Search at an enterprise: equipment, documents, attachment of property and an action plan for the company

A search of an office, warehouse or workshop affects the whole company: work stops, equipment and documents are taken away, and later the property may be attached. Here is what matters specifically for a business. The general rights during a search are in a separate article: search of a home or of a person: what to do and what your rights are.

When a search of an office is lawful

An office, warehouse, workshop or company vehicle is the “other possession of a person” (Article 233(2) of the Criminal Procedure Code of Ukraine, hereinafter the CPC). It may be entered with the voluntary consent of the possessor or on the basis of a ruling of the investigating judge (Article 233(1) of the CPC), and before the ruling is made — only in urgent cases connected with saving the lives of people and property or with the immediate pursuit of suspects (Article 233(3) of the CPC). A “threat of destruction of evidence” is not among them. During martial law, if the investigating judge objectively cannot exercise their powers, permission for a search, attachment of property or temporary access may be given by the head of a prosecutor’s office by a resolution (Article 615(1)(2) of the CPC); such a resolution may be appealed to court, and the complaint is considered by an investigating judge (Article 615(4) of the CPC). If such a resolution has been issued instead of a ruling, clarify with your attorney how the time limits and the appeal described below apply. What must happen after an urgent entry before the ruling is made, as well as the admission of an attorney, attesting witnesses and video recording, we covered in the article on search of a home or of a person.

What the investigator had to prove to the court

In the motion for a search, the investigation must justify why the items and documents cannot be obtained voluntarily — by a demand under Article 93(2) of the CPC — or by means of other investigative actions. This requirement does not apply when the search is for instruments of a criminal offence or for items and documents withdrawn from circulation (Article 234(3)(8) of the CPC). The investigating judge refuses a search if the prosecutor or investigator does not prove sufficient grounds to believe that a search is the most appropriate and effective way to find and seize the necessary items and documents, and a measure proportionate to the interference with personal and family life (Article 234(5)(5) of the CPC). Therefore, the investigator’s written requests for documents should not be ignored, and you should determine the scope of your reply together with an attorney.

The ruling: what a company should check

In the ruling (Article 235(2) of the CPC) check which premises, or part of them, the search is permitted for — the office, a floor, a warehouse; whether your company is named as the owner or actual possessor; whether computer equipment is named in the list of what is sought (why this matters — below). If the search goes beyond these limits, say so: statements of those present are entered in the protocol (Article 236(8) of the CPC).

During the search: what matters for a company

• Employees. The investigator or prosecutor may forbid anyone to leave the place of the search until it ends and to take actions that interfere with the search; non-compliance entails liability (the second paragraph of Article 236(3) of the CPC).
• Doors, safes, passwords. If those present refuse to open the premises or a storage place or to remove the logical protection system, the investigator or prosecutor has the right to do so themselves (Article 236(6) of the CPC). Decide with your attorney whether to give access.
• Protocol. At an enterprise, the second copy of the protocol is handed to the head or a representative (the second paragraph of Article 236(9) of the CPC). The protocol states the items and documents seized, copies of computer data and the means of their identification (Article 104(3)(3) of the CPC) — ask for the serial numbers of the equipment to be recorded.

Equipment and data: seizure or a copy

For a company the most painful thing is servers, laptops and phones. What the CPC says about equipment:

• computer equipment may be seized for examination of its physical properties only if it is expressly named in the ruling (the second paragraph of Article 168(2) of the CPC);
• in general, temporary seizure of computer systems is prohibited. Exceptions: providing them together with the information is a necessary condition of an expert examination; they were obtained as a result of a criminal offence or are its means or instrument; access to them is restricted by the owner, possessor or holder or is connected with overcoming a logical protection system (the third paragraph of Article 168(2) of the CPC). So, if access is restricted by the owner, possessor or holder of the equipment, the prohibition does not apply;
• if necessary, the investigator or prosecutor makes copies of the information from the systems — with the involvement of a specialist (the fourth paragraph of Article 168(2) of the CPC);
• if a computer system or part of it is seized, then at the possessor’s request copies of the information are left to them on their media, if technically possible (the fifth paragraph of Article 168(2) of the CPC). This rule does not apply if the circulation of the information is prohibited by law, and for information with restricted access it applies only to the extent that does not contradict the procedure for its circulation and protection (the sixth paragraph of Article 168(2) of the CPC). Keep clean media in the office and state the demand for the protocol;
• if during the search access is found to systems that are not in the ruling, the investigator or prosecutor may search for and record data in them on site, where there are sufficient grounds to believe they are important for the proceedings (the second paragraph of Article 236(6) of the CPC).

