Council of Europe Convention 108+

Why does it matter?

Convention 108+ is the only legally binding international treaty on personal data protection with global relevance that is open to non-member states, and its principles sit behind national laws on three continents. For a privacy team it gives one baseline across the parties, a reference for cross-border transfers (article 14) and the standard against which the Convention Committee evaluates each party (article 4, paragraph 3).

Key benefits include:

• One baseline across many jurisdictions

Parties from Europe, Latin America and Africa have bound themselves to the same principles (articles 5 to 11), which narrows the gaps a multi-country privacy program must manage.

• Transfers between parties stay open

A party may not prohibit or subject to special authorization a transfer to another party for the sole purpose of protecting personal data, unless there is a real and serious risk of circumventing the Convention (article 14, paragraph 1).

• Breach notification is a treaty duty

The controller must notify, without delay, at least the competent supervisory authority of breaches that may seriously interfere with data subjects' rights and fundamental freedoms (article 7, paragraph 2).

• Automated decisions carry a named right

Individuals may not be subject to a decision significantly affecting them based solely on automated processing without having their views considered, and may ask for the reasoning behind processing (article 9, paragraph 1, points a and c).

• Supervisors hold real powers

Each party must give its authorities powers of investigation and intervention, the ability to impose administrative sanctions, independence, and enough resources to act (article 15, paragraphs 2, 5 and 6).

How does it work?

The consolidated text has 31 articles in eight chapters: general provisions (articles 1 to 3); basic principles for the protection of personal data (articles 4 to 13); transborder flows (article 14); supervisory authorities (article 15); co-operation and mutual assistance (articles 16 to 21); the Convention Committee (articles 22 to 24); amendments (article 25); and final clauses (articles 26 to 31). Chapter II sets the rules a party must write into law; the rest builds the machinery around them.

Convention 108 (ETS No. 108) entered into force on October 1, 1985 and has 55 parties, including nine non-members of the Council of Europe. Protocol CETS No. 223 enters into force when all parties to Convention 108 have ratified it or, as from October 11, 2023, once 38 parties have. The Treaty Office chart of October 14, 2026 shows 34 ratifications and 12 signatures not yet followed by ratification, and records the Russian Federation's signature as suspended since March 16, 2022. Until then the 1981 text and the 2001 Additional Protocol on supervisory authorities and transborder flows (ETS No. 181) remain the binding instruments.

Under article 4, a party's measures must be in force by the time it ratifies or accedes, and it must let the Convention Committee evaluate their effectiveness and contribute to that evaluation. The Committee has one representative per party (article 22), reviews implementation and recommends measures where a party is not compliant (article 23, point h), and gives an opinion before any new accession (article 23, point e). The Consultative Committee of Convention 108 (T-PD) carries out the committee work today; its decisions on review need a four-fifths majority under the Protocol's appendix.

Key Elements

• Legitimacy and quality of data (article 5)

Processing must be proportionate to a legitimate purpose and rest on free, specific, informed and unambiguous consent or another legitimate basis laid down by law. Data must be lawful, fair, transparent, collected for explicit purposes, adequate, accurate and kept no longer than necessary.

• Special categories (article 6)

Genetic data, data on offences, criminal proceedings and convictions, biometric data that uniquely identifies a person, and data revealing racial or ethnic origin, political opinions, trade-union membership, beliefs, health or sexual life may be processed only with appropriate safeguards enshrined in law.

• Security and breach notice (article 7)

Controllers and, where applicable, processors apply appropriate security measures against unauthorized access, destruction, loss, use, modification or disclosure. The text sets no fixed number of hours for breach notice; it requires notice without delay.

• Transparency and rights (articles 8 and 9)

Controllers tell data subjects who they are, the legal basis and purposes, the categories of data, the recipients and how to exercise rights. Rights cover automated decisions, access, the reasoning behind processing, objection, rectification or erasure, a remedy and help from a supervisory authority.

• Accountability and privacy by design (article 10)

Controllers and processors must be able to demonstrate compliance, examine the likely impact of intended processing before it starts, design processing to prevent or minimize interference with rights, and apply technical and organizational measures at all stages. A party may scale these duties to the nature and volume of data and the size of the controller.

• Transborder flows (article 14)

Transfers to a non-party need an appropriate level of protection, secured by the law of the recipient state or by ad hoc or approved standardized safeguards in legally binding instruments. Narrow exceptions exist, and the supervisory authority may prohibit, suspend or condition a transfer.

• Supervisory authorities and co-operation (articles 15 to 21)

Authorities act with complete independence, may not seek or accept instructions, publish periodic reports, and have their decisions open to appeal in court. They form a network, share information and assist data subjects in other parties without charging costs beyond experts and interpreters.

What does it cover?

Each party applies the Convention to data processing subject to its jurisdiction in the public and private sectors (article 3, paragraph 1). Processing by an individual in the course of purely personal or household activities is outside it (article 3, paragraph 2). Exceptions to articles 5(4), 7(2), 8(1) and 9 are allowed only where provided by law, respecting the essence of fundamental rights and necessary and proportionate in a democratic society for aims such as national security, defense or public safety (article 11, paragraph 1). Processing for national security and defense may also be exempted from articles 4(3), 14(5), 14(6) and 15(2)(a) to (d), but must remain under independent and effective review (article 11, paragraph 3). Controllers and processors are bound through the law of each party.

What are its objectives?

Convention 108+ sets a common floor of data protection law for its parties and a shared way to move personal data between them.

Protect every individual, whatever their nationality or residence, with regard to the processing of their personal data (article 1).

Require each party to put the principles into its law before it ratifies, and to submit that law to evaluation (article 4).

Give individuals rights to information, access, objection, rectification, erasure and a remedy (articles 8, 9 and 12).

Keep personal data flowing between parties while setting conditions for transfers to non-parties (article 14).

Establish independent supervisory authorities that co-operate across borders and help data subjects abroad (articles 15 to 21).

Review how each party implements the treaty through the Convention Committee (articles 4 and 23).

Framework in Context

Convention 108+ is the Council of Europe's instrument and a treaty, so it binds the states that ratify it rather than organizations directly. The Treaty Office notes that European Union data protection legislation refers to Convention 108 in the context of transborder data flows. Switzerland ratified the Protocol on September 7, 2023, Argentina on April 17, 2023 and Uruguay on August 5, 2021, while the United Kingdom signed it on October 10, 2018 without ratifying. Unlike the GDPR, which is an EU regulation, or ISO/IEC 27701, which is a management standard, Convention 108+ is a treaty with no certification.

Common Framework Mappings

The Council of Europe does not publish a formal mapping from Convention 108+ to other instruments. The frameworks below either overlap with its principles or implement it in a party's domestic law, and privacy teams compare them when one program must serve several jurisdictions.

Mapped frameworks include:

GDPR

UK GDPR

OECD Privacy Guidelines

APEC PF

APEC CBPR System

Swiss FADP (SR 235.1)

Argentina PDPL (Law 25.326)

Uruguay PDP Law 18.331

KVKK (Law No. 6698)

ISO 27701

ISO 29100

NIST Privacy Framework v1.0

EU Law Enforcement Directive (2016/680)