Search and Seizure of Devices in Ukraine: What to Do as a Business Owner Abroad

What Actually Triggers a Search

You have lived in the EU for years, but your office, warehouse, or apartment remains in Ukraine, and your company is run by a local director or accountant. News of a search usually doesn't come from you — they call from the office after investigators are already inside. At that moment, it's critical to quickly understand the basis, because it determines both your conduct on the spot and your strategy going forward.

The most common basis is a criminal investigation against the company itself or a company official: suspicion of tax evasion, fraudulent business, or violations in procurement procedures. Second: the company is not a suspect but a counterparty to someone else under investigation, and your equipment is seized as evidence of shared transactions. Third: a tax or customs audit escalates into a criminal investigation. Fourth: a complaint or statement from an employee triggers a separate investigation.

There is also a fifth, most common scenario in practice: the company or owner is not a suspect but merely a witness in someone else's case. The search itself says nothing about guilt. So the first thing to do upon learning of a search is to find out the case number and article and immediately engage a lawyer who will determine the status of the company or person in the matter.

Who Has Authority to Conduct a Search and Seize Devices

A search is conducted by an investigator or detective of the body handling the case. Depending on the nature of the investigation, these may be investigators of the National Police — for general criminal cases, the Security Service of Ukraine (SBU) — for state security and cybercrime cases, detectives of the State Bureau of Investigation (DBR) — for cases against judges and high-ranking officials, or detectives of the Bureau of Economic Security (BES) — for tax and customs crimes, including VAT fraud.

Separate are audits by the State Tax Service: a tax audit itself is not a search, and equipment is not seized within its scope. But if the audit reveals signs of a crime, materials are transferred to law enforcement, which can then conduct a search under a separate ruling.

Regardless of who arrives, it's worthwhile to verify the credentials of all participants and record their surnames and positions. Persons without credentials or without an explanation of their role are not given the legal right to remain on the premises during a search. The team is almost always accompanied by witnesses (понаті) — two independent persons whose presence and signatures in the protocol confirm that the action was conducted without violations.

The Investigative Judge's Ruling: What It Permits and What It Doesn't

A lawful search is possible only on the basis of an investigative judge's ruling. This is not a formality but a document that outlines the limits of investigators' actions, so the first thing to ask at the door is to see the ruling and be given time to read it.

The text must include: a specific address, the case number and article of the Criminal Code, a list of items and equipment permitted to be seized, and the validity period of the ruling. Anything that exceeds these limits is already grounds for challenging. If investigators try to seize something not specifically named in the ruling, this should be entered into the protocol as a separate note rather than being objected to aloud.

The law also provides for a narrow exception — an urgent search without a prior ruling when delay threatens loss of evidence. The investigator is then required to seek confirmation from the investigative judge within 24 hours of the lawfulness of the action already taken; if the court refuses, the evidence obtained loses force. So even in an urgent situation, it's important to immediately document whether a ruling existed at the moment the action began.

How to Behave During a Search

First action: verify credentials and the ruling. Second: call a lawyer or attorney before any discussion of the substance of the case begins. The right to defense applies from the moment of the actual beginning of the search, and investigators are required to provide the ability to contact an attorney and await their arrival within a reasonable time.

Until your attorney arrives, a simple rule applies: do not give explanations on the substance of the case, do not comment on the content of documents or correspondence, and do not sign anything you have not fully read. The right not to testify against yourself and closest relatives is constitutionally guaranteed, and silence here is not a sign of guilt but normal procedural conduct.

Since 2020, the code requires continuous video recording of the search — protection for all sides: the video shows what, where, and how was found. If recording is not occurring, this should be entered as a note in the protocol. The protocol itself is the main document, signed upon completion: it must list all seized items with descriptions, not general formulations. Any disagreements are entered into the protocol as notes before signature, not objected to verbally after the fact.

Search Affects More Than Just Business

The key thing a business owner abroad must understand: a search and device seizure are not exclusively a corporate matter. The same ruling that covers the office in Ukraine often extends to the private apartment of the director, accountant, or owner if documents or devices related to the case may be there, and in some cases may reach business operations in other countries, such as premises or offices in Poland. A home search follows the same rules but has an added dimension: family, children, elderly parents may be present, and the presence of strangers in your own home is experienced differently than in a work office.

Under the ruling, a vehicle may also be searched if there is reason to believe it contains items related to the case. A phone may be seized even outside a search — for example, when crossing a border, when border or customs service acts under a separate procedure. The same basic principles apply there — the right to know the basis of the action, the right to a lawyer, the right to document the process — even when the formal procedure is different.

A device belonging to your spouse, child, or parents may be seized if it theoretically contains data significant to the case, even when that person has nothing to do with the matter. And the most common situation in practice — a person is not a suspect at all but a witness in someone else's case: a business partner, former employee, or property landlord. Witness status does not exempt from a search, but significantly limits what lawful actions can be taken against that person. So your family should have a lawyer's contact before anything happens.

Devices, Data, and Cloud: Legal Protection in Advance

The key thing to do well before anyone knocks on the office or apartment door is to get your data storage in order. This is not about concealment or destruction of information — that is unacceptable — but about ordinary corporate hygiene that protects confidential and privileged data while a lawful procedure determines what is subject to examination.

Full disk encryption on laptops and servers and memory encryption on phones is basic practice for any business. Two-factor authentication on email, cloud storage, and corporate services closes the simplest path to account access even if the device is physically seized. Separation of work and personal data — a separate work phone or at least a separate profile — means that seizure of work equipment does not automatically open access to personal correspondence or family photos.

