Swiss tech companies are permitted to hand over data directly to EU investigators

Federal Council responds to new EU rules on the disclosure of electronic evidence

Law enforcement is increasingly reliant on digital data. Emails, chat messages, IP addresses and other electronic information can provide crucial clues for solving criminal offences. However, this data is often held by service providers based in another country or operating their infrastructure across borders. Securing such evidence therefore regularly presents legal and practical challenges for law enforcement agencies.

The European e-evidence legislation is intended to simplify and speed up access to electronic evidence within the EU. For Swiss companies that also offer their services on the European market, however, this gives rise to new legal risks. Whilst they may be obliged under European law to hand over data directly, such a transfer to foreign law enforcement authorities may contravene Swiss criminal law.

The Federal Council therefore adopted a transitional solution on 28 October 2026. Since then, Swiss tech service providers have been able to apply for a special authorisation which, under certain conditions, allows them to hand over electronic evidence directly to the competent EU law enforcement authorities. This is intended to defuse the conflict between the different legal systems until a permanent legal basis is established.

What does European e-evidence legislation cover?

European e-evidence legislation consists, in particular, of Regulation (EU) 2023/1543 and Directive (EU) 2023/1544. The Regulation establishes uniform rules for the cross-border production and preservation of electronic evidence. The Directive supplements this by regulating the designation of establishments or the appointment of legal representatives by certain service providers.

The Regulation has been applicable since 18 August 2026. It enables the competent judicial authorities of an EU Member State to request electronic evidence, under certain conditions, directly from a service provider or its designated establishment or legal representative in another Member State.

The Regulation distinguishes between two instruments:

• The European Production Order obliges the addressee to make specific electronic evidence available. In principle, the requested data must be provided within ten days. In the emergencies provided for by law, the time limit is eight hours.
• The European Preservation Order, on the other hand, serves to provisionally preserve certain data so that it is not deleted before the legal issues surrounding its production have been resolved. Such an order therefore initially requires the preservation of the information in question, rather than its immediate transmission.

The Regulation distinguishes between subscriber data, data used to identify a user, traffic data and content data, such as emails or chat histories. The conditions that must be met for an order to be issued depend, in particular, on the relevant category of data. In the case of data that is particularly intrusive, the Regulation sets out additional requirements for the order and its review.

The new provisions are intended, in particular, to prevent criminal proceedings from being delayed by protracted international mutual legal assistance procedures. For the service providers concerned, however, this means that they must decide within short timeframes on the disclosure of information – some of which may be sensitive – and comply with the relevant orders.

The legal conflict for Swiss tech companies

European e-evidence legislation may also affect companies based in Switzerland. The key factor is whether the companies offer services within the meaning of the Regulation in the EU. In principle, a designated establishment or a legal representative in the EU is required to receive such orders.

The Federal Council cites, for example, Swisscom, Sunrise and Proton as companies that may be affected by such disclosure orders.

The difficulty arises from the interplay between European disclosure obligations and Swiss criminal law.

Article 271(1) of the Swiss Criminal Code makes it a criminal offence for any person to carry out, on Swiss territory and without authorisation, acts on behalf of a foreign state which are the responsibility of a public authority or a public official, or to facilitate such acts. The provision protects the state’s monopoly on the exercise of public power and Swiss sovereignty. It is intended to prevent the exercise of activities involving the exercise of public authority on Swiss territory for the benefit of a foreign state without the necessary authorisation.

According to the case law of the Federal Supreme Court, the offence covers acts which, by their nature and purpose, are characterised as official acts. The decisive factor here is the classification under Swiss law. It is generally irrelevant whether the act in question is carried out by a foreign public official or a private individual. Nor is an explicit mandate from a foreign authority required; it is sufficient that the act is carried out in the interests of a foreign state.

In the case of the direct handover of electronic evidence by Swiss technology service providers to EU law enforcement authorities, the transfer of data takes place on the basis of an official order for the purpose of presenting evidence in foreign criminal proceedings and thus in the interests of a foreign state. Since, under Swiss law, the collection and transmission of evidence in the context of foreign administrative proceedings may, in principle, be restricted to the channels of international administrative or judicial assistance, the question arises as to whether such a handover of data is compatible with Article 271(1) of the Swiss Criminal Code. In particular, the transfer of information about third parties that is not publicly accessible could be classified as an act of sovereign authority, for which a corresponding Swiss authorisation would be required. If such an act is carried out, at least in part, on Swiss territory and without the necessary authorisation, criminal liability under Article 271(1) of the Swiss Criminal Code (StGB) may arise.

This may give rise to a conflict of laws for Swiss tech service providers: on the one hand, they may be obliged under European e-evidence legislation to comply with disclosure orders issued by EU authorities. On the other hand, the direct transfer of data from Switzerland without the relevant Swiss authorisation may conflict with Article 271(1) of the Swiss Criminal Code. An obligation under European law does not replace the authorisation required under Swiss law.

