As of 1 October 2026.

The Budapest Convention is a treaty on criminal law and criminal procedure concerning offences committed through computer systems. It requires Parties to criminalise certain conduct (offences against the confidentiality, integrity and availability of computer data and systems, computer-related forgery and fraud, content-related offences and copyright infringements), to provide procedural powers for investigations involving electronic evidence, and to cooperate internationally. The First Additional Protocol (ETS No. 189, 2003) concerns the criminalisation of acts of a racist and xenophobic nature committed through computer systems. The Second Additional Protocol provides for enhanced cooperation and disclosure of electronic evidence. The Convention is referred to in debates on cybercrime cooperation and in comparison with the UN Convention against Cybercrime.

• Arts. 2–6 – Illegal access, illegal interception, data interference, system interference and misuse of devices.
• Arts. 16–21 – Procedural powers: expedited preservation of data, production orders, search and seizure, real-time collection of traffic data and interception of content data.
• Art. 15 – Procedural powers are subject to conditions and safeguards, including human rights protection and the principle of proportionality.
• Arts. 23–35 – International cooperation, mutual assistance and a 24/7 network of contact points.
• Second Additional Protocol – Direct requests to registrars for domain name registration information and to service providers for subscriber information, expedited disclosure in emergencies, joint investigation teams, and data protection safeguards (Art. 14).

The Convention addresses criminal conduct by individuals and does not regulate the conduct of States as such. The Cybercrime Convention Committee (T-CY) monitors its implementation and adopts guidance notes, including on the application of the Convention's offences to attacks on critical infrastructure and to election interference: the Guidance Note on critical information infrastructure attacks (T-CY(2013)11, adopted June 2013) and the Guidance Note on election interference by malicious cyber activities (T-CY(2019)4, adopted July 2019).

• 2024-06-20: The Council of Europe announces 75 Parties following accessions by Benin, Fiji and Kiribati.
• 2026-01: 81 Parties, 2 further signatories and 14 States invited to accede (Council of Europe, SG/Inf(2026)11).
• 2026-02-05: Hungary ratifies the Second Additional Protocol (after Serbia and Japan).
• 2026-04-15: Costa Rica ratifies the Second Additional Protocol (fourth ratification).
• 2026-05-06: Papua New Guinea accedes as the 82nd Party (entry into force for Papua New Guinea on 1 September 2026).
• 2026-09-17: Seychelles accedes as the 83rd Party (entry into force for Seychelles on 1 January 2027); according to the Council of Europe, 83 Parties, 2 further signatories and 12 States invited to accede (Council of Europe).

• cybercrime_convention
• ai_convention
• iccpr
• cjeu_schrems2

• Council of Europe: About the Convention, accessed 2026-09-27
• Council of Europe: Second Additional Protocol, accessed 2026-09-27
• Council of Europe, SG/Inf(2026)11 (4 May 2026), accessed 2026-09-27
• Council of Europe: Budapest Convention reaches 75 Parties, accessed 2026-09-27
• Council of Europe: Papua New Guinea becomes the 82nd Party to the Convention on Cybercrime, accessed 2026-09-30
• Council of Europe: Costa Rica becomes the fourth State to ratify the Second Additional Protocol, accessed 2026-09-30
• Council of Europe: Cybercrime@CoE Update, Q2 2026, accessed 2026-09-30
• Council of Europe: T-CY guidance notes, accessed 2026-09-30
• Council of Europe Treaty Office: chart of signatures and ratifications, ETS 185, accessed 2026-09-27
• Council of Europe, Cybercrime Convention Committee (T-CY) news: accession of Seychelles (17 September 2026), accessed 2026-10-01

• 2026-09-27: Entry created (draft).
• 2026-09-30: Entry reviewed and finalised.
• 2026-10-01: Accession of Seychelles added; number of Parties updated.