E-Evidence: Based in the EU? Why You Get a Designated Establishment, Not a Legal Representative
This time in our plain English series on the EU e-evidence framework: What EU-based service providers must do and why appointing an “addressee” is not the same as having legal support.
A question we hear a lot: “We have an EU entity – can we just appoint a legal representative for e-evidence?” Short answer is – no. The e-Evidence Directive gives you one route or the other, depending on where you’re established. If you’re established in the EU, your route is the designated establishment.
Designated Establishment vs. Legal Representative
Both, designated establishment an legal respresentative play exactly the same role: they are your addressee – the official recipient of European Production Orders (EPOCs) and European Preservation Orders (EPOC-PRs), responsible for receiving them, complying with them, and meeting the deadlines. The difference is purely about who can hold the role:
- Established in the EU? You must designate one of your own EU establishments – a subsidiary, branch, or office – as the addressee. This is the designated establishment.
- Not established in the EU but offering services there? You must appoint an external natural or legal person in a Member State as your legal representative (covered in Part 1 of this series – link to Part 1).
So the legal representative is the substitute for an EU presence and not an optional alternative to it.
How to Designate an Establishment
Designation is a formal act: you nominate the establishment, equip it with the powers and resources to handle orders, and notify the central authority of the Member State where it sits. The Directive requires at least one addressee – meaning you can designate several, for example one per region or per business line, as long as each is properly notified and resourced.
Where you have a choice, pick based on practical criteria:
It must be in a Member State where you offer services and which applies the relevant legal instruments;
You may also wish to have regard to other aspects, such as the transposition progress and stage of the e-Evidence Directive as well as the readiness of the national IT infrastructure. At the time of writine, only a small number of EU Member States have both transposed the Directive and are ready for the validation of the Service Provider Notifications.
Operational fit shoud also be considered, such as proximity to your data, compliance and security teams, language capabilities, and the ability to react within 10-day or 8-hour deadlines.
Remember: the service provider and the addressee are jointly and severally liable for non-compliance. Whichever entity you designate, it must genuinely be able to do the job and ensure comliance within the deadlines.
A Designated Establishment Is Not Legal Support
Here’s the misunderstanding that causes real trouble: designating an establishment or appointing a legal representative, as the case may be, in itself does not provide guarantee of compliance or legal support. Designating an establishment merely solves the question of “who receives the order”. However, it does nothing to solve the question of what is to be doen aften an order is received. When an EPOC lands, someone has to assess it within days or hours: Is it complete? Is the data category right? Are privileges or immunities affected? Is there a conflict with third-country law? Should we execute, seek clarification, or object?
That is legal work – and nothing stops you from bringing in external specialists for it, even though your addressee is your own EU entity. The Directive regulates the mailbox, not the expertise behind it.
How We Can Support You
We support the service providers that are in scope of the e-evidence framework from initial assessment as to which services fall within the framework to legal support in executing the orders and sending back the responses be it with the data or asking for clarification.
There are two ways how we are able to provide the ongoing compliance support in respect to e-evidence:
Advisory Support As An External Counsel
You forward incoming EPOCs and EPOC-PRs to us; we review each order, advise on the correct response, be it execution, clarification request, or invoking grounds like privileges and immunities, and accompany you through every step until the order is closed. We are able to flexibly agree the desired workflows and escalatoin paths to ensure agile reaction, especially in cases of emergency orders.
Our Legal Services Through EviGate Platform
For the most effective setup and automated escalation paths, handle your orders through EviGate platform, which provides structured workflows for every order type, automatic deadline tracking, and the right forms at the right step.
If you are using EviGate platform, you are able to get our e-evidence legal support though the platform. Then we can see each order received by you, the progress of dealing with the request, we can step in with support exactly when and where you need it – no email chains, no lost deadlines. Even better, in emergency cases we are able to liaise directly with your technical teams letting your legal or compliance departments to enjoy their night sleep or weekend.
Get in touch to discuss how we could best support you in your e-evidence compliance and what set up would work best for you.
Frequently Asked Questions On Designated Establishment
Any of them can be, provided it’s in a country where you offer services. Choose the one best placed operationally – and, right now, favour countries where notification systems are already up and running. You can also designate more than one.
The addressee remains legally responsible and must hold the necessary powers and resources – that can’t be outsourced. But the handling of orders can absolutely be supported by external counsel or a platform for the assessment and processing of orders.
Only if you genuinely equip it: mandate, escalation paths, access to data teams, and the ability to act within the deadlines. A nameplate entity may exposes you to joint liability without protection. It is important that you have sound internal policies and confirmed escalation paths, ideally, having run one or more test runs within the forseen deadlines.
