The processing of data within the meaning of Section 115h StPO describes the technically and legally strictly regulated process by which seized digital data is made usable for criminal proceedings. The starting point is a forensically secured original backup, from which a working copy is created. Exclusively this working copy forms the basis for further evaluation.

The data is not searched freely, but is consistently restricted to the scope authorized by the court. The specified data categories and time periods are particularly decisive. Any evaluation going beyond this is inadmissible.

The regulation deliberately serves to limit state intervention. It ensures that the data analysis does not lead to uncontrolled exploration, but remains closely tied to the judicial authorization.

Select Your Preferred Appointment Now:Free initial consultation

Systematics of data processing

Data processing according to Section 115h StPO is a clearly structured procedural step within the investigative proceedings. It follows the securing and seizure of data carriers and data and serves the technical evaluation of the already secured data sets. This is not an independent coercive measure, but the methodical implementation of an already authorized measure.

The process follows a fixed sequence: first, the investigative authorities create an original backup, then they make a working copy and carry out the content evaluation on this basis. The result represents a structured data set, which they make accessible to the proceedings as evidence. The legal requirements define each of these steps bindingly, so that the parties involved may neither skip nor mix them.

The systematics ensure that the evaluation of data remains technically traceable and legally verifiable. In particular, the separation between backup and evaluation prevents original data from being altered or falsified. At the same time, it is guaranteed that the data is available in a form that enables judicial utilization.

Select Your Preferred Appointment Now:Free initial consultation

Relationship to Section 109 StPO definitions

The regulation of Section 115h StPO builds directly on the definitions of Section 109 StPO. There, the central technical and legal terms are defined, in particular original backup, working copy, processing of data as well as the result of data processing. These definitions are mandatory for the understanding and application of data processing. Read more about the definitions of Section 109 StPO here: Legal definitions of securing and seizure

Data processing itself is defined as technical processing for evidentiary reasons. It includes both the evaluation of existing data and the recovery of deleted content and its restriction to the authorized scope. The judicial decision on the seizure of data carriers and data, to which the processing is substantively bound, is always decisive.

The definitions ensure a clear demarcation of the individual procedural steps. While securing and seizure concern the power of disposal over data, data processing regulates its content evaluation. Without this legal differentiation, traceable and controllable processing of digital evidence would not be guaranteed.

Select Your Preferred Appointment Now:Free initial consultation

Original backup and working copy

The original backup forms the basis of every data processing. This is a forensically created copy of the original data set, which is generated using special security mechanisms. The goal is to preserve the original state of the data unchanged and secure as evidence.

Based on this original backup, the investigative authorities create a working copy. They use exclusively this working copy for further evaluation. The original backup, on the other hand, remains untouched and serves as a reference with which the integrity of the data can be checked at any time.

This clear separation between original backup and working copy is mandatory. It prevents changes to the evidence from occurring through the analysis itself. At the same time, it enables a repeatable and verifiable evaluation, which is of central importance for the judicial usability of digital evidence.

Select Your Preferred Appointment Now:Free initial consultation

Scope of data processing by judicial authorization

Data processing is strictly bound to the judicial authorization. What is decisive is which data categories and which time period are covered by the decision on the seizure. The evaluation may take place exclusively within this framework.

The judicial decision specifically determines:

• which types of data may be evaluated, such as communication data or files,
• which time period is covered by the evaluation,
• which restrictions are to be observed during processing.

Any analysis going beyond this is inadmissible. Data processing is therefore not an open search process, but a targeted and limited evaluation based on clearly defined criteria. Compliance with these limits is crucial for the legal usability of the data obtained.

Select Your Preferred Appointment Now:Free initial consultation

Technical process of data processing

The technical process of data processing follows a structure prescribed by law. The starting point is always the secured data set, from which the investigative authorities create an original backup. This secures the original data set unchanged as evidence.

In practice, the process is regularly divided into the following steps:

• Creation of a forensically secured original backup,
• Preparation of a working copy for further processing,
• Sifting and filtering of the data according to the specified criteria,
• Structuring of the relevant data in a usable format.

The evaluation takes place exclusively on the working copy. Technical measures can also be used to make data more accessible. The result is a structured data set that enables electronic further processing and can be used in the proceedings.

Select Your Preferred Appointment Now:Free initial consultation

Recovery of deleted data and its limits

The recovery of deleted data is part of the data processing, provided it is covered by the scope of the judicial authorization. Technically, data can also be reconstructed that has already been removed during ongoing operation, as long as it is still present in the data set.

Typically, recovery includes:

• the reconstruction of deleted files,
• the recovery of communication histories,
• the reading of fragmented data sets.

Here, too, the strict binding to the judicial authorization applies. Deleted data may only be recovered and evaluated if it is covered by the specified data categories and time periods. Recovery is therefore not an independent investigative step, but part of the technical processing within clearly defined limits.

Select Your Preferred Appointment Now:Free initial consultation

Restriction of data to relevant content

Within the framework of data processing, a targeted restriction of the data to content relevant to the proceedings takes place. The starting point is the entire secured data set, which, however, may not be evaluated in its entirety. Rather, those data are to be filtered out that are covered by the judicial authorization.

The restriction is based on clearly defined criteria, in particular:

• data categories, such as certain forms of communication or file types,
• temporal limitation to a specified period,
• substantive relevance to the subject of the investigative proceedings.

