# Convention 108+

> Convention 108+ (Council of Europe): The only binding international data protection treaty. Region: Global. Builds with privacy tech: The regime itself mandates, pilots or funds privacy-preserving technology.

Part of the Soda Labs Privacy Hub regulation map, which reads the instruments
themselves rather than summarising the summaries: https://www.sodalabs.xyz/privacy-hub/regulation

## Key facts

- Entry type: Regulator or standard-setter
- Region: Global
- Subject: The only binding international data protection treaty
- Authority: Council of Europe
- Stance on on-chain confidentiality: Builds with privacy tech. The regime itself mandates, pilots or funds privacy-preserving technology.
- Tags: data protection, binding treaty, not in force, automated decisions
- Canonical page: https://www.sodalabs.xyz/privacy-hub/regulation/reg-convention-108

## What it actually says

The counterweight instrument, and the one that has not arrived. Convention 108+ modernises the only binding international data protection treaty open to states outside Europe, adding minimisation, proportionality, privacy by design, breach notification and a right not to be subject to decisions taken solely by automated processing. Every one of those bears directly on transaction monitoring and blockchain analytics. Article 11 still permits exceptions for national security and criminal investigation subject to necessity and proportionality, which is the hook anti-money-laundering processing hangs on. Four ratifications short of entry into force as of August 2026, eight years after opening. Set that against tax reporting under CARF beginning in 2027 and the asymmetry in this section becomes hard to miss.

## The instruments that matter

- **CETS No. 223**: amending protocol to the 1981 Convention 108, opened for signature 10 October 2018 and open to non-European states
- **What it adds**: data minimisation, proportionality, privacy by design and by default, breach notification, and a right not to be subject to decisions based solely on automated processing
- **Not yet in force**: 34 ratifications against the 38 needed since 11 October 2023; Moldova ratified on 15 May 2026 as the 34th

## Sources

- [CETS 223 signature chart](https://www.coe.int/en/web/conventions/full-list?module=signatures-by-treaty&treatynum=223)

## Related entries

- [BIS Innovation Hub](https://www.sodalabs.xyz/privacy-hub/regulation/reg-bis-innovation-hub): Central bank prototypes that build privacy on purpose
- [ISO and IEC standards](https://www.sodalabs.xyz/privacy-hub/regulation/reg-iso): The standards bodies that specify privacy instead of policing it
- [NIST](https://www.sodalabs.xyz/privacy-hub/regulation/reg-nist): The vocabulary that makes privacy claims testable
- [Basel Committee, SCO60](https://www.sodalabs.xyz/privacy-hub/regulation/reg-basel-sco60): Bank capital · the sharpest traceability rule anywhere
- [Egmont Group](https://www.sodalabs.xyz/privacy-hub/regulation/reg-egmont): How financial intelligence crosses borders
- [FATF](https://www.sodalabs.xyz/privacy-hub/regulation/reg-fatf): The source of almost every travel rule on earth