Council of Europe. Surveillance / law enforcement access. Treaty (Protocol, CETS No. 224)
Budapest 2nd Additional ProtocolSecond Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence
Partly verified
Medium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.
§1Summary
- Synopsis
Lets authorities in one party ask service providers in another party directly for domain registration and subscriber information, and speeds up the giving of effect to orders for traffic data. It also provides for emergency mutual assistance and joint investigations. Article 14 contains a full data protection safeguards regime for the data transferred.
- Key themes
- Unique features
It allows direct cross-border requests to private providers and has a built-in data protection article that can work as a transfer basis between parties.
- SaaS relevance
Once in force, a SaaS provider could receive direct subscriber-information requests from foreign parties' authorities.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Art 14 requires notifying the transferring party of security incidents involving transferred data
- DPO
- No
- Cross-border transfers
- Art 14 safeguards govern transfers between parties
- Maximum penalty
- Set by national law
§3Dates
- Key dates
- Adopted
- Adopted 2021-11-17; opened 2022-05-12. Enters into force after 5 ratifications. Costa Rica became the 4th ratifying state on 2026-04-15.
§4Text and authority
- Text
- Authoritative text rm.coe.int
- Authority
- Cybercrime Convention Committee (T-CY)
§5Where it applies
- Members of the body
Membership-based — check ratification status. Membership of Council of Europe does not mean a state has signed or ratified this instrument.
- Albania
- Andorra
- Armenia
- Austria
- Azerbaijan
- Belgium
- Bosnia and Herzegovina
- Bulgaria
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Estonia
- Finland
- France
- Georgia
- Germany
- Greece
- Hungary
- Iceland
- Ireland
- Italy
- Latvia
- Liechtenstein
- Lithuania
- Luxembourg
- Malta
- Moldova
- Monaco
- Montenegro
- Netherlands
- North Macedonia
- Norway
- Poland
- Portugal
- Romania
- San Marino
- Serbia
- Slovakia
- Slovenia
- Spain
- Sweden
- Switzerland
- Turkey
- Ukraine
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.I could not confirm whether a fifth ratification after April 2026 has started the entry-into-force period. The five-ratification threshold comes from established references. The EU has authorised member states to ratify it.