Temporarily seized property: time limits and return

Seized items and documents that are not in the list in the ruling and are not withdrawn from circulation by law are considered temporarily seized property (Article 236(7) of the CPC). For temporarily seized property the law sets the following time limits and rules for return:

• if property was temporarily seized during a search on a ruling, the investigator or prosecutor must file a motion for its attachment within 48 hours after the seizure, otherwise the property is returned immediately (the second paragraph of Article 171(5) of the CPC);
• the investigating judge makes the ruling on attachment of temporarily seized property no later than 72 hours from the day the motion reaches the court, otherwise the property is returned (Article 173(6) of the CPC);
• property is also returned on a resolution of the prosecutor, if the prosecutor finds the seizure unfounded, in case of refusal of attachment and in case of cancellation of the attachment (Article 169(1) of the CPC).

If the property is not returned, the possessor of the temporarily seized property may appeal this inaction even during the pre-trial investigation (Article 303(1)(1) of the CPC).

Attachment of the company’s property

Attachment is the temporary, until cancellation, deprivation, by ruling of the investigating judge or court, of the right to alienate, dispose of and/or use property in respect of which there is a set of grounds or reasonable suspicions to believe that it is evidence of a criminal offence, is subject to special confiscation or confiscation, or is needed to secure a civil claim or the recovery from a legal entity of an undue benefit received (Article 170(1) of the CPC). Property that was not seized may also be attached, and the motion for this may be considered without notifying the owner, if this is necessary to secure the attachment (Article 172(2) of the CPC). So a company may learn of an attachment only after the ruling. What to rely on:

• the investigating judge refuses attachment if its necessity is not proved, as well as the risks of concealment, damage, spoilage, destruction, transformation or alienation of the property (Article 173(1) of the CPC, the second paragraph of Article 170(1) of the CPC);
• the method of attachment must not stop or excessively restrict lawful business activity (Article 173(4) of the CPC);
• the suspect, the accused and third parties may appeal the decision on attachment (Article 173(7) of the CPC);
• an owner or possessor who was not present at the consideration may ask for the attachment to be cancelled; it may also be cancelled when it is proved that the need has disappeared or that the attachment was imposed without justification (Article 174(1) of the CPC). Such a motion is considered no later than three days after it reaches the court (Article 174(2) of the CPC).

Temporary access instead of a search

Temporary access is when the person who holds the documents, by ruling of the investigating judge, allows a party to the proceedings to review them, make copies and seize them (Article 159(1) and (2) of the CPC); for computer systems — through a copy of the information without seizing them (the second paragraph of Article 159(1) of the CPC). For a business this is milder than a search:

• the investigating judge summons the person who holds the documents; without a summons — only if sufficient grounds are proved to believe that there is a real threat of their alteration or destruction (Article 163(1) and (2) of the CPC). After the summons, the documents must be preserved in the form they had at the moment of the summons (Article 163(3) of the CPC);
• a trade secret is a secret protected by law (Article 162(1)(4) of the CPC): access to it is granted only if it is proved, in particular, that the circumstances cannot be proved by other means (Article 163(6) of the CPC);
• if a ruling on temporary access is not complied with, the investigating judge may permit a search (Article 166(1) of the CPC).

Action plan for the company

In advance:

• decide who meets the investigators and receives a copy of the ruling and the protocol — the head or an authorised representative;
• keep an attorney’s contacts at reception, together with an instruction for employees: do not obstruct, do not delete anything, make objections by statements for the protocol;
• know who has the keys and access rights, so that the question of access is decided by one person together with the attorney;
• keep backup copies of critical data outside the office, so that work does not stop if the equipment is seized.

After the search:

• check the description of what was seized against the list in the ruling;
• for temporarily seized property, watch the time limits: 48 hours from the seizure — for the motion for attachment, 72 hours from the day the motion reaches the court — for the ruling; if they are missed, demand the return of the property;
• if the property has been attached, prepare with your attorney a motion to cancel the attachment or an appeal against the ruling.

If a search is already under way, an attorney should be at your side as early as possible. More about defence in criminal proceedings — on our service page.

The provisions are cited as currently in force as of 13 October 2026.