Budapest Convention on Cybercrime

Open in Knowledge map

Sources last checked: 2026-11-09

The Council of Europe’s Convention on Cybercrime is a treaty, not a privacy law, but it decides how police can obtain data held by companies.

What it requires

Countries that join must let their authorities order a person to hand over specified computer data, and a service provider to hand over subscriber information.¹ They must also be able to order that data be preserved quickly.² These powers must have conditions and safeguards under national law.³

The Second Additional Protocol

The Protocol would let a country’s authorities send an order for subscriber information directly to a service provider in another country.⁴ It includes its own rules on protecting personal data.⁵

It takes effect three months after five countries have ratified it.⁶ The Council of Europe reported Costa Rica as the fourth to ratify, on 15 April 2026,⁷ and 52 states had signed by July 2026.⁸

Source note: the Council of Europe’s treaty office table could not be reached, so a fifth ratification since then cannot be ruled out.

References

1. Convention on Cybercrime, Article 18: Production order ↩

2. Convention on Cybercrime, Article 16: Expedited preservation ↩

3. Convention on Cybercrime, Article 15: Conditions and safeguards ↩

4. Second Additional Protocol, Article 7: Disclosure of subscriber information ↩

5. Second Additional Protocol, Article 14: Protection of personal data ↩

6. Second Additional Protocol, Article 16: Signature and entry into force ↩

7. Council of Europe: news on ratifications of the Second Additional Protocol ↩

8. Council of Europe, July 2026: Joining the Convention on Cybercrime, benefits ↩