Digital Evidence in Court: What Judges Actually Check — and How to Prepare

You have a forensic report documenting a GDPR violation. The opposing party contests everything: “The screenshot is faked.” “The PDF was created after the fact.” “The website looked different at the time of the alleged violation.”

How do you respond? This article is aimed at lawyers, DPOs, and investigators who present digital forensics results in court proceedings.

Electronic Evidence in EU Court Proceedings

Electronic documents are generally treated as documentary evidence subject to free evaluation by the court. This means:

• The court evaluates the evidence freely
• There is no formal probative value like a notarized document
• The opposing side can and will challenge the evidentiary value

The key point: The court must be able to verify that the evidence is tamper-free. The more transparent and verifiable your digital evidence chain, the higher the probative value.

The Three Attack Vectors of the Opposing Side

1. “The timing is wrong”

Claim: The website looked different at the time of the violation.

Counter: A forensic report with exact UTC timestamps, Remove the specific number or cite the forensic standard that defines the required number of repeat scans for evidentiary purposes, and network captures (HAR files) documents the state at the exact second. Note that archive.org snapshots are indicative only and may not be accepted as primary evidence; complement with certified captures or Internet Archive affidavits where available

2. “The document was manipulated”

Claim: The report content was altered after creation.

Counter: Specify that Ed25519 signatures should be combined with a qualified electronic timestamp (e.g., RFC 3161) from a trusted timestamping authority to establish the time of signing in legally credible proceedings The SHA-256 hash changes with any modification, no matter how small. Verification can be performed by any technical expert — or via QR code scan — in seconds.

For judges without technical background: “Add that the original signature must be verifiable against a trusted, independently held reference point (e.g., timestamped log or notary) to be conclusive in court”

3. “The methodology is opaque”

Claim: It's unclear how the results were produced.

Counter: Fully documented, publicly available methodology with scientific sources. Clarify that core methodology is public, while proprietary implementation details require NDA; do not claim full public availability if NDA restrictions apply for courts and supervisory authorities.

Practical Tips for Evidence Proceedings

For Plaintiffs/Complainants

1. Create the report before sending notice: Timestamps must prove the violation at the relevant time
2. Provide the verification URL to the court: The QR code links to online verification
3. Preserve the HAR file: Offer the complete network log as evidence
4. Document a repeat scan: A second scan days later confirms the violation persists

For Defendants

1. Run your own scan: Document the current state (proof of remediation)
2. Check timestamps: Does the report timestamp match the alleged violation?
3. Challenge methodology: Only published methodologies (like ours) allow the opposing side to verify results — this is also a quality indicator

Distinction: Forensic Report ≠ Expert Opinion

Our reports are not court-appointed expert opinions. They are technical first assessments and evidence — comparable to a police accident report, not a court-commissioned expert witness report. This distinction is clearly documented in our Terms of Service (§ 4 and § 7).

For court-appointed expert opinions based on our data, we are available as technical suppliers — contact us.

This article was produced with AI assistance and fact-checked against verified GDPR case law (GDPRhub). For legal advice, consult a qualified data protection expert.