The goal is a reduced and relevant data set, which forms the basis for further use in the proceedings. At the same time, this ensures that irrelevant or inadmissible data is not included in the evaluation.

Result of data processing and structuring

The result of the data processing is a structured data set that corresponds to the requirements of the judicial decision. This data set contains exclusively that information which was determined within the framework of the permissible evaluation.

The law obliges the result to be provided in a commonly used file format. This allows the data to be processed further electronically and used efficiently in the proceedings.

Typical requirements for the result are:

• clear structuring of the data, for example by time, content, or source,
• traceability of the selection of the data contained,
• technical usability for further evaluations or presentations in the proceedings.

The result forms the basis for further use in the investigative and main proceedings and must therefore be traceable both in terms of content and technology.

Select Your Preferred Appointment Now:Free initial consultation

The processing report as a central control instrument

Data processing must be documented by a processing report. This report serves the traceability and verifiability of the entire process and is a central element of the legal regulation.

The processing report must specifically record:

• the course of the data processing,
• the technical steps and methods used,
• any recovery of deleted data,
• the criteria for restricting the data set.

The documentation ensures that the data processing can be checked retrospectively. The report specifically makes it possible to assess compliance with the judicial authorization as well as the lawfulness of the individual processing steps.

Select Your Preferred Appointment Now:Free initial consultation

Role of the public prosecutor’s office in the investigative proceedings

The public prosecutor’s office leads the investigative proceedings and is thus also responsible for controlling the data processing. It decides on the submission of the necessary applications and monitors the implementation of the authorized measures.

In connection with data processing, this specifically includes:

• the application for judicial authorization for the seizure of data carriers and data,
• the determination of the scope of the evaluation through corresponding applications,
• the monitoring of the implementation by the criminal police or experts.

The public prosecutor’s office thus bears the responsibility for ensuring that the data processing takes place within the framework of the legal requirements and that the results are properly introduced into the proceedings.

Select Your Preferred Appointment Now:Free initial consultation

Transfer of data to the court in the main proceedings

The result of the data processing is to be transmitted to the court in the course of the filing of the indictment. Thus, the processed data becomes part of the court proceedings and is available for further evidence.

The transfer specifically includes:

• the structured data set as the result of the processing,
• the processing report for documenting the process,
• if applicable, supplementary documents for the traceability of the evaluation.

The transmission ensures that the court can independently check and utilize the data. The structured processing enables efficient integration into the taking of evidence.

Select Your Preferred Appointment Now:Free initial consultation

Deletion obligations after conclusion of the proceedings

After the final conclusion of the proceedings, there is a legal obligation to delete the data sets created during the data processing. This affects both the result of the data processing and the underlying copies.

The following are to be deleted in particular:

• the result of the data processing,
• the original backup,
• the working copy.

An exception exists only if the data is required as evidence in another pending criminal proceeding. In all other cases, a complete deletion is to be ordered and carried out.

Data processing upon discontinuation of the proceedings

If the investigative proceedings are discontinued, the same deletion obligations apply to the data sets created during the data processing as after a judicial conclusion. In this case, the public prosecutor’s office is responsible and must order the corresponding measures.

The deletion specifically includes:

• the result of the data processing,
• the original backup,
• the working copy.

Here, too, deletion is only omitted if the data is required as evidence in another pending criminal proceeding. Otherwise, a complete and final removal of the data is to be carried out.

Select Your Preferred Appointment Now:Free initial consultation

Legal protection against unlawful data processing

Against unlawful data processing, judicial legal protection is available to those affected. The objection due to violation of rights is particularly decisive, with which it can be asserted that a measure was illegally ordered or carried out.

Such legal protection is particularly considered if:

• the data processing goes beyond the authorized scope,
• the legal requirements were not met,
• the measure was carried out disproportionately.

The court decides on the objection. It checks whether the data processing meets the legal requirements and can, if necessary, eliminate unlawful conditions.

Select Your Preferred Appointment Now:Free initial consultation

Distinction from other investigative measures

Data processing is to be clearly distinguished from other investigative measures. While securing and seizure concern the establishment of the power of disposal over data, data processing regulates its content evaluation.

The main differences can be summarized as follows:

• Securing concerns the provisional securing of data,
• Seizure takes place by judicial decision and specifies the measure,
• Data processing serves the technical evaluation of the already secured data.

Data processing is therefore not an independent intervention, but a downstream processing step. It presupposes a previously lawfully ordered measure and is substantively bound to it.

Select Your Preferred Appointment Now:Free initial consultation

Your Benefits with Legal Assistance

The processing of data according to Section 115h StPO is a technically complex and legally strictly regulated process. Even minor deviations from the legal requirements can lead to obtained evidence being unusable. Early legal review is therefore crucial.

Legal support enables, in particular:

• the review of the judicial authorization and its specific scope,
• the monitoring of compliance with legal limits during data processing,
• the analysis of the processing report for errors or inconsistencies,
• the assertion of violations of rights through appropriate legal remedies.

Especially with extensive digital data sets, there is a significant risk that unlawful evaluations are carried out or relevant procedural errors remain undetected. Targeted legal control creates clarity here and can have a decisive influence on the further course of the proceedings.

A sound defense strategy therefore requires that the data processing is fully understood and reviewed not only technically, but also legally.

Select Your Preferred Appointment Now:Free initial consultation

FAQ – Frequently Asked Questions