nicas espec\u00edficas enquanto se aguarda um pedido de apresenta\u00e7\u00e3o posterior. Ao contr\u00e1rio do EPOC, o EPOC-PR n\u00e3o exige que o prestador divulgue quaisquer dados \u2014 exige simplesmente que o prestador garanta que os dados especificados n\u00e3o sejam apagados, alterados ou, de qualquer outra forma, tornados indispon\u00edveis. O EPOC-PR funciona como uma medida cautelar que impede a perda de provas enquanto a autoridade emissora prepara uma ordem de apresenta\u00e7\u00e3o ou outro processo legal para obter os dados.<\/p>\n\n\n\n Prosecutors can issue an EPOC-PR for any data category, whereas EPOCs for traffic or content data require a judge, a court or an investigating judge. This broader issuing authority reflects the lower privacy impact of preservation (the data is retained but not disclosed) compared to production (the data is actually disclosed to the requesting authority).<\/p>\n\n\n\n When a service provider receives an EPOC-PR, it must take immediate steps to preserve the specified data. The preservation obligation ends after 60 days. Within that period the issuing authority can extend it once by 30 days if it needs more time to issue a production request. If it confirms (Annex V) that a production request has been issued, the provider must keep preserving the data until it is produced. Without either, the obligation lapses, and the data fall back under the provider’s normal retention rules.<\/p>\n\n\n\n O EPOC-PR \u00e9 particularmente \u00fatil em situa\u00e7\u00f5es em que as provas possam estar em risco de serem eliminadas \u2014 por exemplo, quando um suspeito tem conhecimento de uma investiga\u00e7\u00e3o e pode tentar destruir provas, ou quando os dados est\u00e3o sujeitos a elimina\u00e7\u00e3o autom\u00e1tica ao abrigo das pol\u00edticas de reten\u00e7\u00e3o do prestador de servi\u00e7os. Ao garantir a preserva\u00e7\u00e3o r\u00e1pida dos dados, o EPOC-PR evita a perda de provas, ao mesmo tempo que d\u00e1 tempo para o processo de autoriza\u00e7\u00e3o mais rigoroso exigido para uma ordem de apresenta\u00e7\u00e3o de provas.<\/p>\n\n\n\n As diferen\u00e7as entre o EPOC e o EPOC-PR s\u00e3o fundamentais e abrangem v\u00e1rias dimens\u00f5es. A finalidade constitui a distin\u00e7\u00e3o mais b\u00e1sica: um EPOC obriga \u00e0 produ\u00e7\u00e3o (divulga\u00e7\u00e3o) de dados, enquanto um EPOC-PR obriga apenas \u00e0 preserva\u00e7\u00e3o (reten\u00e7\u00e3o) de dados. O impacto na privacidade de um EPOC \u00e9 significativamente maior do que o de um EPOC-PR, o que se reflete nos diferentes requisitos de autoriza\u00e7\u00e3o e nas garantias processuais.<\/p>\n\n\n\n Issuing authority requirements differ between the two instruments. EPOCs for traffic and content data must be issued or validated by a judge, a court or an investigating judge, while EPOC-PRs can be issued by prosecutors without judicial validation. This difference reflects the proportionality principle \u2014 the more invasive the measure, the higher the level of judicial oversight required.<\/p>\n\n\n\n Response timescales also differ. EPOCs require production within ten days (or eight hours in emergencies), while EPOC-PRs require immediate preservation with the obligation lasting 60 days (extendable by a further 30 days, and until the data is produced once the authority confirms that a production request has been issued). The EPOC-PR is designed to be a rapid, temporary measure, while the EPOC is a definitive order requiring substantive compliance.<\/p>\n\n\n\n The grounds for refusal differ between the two instruments. For EPOCs that require notification, the enforcing authority can refuse on limited grounds (immunities and privileges, a manifest breach of fundamental rights, ne bis in idem, dual criminality). The provider itself can flag immunities or privileges on the Annex III form, file a reasoned objection on third-country law, and object to enforcement only on the grounds in Article 16(4), points (a) to (f). For EPOC-PRs there is no notification and no ground for refusal by the enforcing authority, and no third-country objection procedure. The provider can report problems on the Annex III form and, if enforcement is sought, object on the grounds in Article 16(5).<\/p>\n\n\n\n As operadoras de telecomunica\u00e7\u00f5es est\u00e3o entre os destinat\u00e1rios mais prov\u00e1veis tanto de EPOCs como de EPOC-PRs, dado o volume de dados de assinantes, de tr\u00e1fego e de conte\u00fados que det\u00eam. As operadoras devem criar processos e sistemas para lidar com ambos os tipos de ordens, incluindo a capacidade de receber e validar as ordens recebidas, identificar os dados relevantes nos seus sistemas, preservar os dados em resposta \u00e0s EPOC-PR, fornecer os dados em resposta \u00e0s EPOC, acompanhar o estado e os prazos de cada ordem e manter documenta\u00e7\u00e3o e registos de auditoria para conformidade regulamentar<\/a>.<\/p>\n\n\n\n O prazo de resposta de dez dias para os EPOC (e de oito horas para emerg\u00eancias) \u00e9 particularmente exigente. Os operadores devem dispor de processos que permitam a r\u00e1pida identifica\u00e7\u00e3o e extra\u00e7\u00e3o dos dados solicitados, a revis\u00e3o por pessoal jur\u00eddico e de conformidade qualificado e a entrega segura \u00e0 autoridade requerente. Os processos manuais que dependem da a\u00e7\u00e3o individual podem n\u00e3o ser suficientes para cumprir estes prazos de forma consistente, pelo que as operadoras devem considerar investir em sistemas automatizados ou semiautomatizados para o tratamento de pedidos de provas eletr\u00f3nicas.