Council of Europe. Comprehensive data protection. Treaty (Amending Protocol, CETS No. 223)
Convention 108+Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108+)
§1Summary
- Synopsis
Modernises Convention 108 to bring it broadly into line with the GDPR. It adds proportionality and lawful-basis requirements, breach notification, wider data subject rights (including rights on automated decisions), transparency, privacy by design and accountability. The Convention Committee also gets stronger powers to evaluate parties.
- Key themes
- Unique features
It is a global, treaty-based near-equivalent of the GDPR that non-European states can join. The GDPR (Recital 105) names accession to it as a factor in adequacy decisions.
- SaaS relevance
Once in force, its parties will need to legislate breach notification and accountability duties that will apply to SaaS providers in those states.
§2Obligations
- Breach notification
- Supervisory authority without delay for serious breaches (Art 7(2))
- DPO
- No
- Cross-border transfers
- Free flow between parties; appropriate safeguards for non-parties
- Maximum penalty
- Set by national law
§3Dates
- Key dates
- Adopted
- Adopted by the Committee of Ministers 2018-05-18; opened 2018-10-10. Enters into force once all Convention 108 parties ratify, or, failing that, on or after 2023-10-11 once 38 parties have ratified. 34 ratifications and 46 signatures as of the T-PD Bureau of 16–17 Sept 2026 (Moldova was the 34th, 2026-05-15).
§4Text and authority
- Text
- Authoritative text rm.coe.int
- Authority
- Convention Committee (T-PD); national supervisory authorities
§5Where it applies
- Members of the body
Membership-based — check ratification status. Membership of Council of Europe does not mean a state has signed or ratified this instrument.
- Albania
- Andorra
- Armenia
- Austria
- Azerbaijan
- Belgium
- Bosnia and Herzegovina
- Bulgaria
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Estonia
- Finland
- France
- Georgia
- Germany
- Greece
- Hungary
- Iceland
- Ireland
- Italy
- Latvia
- Liechtenstein
- Lithuania
- Luxembourg
- Malta
- Moldova
- Monaco
- Montenegro
- Netherlands
- North Macedonia
- Norway
- Poland
- Portugal
- Romania
- San Marino
- Serbia
- Slovakia
- Slovenia
- Spain
- Sweden
- Switzerland
- Turkey
- Ukraine
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Not in force as of Oct 2026 (34 of 38 required ratifications). The text_url document ID was not re-checked this session.