Privacy Map

Council of Europe. Comprehensive data protection. Treaty

Convention 108Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data

In force

§1Summary

Synopsis

The first legally binding international data protection treaty. Parties must give effect in domestic law to core principles (data quality, special categories, security, data subject rights) and to transborder flow rules. Non-member states of the Council of Europe can also join.

Key themes
  • data quality
  • sensitive data
  • security
  • access and rectification
  • transborder flows
  • mutual assistance
Unique features

It is open to accession by non-European states and has more than 50 parties, including several in Africa and Latin America. It is still the only binding multilateral data protection treaty with global reach.

SaaS relevance

It binds states, not companies. Its parties' national laws follow its principles, and joining it helps a state's case for EU adequacy.

§2Obligations

Breach notification
None (added by 108+)
DPO
No
Cross-border transfers
Free flow between parties; restrictions to non-parties permitted
Maximum penalty
Set by national law

§3Dates

Key dates
  • Adopted
  • In force
  • ETS No. 108; opened 1981-01-28 (marked as Data Protection Day); in force 1985-10-01; 1999 amendments allow EU accession; modernised by Protocol CETS 223 (not yet in force)

§4Text and authority

Text
Authority
Consultative Committee of Convention 108 (T-PD)

§5Where it applies

Members of the body

Membership-based — check ratification status. Membership of Council of Europe does not mean a state has signed or ratified this instrument.

§6Sources and verification

Sources consulted
Verification

High confidence.

The party count is approximate; the treaty office page did not render for me.