<\/p>\n\n\n\n \u00c9 importante distinguir as ordens de provas eletr\u00f3nicas da interce\u00e7\u00e3o legal. A interce\u00e7\u00e3o legal envolve a captura e a transmiss\u00e3o em tempo real das comunica\u00e7\u00f5es \u00e0 medida que estas ocorrem. As ordens de obten\u00e7\u00e3o de provas eletr\u00f3nicas, por outro lado, dizem respeito a dados armazenados \u2014 dados que j\u00e1 foram gerados e que se encontram na posse do prestador de servi\u00e7os. Uma autoridade de prote\u00e7\u00e3o de dados (EPOC) pode solicitar dados hist\u00f3ricos de tr\u00e1fego, registos de assinantes ou conte\u00fados armazenados, mas n\u00e3o autoriza a interce\u00e7\u00e3o em tempo real.<\/p>\n\n\n\n No entanto, os dois quadros s\u00e3o complementares. As autoridades respons\u00e1veis pela aplica\u00e7\u00e3o da lei podem recorrer a mandados de obten\u00e7\u00e3o de provas eletr\u00f3nicas para obter dados hist\u00f3ricos sobre os padr\u00f5es de comunica\u00e7\u00e3o de um alvo e, posteriormente, recorrer \u00e0 interce\u00e7\u00e3o legal para monitorizar as comunica\u00e7\u00f5es em curso desse alvo. Os operadores devem estar aptos a dar resposta a ambos os quadros, dispondo de sistemas e processos adequados para cada um deles. O reten\u00e7\u00e3o de dados<\/a> As pol\u00edticas do operador tamb\u00e9m s\u00e3o relevantes, uma vez que a disponibilidade de dados hist\u00f3ricos depende do per\u00edodo durante o qual o operador conserva as diferentes categorias de dados.<\/p>\n\n\n\n Os operadores devem come\u00e7ar a preparar-se para Conformidade em mat\u00e9ria de provas eletr\u00f3nicas<\/a> by designating a designated establishment (if established in the EU) or appointing a representante legal<\/a> in a Member State where they offer services (if not) to receive and handle e-Evidence orders. This was due by 18 August 2026. They should map which data they actually hold and for how long under existing law and business need, so they can find it quickly. The e-Evidence Regulation does not require them to keep data longer than they already do. They should also develop internal procedures for receiving, validating, and responding to both EPOCs and EPOC-PRs, train relevant staff on the requirements and timescales, and implement technical systems to support the rapid identification, preservation, and extraction of requested data.<\/p>\n\n\n\n The EPOC and EPOC-PR are the two pillars of the EU e-Evidence framework, each serving a distinct purpose in the cross-border evidence-gathering process. The EPOC compels the production of specified data, while the EPOC-PR requires its preservation. Together, they provide law enforcement with a faster, more direct mechanism for obtaining digital evidence across EU borders, complementing the slower EIO and MLA channels, which remain available. For telecommunications operators, compliance with both instruments requires investment in processes, systems, and trained personnel \u2014 but providers that set this up properly gain smoother compliance, reduced regulatory risk, and a constructive relationship with the law enforcement authorities that rely on operator cooperation.<\/p>\n\n\n The e-Evidence Regulation also introduces requirements for the establishment of a decentralised IT system to facilitate the transmission of e-Evidence orders between member states and service providers. Since 18 August 2026, orders and responses must go through the EU’s decentralised IT system (built on e-CODEX), where the Member State concerned has connected it. Providers access it through their Member State’s national system, either through the web-based interface or an API based on ETSI TS 104 144. Where the national components are not yet live, orders arrive by secure alternative means, and providers must handle both. The IT system provides a secure, standardised channel for the exchange of orders and responses, and aligning internal processes with its technical requirements avoids compliance challenges as more Member States connect.<\/p>\n\n\n\n Now that the EU e-Evidence Regulation applies, the volume of EPOC and EPOC-PR requests will increase significantly. Operators must ensure their processes can handle EPOC and EPOC-PR requests within the mandated timelines.<\/p>\n\n\n\n Para mais informa\u00e7\u00f5es sobre temas relacionados, consulte estes artigos:<\/p>\n\n\n\n Os seguintes recursos externos fornecem contexto adicional e documenta\u00e7\u00e3o oficial:<\/p>\n\n\n\nUnderstanding EPOC and EPOC-PR<\/h2>\n\n\n\n
The European Preservation Order (EPOC-PR)<\/h2>\n\n\n\n
Principais diferen\u00e7as entre o EPOC e o EPOC-PR<\/h2>\n\n\n\n
Implica\u00e7\u00f5es para as operadoras de telecomunica\u00e7\u00f5es<\/h2>\n\n\n\n
Rela\u00e7\u00e3o com a interce\u00e7\u00e3o legal<\/h2>\n\n\n\n
Prepara\u00e7\u00e3o para a conformidade em mat\u00e9ria de provas eletr\u00f3nicas<\/h2>\n\n\n\n
Conclus\u00e3o<\/h2>\n\n\n\n
Artigos relacionados<\/h2>\n\n\n\n
Recursos externos<\/h2>\n\n\n\n