On 28 October 2026, the Federal Council adopted a model decision under which Swiss digital service providers offering services in the European Union (EU) can be authorized pursuant to art. 271 of the Swiss Criminal Code (SCC) to preserve and produce electronic evidence upon direct request from EU judicial authorities. Authorizations must be sought from the Federal Department of Justice and Police (FDJP), and will be granted for two years, renewable.

This authorization-based regime, which will apply pending a Swiss legal basis or an agreement with the EU, aims at ending the conflict of laws Swiss service providers active in the EU have faced since 18 August 2026, when the EU e-evidence package, namely Regulation (EU) 2023/1543 (e‑evidence Regulation) and Directive (EU) 2023/1544, became applicable. This regime allows data held in Switzerland and/or held by Swiss-based service providers to be sent to an EU judicial authority without any Swiss authority examining the merits of the request.

Background

The e-evidence Regulation lays down the rules under which, in criminal proceedings, a judicial authority of an EU Member State (Denmark excepted) may order a service provider offering its services in the EU to produce or preserve subscriber, traffic or content data. A prosecutor can issue or validate a production order for subscriber data, whilst traffic and content data require an order issued or validated by a judge and an offense punishable by at least three years' imprisonment or a listed cyber, child-abuse or terrorism offense (art. 4 and 5 e-evidence Regulation). The order is addressed directly to the addressee that every service provider offering services in the EU must designate in a Member State (a designated establishment for providers established in the EU, a legal representative for the others; art. 7 e-evidence Regulation; art. 3 Directive (EU) 2023/1544). The provider has ten days to comply, eight hours in case of emergency (art. 10 e-evidence Regulation), and faces fines of up to 2% of its worldwide annual turnover (art. 15 e-evidence Regulation). A Swiss-based email, messaging or cloud provider offering its services in the EU falls within the scope of the e-evidence Regulation wherever its servers are, but only regarding the data pertaining to the services it offers in the EU (art. 1, 2(3) and 3(3) e-evidence Regulation).

Under Swiss law, art. 271(1) SCC provides that whoever performs on Swiss territory, without authorization, acts reserved to public authorities on behalf of a foreign State commits an offense. Gathering and transmitting Swiss-based evidence for use in foreign criminal proceedings is the typical example.

It follows from the foregoing that, in order to process and comply with EU preservation and production orders, service providers headquartered in Switzerland and/or holding data in Switzerland require authorization within the meaning of art. 271(1) SCC, enabling them to preserve and disclose such data to the requesting authorities within the EU through their designated establishment or legal representative located in an EU Member State. Failing such authorization, art. 271(1) SCC could be infringed.

The transitional authorization

Under art. 31 of the Government and Administration Organisation Ordinance (GAOO), the competent federal department grants authorizations under art. 271(1) SCC. In the field of international mutual legal assistance, the FDJP is responsible for granting authorizations within the meaning of art. 271(1) SCC. Cases of major significance, whether political or otherwise, must be submitted to the Federal Council.

The FDJP's model decision of 29 October 2026, published by the Federal Office of Justice, indicates that the authorization is granted to the service provider, its organs, employees, agents and auxiliaries, for two years from its issuance, renewable on reasoned request, and covers both production and preservation orders. It is available to service providers headquartered in Switzerland and/or holding data in Switzerland, that offer services in the EU (the Federal Council's press release mentions Swisscom, Sunrise and Protonmail as examples). For each order, the provider must verify beforehand that the conditions of the authorization are met: the order must be issued or validated by an authority referred to in art. 4 e-evidence Regulation, concern an offense and services covered by the Regulation and data stored by or for the provider at the time of receipt, and be executed through the provider's designated establishment or legal representative in the EU. The authorization does not extend to orders that, from a Swiss perspective, concern predominantly political, military or tax matters within the meaning of art. 3 of the Federal Act on International Mutual Assistance in Criminal Matters (IMAC). The provider must report every order received to the Post and Telecommunications Surveillance Service (PTSS) at the end of each month or the authorization may be revoked. Note that the authorization is a permission, not an obligation. It thus removes the criminal exposure under art. 271 SCC, but whether an order must be obeyed remains a matter of EU law.

What the authorization does not cover

The model decision states expressly (as did the Federal Council's 2013 model decision allowing Swiss banks to cooperate with the US Department of Justice in the US tax dispute) that the authorization only excludes criminal liability under art. 271 SCC and does not release the provider from the other obligations under Swiss law, in particular data protection and professional secrecy. Therefore, the service provider must still verify, for each order, that it is not disclosing a business secret to a foreign authority (art. 273 SCC), violating telecommunications secrecy (art. 321ter SCC), or breaching the Federal Act on Data Protection (FADP), which requires an adequate level of protection abroad (or an applicable statutory exception under art. 16 et seq. FADP) and a legal justification where the disclosure infringes personality rights (art. 30 et seq. FADP). A willful disclosure abroad in breach of art. 16 and 17 FADP is a criminal offense, prosecuted on complaint and punishable by a fine of up to CHF 250'000 for the individuals responsible (art. 61 let. a FADP).

For the affected data subject, the procedural safeguards inherent to mutual legal assistance no longer apply. No Swiss authority reviews the request (the monthly reporting to the PTSS serves statistical purposes and informs the preparation of a permanent statutory solution), the affected person is neither informed nor heard in Switzerland, and there is no right to appeal before a Swiss court. An order relating to a political, military or tax matter falls outside of the scope of the authorization, so that the provider cannot execute it without breaching art. 271 SCC and must therefore object under art. 17 e-evidence Regulation (conflict with third-country law). The only remaining safeguards are those under EU law in the issuing State: notification of the affected person, which may be delayed or omitted entirely (art. 13 e-evidence Regulation), and a remedy before a court there (art. 18 e-evidence Regulation). Legal privilege is assessed exclusively under the law of the issuing State and of the Member State where the provider's addressee sits, not under Swiss law (art. 5(2), 5(9), 5(10) and 12 e-evidence Regulation).

Moreover, the solution is one-way. Swiss prosecutors must still rely on mutual legal assistance to obtain data from providers not subject to Swiss jurisdiction, and requests from third countries, such as under the US CLOUD Act, are not covered by the new regime. Questions such as whether a Swiss authority will retain a screening role over incoming foreign orders, whether the affected persons will have a legal remedy in Switzerland, and whether Switzerland will secure reciprocity are left to the permanent statutory regime, which has yet to be adopted. As the dispatch to Parliament is not expected before the end of 2027 and negotiations with the EU are expected to take time, the transitional regime is likely to endure.

What to do now

• Swiss digital service providers offering services in the EU should ensure they have designated an establishment or, if they are not established in the EU, appointed a legal representative there, as art. 3 Directive (EU) 2023/1544 required by 18 August 2026, and apply to the FDJP for the art. 271 SCC authorization, which is granted in advance and covers all orders received during its two-year validity.
• These providers also need a written internal compliance procedure capable of meeting the e-evidence Regulation's ten-day and eight-hour emergency deadlines, covering the verification of the conditions of the authorization, the review under art. 273 and 321ter SCC as well as the FADP, and the monthly reporting to the PTSS. They should also inform their users that personal data may be disclosed directly to EU authorities (for instance by updating their privacy notices).
• Companies and individuals under investigation in the EU should assume that data held by a Swiss provider may be transmitted directly to the requesting judicial authority without prior Swiss judicial review, and plan their defense accordingly. Privileged correspondence with Swiss counsel stored in a client's account with such a provider is protected only as far as the issuing or enforcing Member State recognizes legal privilege for non-EU lawyers.