LawyersForPeace.Online

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Budapest Convention on Cybercrime (2001) ======

//As of 1 October 2026. Information only, not legal advice – see the [[about:disclaimer|disclaimer]].//

^ Full title | Council of Europe Convention on Cybercrime (Budapest Convention, ETS No. 185) and its Second Additional Protocol (CETS No. 224) |
^ Type | Treaty (with additional protocols) |
^ Adopted by | Council of Europe (open also to non-member States) |
^ Adopted | Opened for signature on 23 November 2001 (Convention); 12 May 2022 (Second Additional Protocol) |
^ Legal status | Convention in force since 1 July 2004; 83 Parties since the accession of Seychelles on 17 September 2026 (Council of Europe); binding on Parties. Second Additional Protocol not in force: it requires five ratifications; the Council of Europe reported four (Serbia, Japan, Hungary, Costa Rica) as of 30 June 2026 |
^ Official text | [[https://www.coe.int/en/web/cybercrime/the-budapest-convention|Council of Europe – Budapest Convention]] · [[https://www.coe.int/en/web/cybercrime/second-additional-protocol|Council of Europe – Second Additional Protocol]] |
^ Subject area | Cybersecurity, cybercrime and critical infrastructure |

===== Overview =====
The Budapest Convention is a treaty on criminal law and criminal procedure concerning offences committed through computer systems. It requires Parties to criminalise certain conduct (offences against the confidentiality, integrity and availability of computer data and systems, computer-related forgery and fraud, content-related offences and copyright infringements), to provide procedural powers for investigations involving electronic evidence, and to cooperate internationally. The First Additional Protocol (ETS No. 189, 2003) concerns the criminalisation of acts of a racist and xenophobic nature committed through computer systems. The Second Additional Protocol provides for enhanced cooperation and disclosure of electronic evidence. The Convention is referred to in debates on cybercrime cooperation and in comparison with the [[law:un:cybercrime_convention|UN Convention against Cybercrime]].

===== Provisions relevant to the cyber and information sphere =====
  * **Arts. 2–6** – Illegal access, illegal interception, data interference, system interference and misuse of devices.
  * **Arts. 16–21** – Procedural powers: expedited preservation of data, production orders, search and seizure, real-time collection of traffic data and interception of content data.
  * **Art. 15** – Procedural powers are subject to conditions and safeguards, including human rights protection and the principle of proportionality.
  * **Arts. 23–35** – International cooperation, mutual assistance and a 24/7 network of contact points.
  * **Second Additional Protocol** – Direct requests to registrars for domain name registration information and to service providers for subscriber information, expedited disclosure in emergencies, joint investigation teams, and data protection safeguards (Art. 14).

===== Application to cyber and information operations =====
The Convention addresses criminal conduct by individuals and does not regulate the conduct of States as such. The Cybercrime Convention Committee (T-CY) monitors its implementation and adopts guidance notes, including on the application of the Convention's offences to attacks on critical infrastructure and to election interference: the Guidance Note on critical information infrastructure attacks (T-CY(2013)11, adopted June 2013) and the Guidance Note on election interference by malicious cyber activities (T-CY(2019)4, adopted July 2019).

===== Recent developments =====
  * 2024-06-20: The Council of Europe announces 75 Parties following accessions by Benin, Fiji and Kiribati.
  * 2026-01: 81 Parties, 2 further signatories and 14 States invited to accede (Council of Europe, SG/Inf(2026)11).
  * 2026-02-05: Hungary ratifies the Second Additional Protocol (after Serbia and Japan).
  * 2026-04-15: Costa Rica ratifies the Second Additional Protocol (fourth ratification).
  * 2026-05-06: Papua New Guinea accedes as the 82nd Party (entry into force for Papua New Guinea on 1 September 2026).
  * 2026-09-17: Seychelles accedes as the 83rd Party (entry into force for Seychelles on 1 January 2027); according to the Council of Europe, 83 Parties, 2 further signatories and 12 States invited to accede (Council of Europe).

===== Related entries =====
  * [[law:un:cybercrime_convention]]
  * [[law:coe:ai_convention]]
  * [[law:hr:iccpr]]
  * [[law:courts:cjeu_schrems2]]

===== Sources =====
  * [[https://www.coe.int/en/web/cybercrime/the-budapest-convention|Council of Europe: About the Convention]], accessed 2026-09-27
  * [[https://www.coe.int/en/web/cybercrime/second-additional-protocol|Council of Europe: Second Additional Protocol]], accessed 2026-09-27
  * [[https://rm.coe.int/sg-inf-2026-11-council-of-europe-programme-office-on-cybercrime-in-buc/48802ba213|Council of Europe, SG/Inf(2026)11 (4 May 2026)]], accessed 2026-09-27
  * [[https://www.coe.int/en/web/portal/-/budapest-convention-reaches-75-parties|Council of Europe: Budapest Convention reaches 75 Parties]], accessed 2026-09-27
  * [[https://www.coe.int/en/web/cybercrime/-/papua-new-guinea-becomes-the-82nd-party-to-the-convention-on-cybercrime|Council of Europe: Papua New Guinea becomes the 82nd Party to the Convention on Cybercrime]], accessed 2026-09-30
  * [[https://www.coe.int/en/web/cybercrime/news/-/asset_publisher/S73WWxscOuZ5/content/costa-rica-becomes-the-fourth-state-to-ratify-the-second-additional-protocol-to-the-convention-on-cybercrime|Council of Europe: Costa Rica becomes the fourth State to ratify the Second Additional Protocol]], accessed 2026-09-30
  * [[https://rm.coe.int/cybercrime-coe-update-2026-q2-full-v16-07-2026/48802ca6f2|Council of Europe: Cybercrime@CoE Update, Q2 2026]], accessed 2026-09-30
  * [[https://www.coe.int/en/web/cybercrime/t-cy-reports|Council of Europe: T-CY guidance notes]], accessed 2026-09-30
  * [[https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=185|Council of Europe Treaty Office: chart of signatures and ratifications, ETS 185]], accessed 2026-09-27
  * [[https://www.coe.int/en/web/cybercrime/t-cy-news|Council of Europe, Cybercrime Convention Committee (T-CY) news: accession of Seychelles (17 September 2026)]], accessed 2026-10-01

===== Change log =====
  * 2026-09-27: Entry created (draft).
  * 2026-09-30: Entry reviewed and finalised.
  * 2026-10-01: Accession of Seychelles added; number of Parties updated.