Minimizing what is stored on the device itself is another smart principle: documents not needed daily are better kept in managed cloud storage with clear access separation than locally on a laptop that may physically end up in an evidence bag. Backups stored separately from the office allow the business to continue even if main equipment is temporarily seized: data is not lost, and access is available from any country.

Protection from spyware and stalkerware is a separate point, especially for owners with a public profile: checking devices for hidden surveillance apps, limiting public information about owners in registries and social networks. None of this has anything to do with obstructing an investigation — on the contrary, it is standard cybersecurity practice. Data protected this way remains confidential until a lawful process — not unauthorized access — determines what relates to the case.

What Happens to Seized Devices and How to Recover Them

Device seizure during a search is temporary property seizure, not automatic confiscation. Each seized item is entered into the protocol description with a brand, serial number, and condition, which is why it's important to verify the list before signing, not after. Items not entered into the protocol with a description are legally harder to recover later.

After seizure, the investigator or prosecutor is required within 48 hours to apply to the investigative judge for an arrest warrant for the seized property. If the deadline is missed or the court refuses, the property must be returned — this is one of the most important levers, which is why it is critical for your lawyer to know the exact date and time of seizure. If arrest is imposed, property remains in the case as evidence, and the defense can request cancellation of the arrest or access to copies of work data needed for company operations.

Investigator actions — including the seizure itself and refusal to return property — can be challenged to the investigative judge by complaint under the procedure provided by the code. A procedurally sound and timely complaint much more often brings results than verbal appeals to the investigator. For a company run from abroad, this is where a lawyer acting under power of attorney and familiar with the case from day one saves weeks compared to instructions drawn up after the fact.

How a Lawyer Prepares a Company and Owner for a Search

This is the most important part of working with a client living in the EU while business or family remains in Ukraine — and potentially extends to business locations in Germany or other EU countries. The greatest value of support is revealed here, not retroactively. The first step is a readiness audit: the lawyer reviews how the company stores data, whether employee access is separated, whether the director and accountant have clear instructions for the first moments of a search. Often it emerges that staff has never even had basic briefing — and during a search people panic or, conversely, sign documents without reading or give explanations without an attorney.

The second step is staff training: a short practical instruction for the director, accountant, security, and office administrator — who to call first, what documents to show, how to document the list of seized items, why staying silent about the substance is normal. Companies where such training is done in advance go through searches faster and with fewer violations by investigators themselves, because staff knows their rights and calmly insists on them.

The third step is attorney presence on the spot during the search: they verify the ruling, monitor the procedure, enter notes into the protocol, and immediately notify the owner abroad — so you don't have to wait until end of day to learn what's happening. For the attorney to act on behalf of the company and owner at that moment, a power of attorney from abroad is drawn up in advance, giving them the authority to represent interests on the spot and sign documents where appropriate, without delay waiting for additional authority.

The fourth step is that same preliminary review of device and data protection. And the fifth, often underestimated, is business recovery after the search: the lawyer accompanies the return of seized property or obtaining copies of work data needed, helps restore operational processes, and if necessary coordinates work with an attorney if the case proceeds to court, remaining the main contact for the owner continuing to manage a business in Ukraine remotely through the full range of services for clients abroad. Often the owner has current administrative questions for the company as well, and here the experience of supporting a remotely registered business comes in handy — including the procedure for opening an individual entrepreneur account from abroad, which shows that managing a Ukrainian business physically from another country is a completely workable model with proper support.

If you need to discuss a specific situation quickly — from the first call from the office to already seized equipment — the simplest way is to start with a consultation request, where a lawyer will assess the status of the case and propose a sequence of actions rather than general advice.

Frequently Asked Questions

Can a search be conducted at a company office if the owner permanently lives abroad?

Yes. An investigative judge's ruling concerns the premises, not the physical presence of the owner in the country. Living abroad does not exempt a company from a search and does not require advance notification of the owner — which is why it's important to have a trusted person and lawyer in Ukraine who can act immediately.

Are investigators required to present the ruling before starting a search?

Yes. Those present have the right to demand presentation of the investigative judge's ruling and to review it before any actions begin. Refusal to show the ruling or actions without it, except in the narrow case of urgent search, are grounds for challenging the lawfulness of the entire action.

What if investigators demand a password for a phone or laptop on the spot?

Wait for an attorney or lawyer and do not give explanations or passwords on the substance of the case until their arrival. The right not to testify against yourself extends to refusal to voluntarily disclose device access before consultation with a defender — this is lawful and common procedural conduct.

How long can seized equipment be held before return?

There is no single deadline: it all depends on whether property arrest is imposed within 48 hours of seizure and on the duration of the subsequent investigation. This is why challenging through the investigative judge and requesting return or access to data copies is the main tool that speeds up the process.

Can equipment belonging personally to the director or accountant be seized?

Yes, if there is reason to believe that the personal device stores data related to the case. This is another reason why separating work and personal data on different devices or profiles is not a formality but a practical way to limit what the investigation gets access to during one action.

A search in Ukraine is a procedure with clear rules, and adherence to them — not attempts to circumvent them — best protects both the business and the person in this situation, especially when managing affairs must be done from another country. Preparation in advance — from trained staff to protected data and power of attorney to a lawyer in Ukraine — turns a search from a disaster you learn about through a panicked call into a managed procedure supervised by a specialist, while the owner continues to live and work where they are.

Матеріал має інформаційний характер і не замінює юридичну консультацію.