Special authorisation as a transitional solution

To resolve this conflict of laws, the Federal Council adopted a model order as a transitional solution on 28 October 2026. On this basis, the Federal Department of Justice and Police (FDJP) may, upon application, grant Swiss tech service providers a special authorisation empowering them to comply directly, to the extent authorised, with relevant production orders issued by competent EU law enforcement authorities. This allows the requested data, in particular that stored in Switzerland, to be transmitted directly to the competent authorities.

The special authorisation is valid for a maximum of two years. Should no permanent solution have been reached between Switzerland and the EU by the time it expires, a new application for authorisation must be submitted.

The special authorisation is limited to authorising actions that might otherwise fall under Article 271 of the Swiss Criminal Code. The permissibility of the specific disclosure of data continues to be governed by the other applicable legal provisions.

Data protection, confidentiality obligations and procedural rights

As electronic evidence regularly contains personal data, Swiss tech service providers must, when disclosing such evidence, comply in particular with the processing principles set out in Article 6 of the Data Protection Act (DSG) and the conditions for the transfer of personal data abroad under Articles 16 and 17 of the DSG. Furthermore, specific statutory confidentiality obligations may preclude such a transfer. For every disclosure order, it must therefore be assessed whether, and to what extent, the requested data may be disclosed, taking these requirements into account. Of particular relevance are the categories of data concerned, the purpose and scope of the disclosure, and any obligations regarding information provision and confidentiality.

In addition, the procedural rights of the data subjects must be taken into account. The European e-Evidence Regulation provides for specific legal remedies and safeguards in this regard. Depending on the category of data, different conditions also apply to the ordering and disclosure of electronic evidence.

What are the implications of the new regulations for businesses?

The transitional arrangement is particularly relevant for Swiss providers of communications, cloud and hosting services who also offer their services within the EU. They should first assess whether, based on their services and their establishment and representation structures, they fall within the scope of the European e-evidence legislation. If this is the case, it is advisable to clarify at an early stage whether a special authorisation from the FDJP is required.

Given the short response times for European production orders, companies should establish clear internal processes and lines of responsibility. These include, in particular, the centralised recording and legal review of incoming orders, as well as coordinated cooperation between the legal department, data protection, compliance and IT. When implementing these measures technically, it must be ensured that only data lawfully requested is secured or transmitted, that its confidentiality and integrity are safeguarded, and that the individual processing steps are documented in a traceable manner.

Finally, existing contracts with customers and other service providers should be reviewed for provisions relating to data disclosure, cooperation with regulatory enquiries and information obligations. Such agreements can clarify the legal requirements but cannot replace them.

Conclusion and Outlook

With the transitional solution adopted on 28 October 2026, the Federal Council has resolved the conflict between European e-evidence legislation and Article 271 of the Swiss Criminal Code. The special authorisation enables Swiss tech service providers to disclose electronic evidence directly to the extent authorised, without exempting them from compliance with further legal requirements.

In the long term, the Federal Council is aiming for a permanent legal framework. As early as April 2025, it instructed the FDJP to examine the relevant legal basis and possibilities for closer cooperation with the EU. Until this work is completed, affected companies should monitor legal developments and adapt their internal processes to deal with European production and preservation orders.

Sources

• Federal Office of Justice (FOJ), press release of 28 October 2026: Production of electronic evidence: defusing a legal conflict for tech services with an interim solution.
• Federal Office of Justice (FOJ): Electronic evidence in criminal proceedings, topic page, updated on 28 October 2026.
• Federal Council, press release of 9 April 2025: International criminal prosecution: making it easier to secure electronic evidence.
• Regulation (EU) 2023/1543 of the European Parliament and of the Council of 12 July 2023 on European Production Orders and European Preservation Orders for electronic evidence in criminal proceedings and for the enforcement of custodial sentences following criminal proceedings, in particular Articles 3–10, 16 and 17.
• Directive (EU) 2023/1544 of the European Parliament and of the Council of 12 July 2023 laying down uniform rules on the designation of establishments and the appointment of representatives for the purposes of the collection of electronic evidence in criminal proceedings.
• Swiss Criminal Code of 21 December 1937 (StGB; SR 311.0), in particular Article 271(1) (Prohibited acts on behalf of a foreign state)
• Federal Act on Data Protection of 25 September 2020 (DSG; SR 235.1), in particular Articles 6, 16 and 17.
• Husmann, Markus: Art. 271 StGB, in: Niggli, Marcel Alexander/Wiprächtiger, Hans (eds.), Basler Kommentar, Criminal Law II, 4th ed., Basel 2019, in particular N 5 et seq., 21 et seq., 37 et seq., 49 et seq., 67 et seq. and 72 et seq.
• Trechsel, Stefan/Vest, Hans: Article 271 of the Swiss Criminal Code, in: Trechsel, Stefan/Pieth, Mark/Geth, Christopher (eds.), Swiss Criminal Code, Practical Commentary, 5th ed., Zurich/St. Gallen 2025, in particular N 1–4 and 6.